github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #2624] firecfg does not detect all .desktop files for cleaning #1665

New issue
Open
opened 2026-05-05 08:18:41 -06:00 by gitea-mirror · 14 comments
gitea-mirror commented 2026-05-05 08:18:41 -06:00
Owner
Copy link

Originally created by @rusty-snake on GitHub (Mar 28, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2624

Firecfg can replace DBusActivatable=true with false in .desktop files (#1574), but does not recognize all .desktop files belonging to a programm.

OS: Fedora Workstation 29 (GNOME)
Firejail: 0.9.57

Example where it occurs:

  • org.gnome.Builder.desktop gnome-builder
  • org.gnome.Logs.desktop gnome-logs
  • org.gnome.Maps.desktop gnome-maps
  • org.gnome.Epiphany.desktop epiphany
  • org.gnome.clocks.desktop gnome-clocks

Looks like no gnome- or a uppercase letter after the org.gnome. is an issue. (I don't know how firecfg scan for .desktop files).

Example where it not occurs:

  • org.gnome.gedit.desktop gedit
  • org.gnome.baobab.desktop baobab
  • ca.desrt.dconf-editor.desktop dconf-editor
  • org.gnome.Cheese.desktop cheese

Also nautilus (org.gnome.Nautilus.desktop) is cleaned up, although it does not have a firejail profile.

Originally created by @rusty-snake on GitHub (Mar 28, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2624 Firecfg can replace `DBusActivatable=true` with `false` in .desktop files (#1574), but does not recognize all .desktop files belonging to a programm. OS: Fedora Workstation 29 (GNOME) Firejail: 0.9.57 Example where it occurs: * `org.gnome.Builder.desktop` `gnome-builder` * `org.gnome.Logs.desktop` `gnome-logs` * `org.gnome.Maps.desktop` `gnome-maps` * ~`org.gnome.Epiphany.desktop` `epiphany`~ * `org.gnome.clocks.desktop` `gnome-clocks` Looks like no `gnome-` or a uppercase letter after the `org.gnome.` is an issue. (I don't know how firecfg scan for .desktop files). Example where it not occurs: * `org.gnome.gedit.desktop` `gedit` * `org.gnome.baobab.desktop` `baobab` * `ca.desrt.dconf-editor.desktop` `dconf-editor` * `org.gnome.Cheese.desktop` `cheese` ~Also `nautilus` (`org.gnome.Nautilus.desktop`) is cleaned up, although it does not have a firejail profile.~
gitea-mirror added the
bug
firecfg
 labels 2026-05-05 08:18:41 -06:00
gitea-mirror commented 2026-05-05 08:18:43 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Mar 28, 2019):

IMHO a good way to fix this is that firecfg scan in all .desktop files in /usr/share/applications for the Exec line.

<!-- gh-comment-id:477756469 --> @rusty-snake commented on GitHub (Mar 28, 2019): IMHO a good way to fix this is that firecfg scan in all .desktop files in /usr/share/applications for the Exec line.
gitea-mirror commented 2026-05-05 08:18:43 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Mar 28, 2019):

@rusty-snake Firecfg already does that, and it handles lower- and uppercase filenames. Also, nautilus does have a profile. I don't use firecfg but for fun I installed firejail from git master in an Arch Linux systemd-nspawn container. When running sudo firecfg --debug I can't reproduce what you're seeing. Both gedit and nautilus desktop files in ~/.local/share/applications have DBusActivatable=false. Have you tried to reproduce the issues with a more recent firejail version yet?

