[GH-ISSUE #2669] Remove the need for QTWEBENGINE_DISABLE_SANDBOX=1 (appimage)

gitea-mirror commented

2026-05-05 08:19:51 -06:00

Owner

Originally created by @probonopd on GitHub (Apr 30, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2669

QTWEBENGINE_DISABLE_SANDBOX=1 may be needed to run Qt applications that use QtWebEngine under Firejail.

At least this is the case for https://appimage.github.io/Galacteek/.

Would it make sense to have Firejail set this environment variable globally? I see it already exists in the source code but is commented out.

Originally created by @probonopd on GitHub (Apr 30, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2669 `QTWEBENGINE_DISABLE_SANDBOX=1` may be needed to run Qt applications that use QtWebEngine under Firejail. At least this is the case for https://appimage.github.io/Galacteek/. Would it make sense to have Firejail set this environment variable globally? I see it already exists in the source code but is commented out.

gitea-mirror

2026-05-05 08:19:51 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 08:19:54 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 30, 2019):

Currently this is only set for Viber,

Also see here.

@rusty-snake commented on GitHub (Apr 30, 2019): Currently this is only set for Viber, Also see [here](https://github.com/netblue30/firejail/pull/2295).

gitea-mirror commented

2026-05-05 08:19:55 -06:00

Author

Owner

@probonopd commented on GitHub (May 1, 2019):

Is it already known under which circumstances QtWebEngine needs this option?

@probonopd commented on GitHub (May 1, 2019): Is it already known under which circumstances QtWebEngine needs this option?

gitea-mirror commented

2026-05-05 08:19:56 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 1, 2019):

I would say it should be never added. Firejail sandbox should be tweaked instead.

@Vincent43 commented on GitHub (May 1, 2019): I would say it should be never added. Firejail sandbox should be tweaked instead.

gitea-mirror commented

2026-05-05 08:19:57 -06:00

Author

Owner

@probonopd commented on GitHub (May 3, 2019):

Listing here which applications needs this:

GAMS Studio https://github.com/AppImage/appimage.github.io/pull/536
Plex https://github.com/AppImage/appimage.github.io/pull/132
Sielo Browser https://github.com/AppImage/appimage.github.io/pull/552

@probonopd commented on GitHub (May 3, 2019): Listing here which applications needs this: * GAMS Studio https://github.com/AppImage/appimage.github.io/pull/536 * Plex https://github.com/AppImage/appimage.github.io/pull/132 * Sielo Browser https://github.com/AppImage/appimage.github.io/pull/552

gitea-mirror commented

2026-05-05 08:19:58 -06:00

Author

Owner

@smitsohu commented on GitHub (May 4, 2019):

Is it already known under which circumstances QtWebEngine needs this option?

Always (given that unprivileged user namespaces are enabled).

It's all about the chroot syscall being included in the default seccomp filter. As this is an increasingly common problem, would it justify a new option?

@smitsohu commented on GitHub (May 4, 2019): > Is it already known under which circumstances QtWebEngine needs this option? Always (given that unprivileged user namespaces are enabled). It's all about the chroot syscall being included in the default seccomp filter. As this is an increasingly common problem, would it justify a new option?

gitea-mirror commented

2026-05-05 08:20:00 -06:00

Author

Owner

@probonopd commented on GitHub (May 5, 2019):

It would be best if it would not need a special option to be invoked by the user. (If the user has to do something, then QTWEBENGINE_DISABLE_SANDBOX=1 is fine imho.)

@probonopd commented on GitHub (May 5, 2019): It would be best if it would not need a special option to be invoked by the user. (If the user has to do something, then `QTWEBENGINE_DISABLE_SANDBOX=1` is fine imho.)

gitea-mirror commented

2026-05-05 08:20:01 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 6, 2019):

It's all about the chroot syscall being included in the default seccomp filter. As this is an increasingly common problem, would it justify a new option?

Maybe tweak seccomp rule to allow defining firejail defaults +/- a chosen syscall,
like seccomp +chroot?

@Vincent43 commented on GitHub (May 6, 2019): > It's all about the chroot syscall being included in the default seccomp filter. As this is an increasingly common problem, would it justify a new option? Maybe tweak `seccomp` rule to allow defining firejail defaults +/- a chosen syscall, like `seccomp +chroot`?

gitea-mirror commented

2026-05-05 08:20:03 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 26, 2019):

I think we schould implement @Vincent43 idea

@rusty-snake commented on GitHub (Jun 26, 2019): I think we schould implement @Vincent43 idea

gitea-mirror commented

2026-05-05 08:20:04 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 26, 2019):

How future proceed here?

