github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2538] firejail-default apparmor profile breaks code-oss #1636

New issue

Closed

opened 2026-05-05 08:17:23 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:17:23 -06:00

Owner

Originally created by @njfox on GitHub (Mar 7, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2538

code/code-oss does not work in firejail with apparmor support enabled. It looks like it's trying to open something with w permissions when it launches and is getting denied. Here are the entries in /var/log/audit/audit.log when trying to launch code in firejail:

type=AVC msg=audit(1551992530.121:191): apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/17/comm" pid=9178 comm="electron" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1551992261.059:189): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7acf5722b140 a2=80001 a3=0 items=0 ppid=8641 pid=8658 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm="electron" exe="/usr/lib/electron/electron" subj==firejail-default (enforce) key=(null)
type=PROCTITLE msg=audit(1551992261.059:189): proctitle=2F7573722F6C69622F656C656374726F6E2F656C656374726F6E202D2D756E6974792D6C61756E6368202F7573722F6C69622F636F64652F636F64652E6A73

I've also confirmed apparmor is the problem by launching the application with the default code.profile without apparmor, and it works fine. Does anyone have any ideas on how to troubleshoot?

Originally created by @njfox on GitHub (Mar 7, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2538 `code`/`code-oss` does not work in firejail with `apparmor` support enabled. It looks like it's trying to open something with `w` permissions when it launches and is getting denied. Here are the entries in `/var/log/audit/audit.log` when trying to launch `code` in firejail: ``` type=AVC msg=audit(1551992530.121:191): apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/17/comm" pid=9178 comm="electron" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000 type=SYSCALL msg=audit(1551992261.059:189): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7acf5722b140 a2=80001 a3=0 items=0 ppid=8641 pid=8658 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=2 comm="electron" exe="/usr/lib/electron/electron" subj==firejail-default (enforce) key=(null) type=PROCTITLE msg=audit(1551992261.059:189): proctitle=2F7573722F6C69622F656C656374726F6E2F656C656374726F6E202D2D756E6974792D6C61756E6368202F7573722F6C69622F636F64652F636F64652E6A73 ``` I've also confirmed `apparmor` is the problem by launching the application with the default `code.profile` without apparmor, and it works fine. Does anyone have any ideas on how to troubleshoot?

gitea-mirror closed this issue

2026-05-05 08:17:24 -06:00

gitea-mirror commented

2026-05-05 08:17:26 -06:00

Author

Owner

@Vincent43 commented on GitHub (Mar 7, 2019):

You may try to add /proc/@{PID}/comm w, in /etc/apparmor.d/local/firejail-local. Then reload firejail profile with apparmor_parser -r /etc/apparmor.d/firejail-default as root.

@Vincent43 commented on GitHub (Mar 7, 2019): You may try to add `/proc/@{PID}/comm w,` in `/etc/apparmor.d/local/firejail-local`. Then reload firejail profile with `apparmor_parser -r /etc/apparmor.d/firejail-default` as root.

gitea-mirror commented

2026-05-05 08:17:27 -06:00

Author

Owner

@njfox commented on GitHub (Mar 7, 2019):

That worked, thanks! Is this something that should be considered for the default firejail apparmor policy?

@njfox commented on GitHub (Mar 7, 2019): That worked, thanks! Is this something that should be considered for the default firejail apparmor policy?

gitea-mirror commented

2026-05-05 08:17:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 20, 2019):

Closing here because the issue is solved.

Additional: echoing @njfox question

Is this something that should be considered for the default firejail apparmor policy?

@rusty-snake commented on GitHub (Apr 20, 2019): Closing here because the issue is solved. Additional: echoing @njfox question > Is this something that should be considered for the default firejail apparmor policy?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1636

No description provided.

Rows
Columns