<!-- gh-comment-id:477788370 --> @ghost commented on GitHub (Mar 28, 2019): @rusty-snake Firecfg already [does that](https://github.com/netblue30/firejail/blob/69f6ad691703c6964e8fe3537ec86e45680395c9/src/firecfg/desktop_files.c), and it handles lower- and uppercase filenames. Also, [nautilus does have a profile](https://github.com/netblue30/firejail/blob/master/etc/nautilus.profile). I don't use firecfg but for fun I installed firejail from git master in an Arch Linux systemd-nspawn container. When running `sudo firecfg --debug` I can't reproduce what you're seeing. Both `gedit` and `nautilus` desktop files in ~/.local/share/applications have `DBusActivatable=false`. Have you tried to reproduce the issues with a more recent firejail version yet?
gitea-mirror commented 2026-05-05 08:18:45 -06:00
Author
Owner
Copy link

@SkewedZeppelin commented on GitHub (Mar 28, 2019):

@glitsj16 I can reproduce the report exactly, it is indeed a problem.

I think I saw a similar issue long ago on Arch when it was first implemented, where it would ignore certain .desktops.

Even in the original implementation it was an issue https://github.com/netblue30/firejail/issues/1574#issuecomment-331872888

<!-- gh-comment-id:477792481 --> @SkewedZeppelin commented on GitHub (Mar 28, 2019): @glitsj16 I can reproduce the report exactly, it is indeed a problem. I think I saw a similar issue long ago on Arch when it was first implemented, where it would ignore certain .desktops. Even in the original implementation it was an issue https://github.com/netblue30/firejail/issues/1574#issuecomment-331872888
gitea-mirror commented 2026-05-05 08:18:46 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Mar 29, 2019):

@rusty-snake Firecfg already does that, and it handles lower- and uppercase filenames.

As I say I don't know how firecfg does that internaly (I can't C).

Also, nautilus does have a profile.

Uhh, yes, your right.

Both gedit and nautilus desktop files in ~/.local/share/applications have DBusActivatable=false.

Example where it not occurs:

Yes for baobab, nautilus and gedit it works.

Have you tried to reproduce the issues with a more recent firejail version yet?

Not yet (later I wil do this with an git version). But I can't find an commit in https://github.com/netblue30/firejail/commits/master/src/firecfg/desktop_files.c that change there something.

<!-- gh-comment-id:477964189 --> @rusty-snake commented on GitHub (Mar 29, 2019): > @rusty-snake Firecfg already [does that](https://github.com/netblue30/firejail/blob/69f6ad691703c6964e8fe3537ec86e45680395c9/src/firecfg/desktop_files.c), and it handles lower- and uppercase filenames. As I say I don't know how firecfg does that internaly (I can't C). > Also, [nautilus does have a profile](https://github.com/netblue30/firejail/blob/master/etc/nautilus.profile). Uhh, yes, your right. > Both `gedit` and `nautilus` desktop files in ~/.local/share/applications have `DBusActivatable=false`. > Example where it **not** occurs: Yes for baobab, nautilus and gedit it works. > Have you tried to reproduce the issues with a more recent firejail version yet? Not yet (later I wil do this with an git version). But I can't find an commit in https://github.com/netblue30/firejail/commits/master/src/firecfg/desktop_files.c that change there something.
gitea-mirror commented 2026-05-05 08:18:47 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Mar 29, 2019):

@rusty-snake Don't worry about it too much. @SkewedZeppelin can reproduce, so you found a bug. Nice find!

<!-- gh-comment-id:477967414 --> @ghost commented on GitHub (Mar 29, 2019): @rusty-snake Don't worry about it too much. @SkewedZeppelin can reproduce, so you found a bug. Nice find!
gitea-mirror commented 2026-05-05 08:18:48 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Mar 29, 2019):

@glitsj16 just to complete: reproduced with 8e5ad20.

<!-- gh-comment-id:478034016 --> @rusty-snake commented on GitHub (Mar 29, 2019): @glitsj16 just to complete: reproduced with 8e5ad20.
gitea-mirror commented 2026-05-05 08:18:49 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Mar 30, 2019):

@rusty-snake I can reproduce now too (originally got the working/failing examples from your OP mixed-up as you pointed out). After some more testing I can only conclude that firecfg seems pretty broken.