@rusty-snake commented on GitHub (Aug 26, 2019): How future proceed here?

gitea-mirror commented

2026-05-05 08:20:04 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 26, 2019):

Adding this to Viber.profile and removing env QTWEBENGINE_DISABLE_SANDBOX=1 from there should be enough to close this. You may include this in https://github.com/netblue30/firejail/pull/2927 and wait till https://github.com/netblue30/firejail/pull/2926 is merged.

@Vincent43 commented on GitHub (Aug 26, 2019): Adding [this](https://github.com/netblue30/firejail/pull/2927/files#diff-804b7cf50c334c0afd185b5be88e0139R28) to Viber.profile and removing `env QTWEBENGINE_DISABLE_SANDBOX=1` from there should be enough to close this. You may include this in https://github.com/netblue30/firejail/pull/2927 and wait till https://github.com/netblue30/firejail/pull/2926 is merged.

gitea-mirror commented

2026-05-05 08:20:05 -06:00

Author

Owner

@probonopd commented on GitHub (Aug 28, 2019):

Well, I'd say this ticket can be closed once we the user won't need to manually run env QTWEBENGINE_DISABLE_SANDBOX=1 anywhere anymore, not just for Viber.

@probonopd commented on GitHub (Aug 28, 2019): Well, I'd say this ticket can be closed once we the user won't need to manually run `env QTWEBENGINE_DISABLE_SANDBOX=1` anywhere anymore, not just for Viber.

gitea-mirror commented

2026-05-05 08:20:06 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 28, 2019):

@probonopd you mean appimage apps? They seem to use default.profile. The only fix I see is to remove chroot from default seccomp filter.

@Vincent43 commented on GitHub (Aug 28, 2019): @probonopd you mean appimage apps? They seem to use `default.profile`. The only fix I see is to remove `chroot` from default seccomp filter.

gitea-mirror commented

2026-05-05 08:20:07 -06:00

Author

Owner

@probonopd commented on GitHub (Aug 30, 2019):

Yes, I mean AppImage apps. What would the security implications be of what you are suggesting? Would the FIrejail sandboxing still be effective?

If we have to disable either FIrejail's or Chrome's sandbox, then I'd say enable Firejail's and disable Chrome's, e.g., by exporting QTWEBENGINE_DISABLE_SANDBOX=1 all the time.

@probonopd commented on GitHub (Aug 30, 2019): Yes, I mean AppImage apps. What would the security implications be of what you are suggesting? Would the FIrejail sandboxing still be effective? If we have to disable either FIrejail's or Chrome's sandbox, then I'd say enable Firejail's and disable Chrome's, e.g., by exporting `QTWEBENGINE_DISABLE_SANDBOX=1` all the time.

gitea-mirror commented

2026-05-05 08:20:07 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 30, 2019):

We just need to allow one additional syscall (chroot) which many apps use for self-sandboxing. Everything else will stay intact and app will be protected by both firejail and chrome sandboxing.

@Vincent43 commented on GitHub (Aug 30, 2019): We just need to allow one additional syscall (`chroot`) which many apps use for self-sandboxing. Everything else will stay intact and app will be protected by both firejail and chrome sandboxing.

gitea-mirror commented

2026-05-05 08:20:08 -06:00

Author

Owner

@probonopd commented on GitHub (Sep 4, 2019):

Thank you very much.

@probonopd commented on GitHub (Sep 4, 2019): Thank you very much.

gitea-mirror commented

2026-05-05 08:20:09 -06:00

Author

Owner

@smitsohu commented on GitHub (Sep 5, 2019):

@Vincent43 Maybe rather than removing chroot from the default seccomp blacklist, we could just remove it from default.profile? (or I understood you wrong and that was what you were saying)

@smitsohu commented on GitHub (Sep 5, 2019): @Vincent43 Maybe rather than removing `chroot` from the default seccomp blacklist, we could just remove it from default.profile? (or I understood you wrong and that was what you were saying)

gitea-mirror commented

2026-05-05 08:20:09 -06:00

Author

Owner

@Vincent43 commented on GitHub (Sep 5, 2019):

@smitsohu chroot breaks most electron apps and will ultimately break all of them once they update to latest version. It's no longer suitable default in apps world.

@Vincent43 commented on GitHub (Sep 5, 2019): @smitsohu `chroot` breaks most electron apps and will ultimately break all of them once they update to latest version. It's no longer suitable default in apps world.

Rows
Columns

[GH-ISSUE #2669] Remove the need for QTWEBENGINE_DISABLE_SANDBOX=1 (appimage) #1685