There's more going wrong than the DBusActivatable issue IMHO. Epiphany doesn't have that entree in its .desktop file (at least not in Arch Linux and upstream git master). Allthough firecfg reports finding /etc/firejail/epiphany.profile and creates the symlink, it doesn't create a .desktop file in ~/.local/share/applications. Furthermore, epiphany is reported to exists in /bin (which is incorrect, it's in /usr/bin) by the Configuring symlinks ... part of the firecfg run, but isn't found (or reported as such) in the Fixing desktop files ... part.

$ sudo firecfg --debug
glitsj16 0 0 0 0
Removing all firejail symlinks:

Configuring symlinks in /usr/local/bin based on firecfg.config
...
found epiphany in directory /bin
   epiphany created
...
Fixing desktop files in /home/glitsj16/.local/share/applications
checking profile for org.gnome.baobab.desktop
found /etc/firejail/baobab.profile
found baobab in directory /bin
   org.gnome.baobab.desktop created
...
checking profile for org.gnome.Epiphany.desktop
found /etc/firejail/epiphany.profile
checking profile for geoclue-where-am-i.desktop
...

The other applications you mentioned indeed fail because they don't make it thru the checks in desktop_files.c during execution of the have_profile function. Which makes sense, there are in fact no profiles with those names (Builder, clocks, Logs, Maps). That's why org.gnome-logs.desktop works, and even org.gnome.Logs.desktop when you add Logs to firecfg.config and symlink the gnome-logs.profile to Logs in /etc/firejail.

Unrelated but nonetheless problematic (at least to me as a non-firecfg user) is that sudo firecfg --clean does NOT remove the .desktop files in ~/.local/share/applications it created. What happens if an upgrade changes the Exec=foo command? Or DBusActivatable=true is added? I'm marking this as a bug. Might attract attention from firecfg devs.

<!-- gh-comment-id:478198031 --> @ghost commented on GitHub (Mar 30, 2019): @rusty-snake I can reproduce now too (originally got the working/failing examples from your OP mixed-up as you pointed out). After some more testing I can only conclude that `firecfg` seems `pretty broken`. There's more going wrong than the `DBusActivatable` issue IMHO. Epiphany doesn't have that entree in its .desktop file (at least not in Arch Linux and [upstream](https://gitlab.gnome.org/GNOME/epiphany/blob/master/data/org.gnome.Epiphany.desktop.in.in) git master). Allthough firecfg reports finding /etc/firejail/epiphany.profile and creates the symlink, it doesn't create a .desktop file in ~/.local/share/applications. Furthermore, epiphany is reported to exists in /bin (which is incorrect, it's in /usr/bin) by the `Configuring symlinks ...` part of the firecfg run, but isn't found (or reported as such) in the `Fixing desktop files ...` part. ``` $ sudo firecfg --debug glitsj16 0 0 0 0 Removing all firejail symlinks: Configuring symlinks in /usr/local/bin based on firecfg.config ... found epiphany in directory /bin epiphany created ... Fixing desktop files in /home/glitsj16/.local/share/applications checking profile for org.gnome.baobab.desktop found /etc/firejail/baobab.profile found baobab in directory /bin org.gnome.baobab.desktop created ... checking profile for org.gnome.Epiphany.desktop found /etc/firejail/epiphany.profile checking profile for geoclue-where-am-i.desktop ... ``` The other applications you mentioned indeed fail because they don't make it thru the checks in [desktop_files.c](https://github.com/netblue30/firejail/blob/69f6ad691703c6964e8fe3537ec86e45680395c9/src/firecfg/desktop_files.c) during execution of the `have_profile` [function](https://github.com/netblue30/firejail/blob/master/src/firecfg/desktop_files.c#L52). Which makes sense, there are in fact no profiles with those names (Builder, clocks, Logs, Maps). That's why org.gnome-logs.desktop works, and even org.gnome.Logs.desktop when you add Logs to firecfg.config and symlink the gnome-logs.profile to Logs in /etc/firejail. Unrelated but nonetheless problematic (at least to me as a non-firecfg user) is that `sudo firecfg --clean` does **NOT** remove the .desktop files in ~/.local/share/applications it created. What happens if an upgrade changes the Exec=foo command? Or DBusActivatable=true is added? I'm marking this as a bug. Might attract attention from firecfg devs.
gitea-mirror commented 2026-05-05 08:18:50 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Apr 2, 2019):

@rusty-snake Just pushed a temporary fix. Lets keep this open until a proper fix is available. Thanks again for reporting!

<!-- gh-comment-id:478922906 --> @ghost commented on GitHub (Apr 2, 2019): @rusty-snake Just pushed a temporary fix. Lets keep this open until a proper fix is available. Thanks again for reporting!
gitea-mirror commented 2026-05-05 08:18:50 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 24, 2020):

@glitsj16 If I read the desktop_file.c right, it doesn't search for Exec, it only checks the names.

Not only DBus cleaning is sometimes broken, also Exec cleaning (see #3179).

<!-- gh-comment-id:578308375 --> @rusty-snake commented on GitHub (Jan 24, 2020): @glitsj16 If I read the desktop_file.c right, it doesn't search for Exec, it only checks the names. --- Not only DBus cleaning is sometimes broken, also Exec cleaning (see #3179).
gitea-mirror commented 2026-05-05 08:18:50 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Jan 24, 2020):

Not only DBus cleaning is sometimes broken, also Exec cleaning (see #3179).

@rusty-snake It is indeed. I'm collecting info to try to fix firecfg, but it will take a few days at least. Thanks for the input 👍 .

<!-- gh-comment-id:578312484 --> @ghost commented on GitHub (Jan 24, 2020): > Not only DBus cleaning is sometimes broken, also Exec cleaning (see #3179). @rusty-snake It is indeed. I'm collecting info to try to fix firecfg, but it will take a few days at least. Thanks for the input :+1: .
gitea-mirror commented 2026-05-05 08:18:51 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 24, 2020):

@glitsj16 I have written something in python, I have to test it and will post it tomorrow.

<!-- gh-comment-id:578316692 --> @rusty-snake commented on GitHub (Jan 24, 2020): @glitsj16 I have written something in python, I have to test it and will post it tomorrow.
gitea-mirror commented 2026-05-05 08:18:51 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 25, 2020):

@glitsj16 https://gist.github.com/rusty-snake/3e4b8f8555e942d2964a181d4a5f64a0

<!-- gh-comment-id:578393300 --> @rusty-snake commented on GitHub (Jan 25, 2020): @glitsj16 https://gist.github.com/rusty-snake/3e4b8f8555e942d2964a181d4a5f64a0
gitea-mirror commented 2026-05-05 08:18:52 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 25, 2020):

Quick diff

firecfg:

  • total: 12
  • overkill: 1 (Nautilus)
  • workaround: 3 (Maps (only DBus), Logs, Builder)
  • hardcoded gnome-maps fix: 0

firecfg.py:

  • total: 17
  • overkill: 0
  • workaround: 0
  • hardcoded gnome-maps fix: 1
<!-- gh-comment-id:578422476 --> @rusty-snake commented on GitHub (Jan 25, 2020): ### Quick diff firecfg: - total: 12 - overkill: 1 (Nautilus) - workaround: 3 (Maps (only DBus), Logs, Builder) - hardcoded gnome-maps fix: 0 firecfg.py: - total: 17 - overkill: 0 - workaround: 0 - hardcoded gnome-maps fix: 1
gitea-mirror commented 2026-05-05 08:18:52 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Jan 25, 2020):

@rusty-snake I'll have to do some more testing but your python script seems to work fine. It's too bad that firecfg bugs haven't been getting the attention they need. Hopefully this will change soon.

<!-- gh-comment-id:578432008 --> @ghost commented on GitHub (Jan 25, 2020): @rusty-snake I'll have to do some more testing but your python script seems to work fine. It's too bad that firecfg bugs haven't been getting the attention they need. Hopefully this will change soon.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1665
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?