[GH-ISSUE #2703] Firefox is Working Only in Noprofile mode, is this normal? "New User" #1702

Closed
opened 2026-05-05 08:21:35 -06:00 by gitea-mirror · 5 comments
Owner

Originally created by @VampireFox2 on GitHub (May 17, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2703

Hi,

This is my first time ever working with Firejail and I'm liking it so far. So I installed the firejail-apparmor_0.9.58.2_1_amd64.deb and firetools_0.9.58_1_amd64.deb files and went through "Section 1. Technology" and "Section 2. Usage and Configuration basic usage" in the guide.

I didn't use the pakages in the Ubuntu repositories because their a bit outdated:

firejail/bionic 0.9.52-2 i386
sandbox to restrict the application environment

firejail-profiles/bionic,bionic 0.9.52-2 all
profiles for the firejail application sandbox

firetools/bionic 0.9.50-1 i386
Qt frontend for the Firejail application sandbox

It seems that Firefox is working fine when I open it from the Unity launcher because I can see it's running after running this command:

firejail --top

if I run

firejail firefox I get the following output and it doesn't open:

Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 8515, child pid 8516 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Post-exec seccomp protector enabled Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @default-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,finit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver,ioperm,iopl,kexec_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,vhangup,vmsplice, Child process initialized in 89.75 ms Error: execute permission denied for /usr/local/bin/firefox Error: no suitable firefox executable found

However if I run firejail --noprofile firefox is does open.

Is this normal? Please forgive me as I am a new user and new to using sandboxing apps in general. I just want to confirm that I have everything setup and working the way it's supposed to.

I have apparmor enabled and have these firefox profiles in enforcing mode.

/usr/lib/firefox/firefox{,[^s][^h]}
/usr/lib/firefox/firefox{,
[^s][^h]}//browser_java
/usr/lib/firefox/firefox{,[^s][^h]}//browser_openjdk
/usr/lib/firefox/firefox{,
[^s][^h]}//lsb_release
/usr/lib/firefox/firefox{,*[^s][^h]}//sanitized_helper

I'm on Ubuntu 18.04.2 LTS

Apparmor support is also enabled in firejail.

Also I had a question regarding Firefox. Should I install all my addons before or after setting up Firejail? Thank you so much for you time and for creating an awesome application.

Originally created by @VampireFox2 on GitHub (May 17, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2703 Hi, This is my first time ever working with Firejail and I'm liking it so far. So I installed the **firejail-apparmor_0.9.58.2_1_amd64.deb** and **firetools_0.9.58_1_amd64.deb** files and went through **"Section 1. Technology"** and **"Section 2. Usage and Configuration basic usage"** in the guide. I didn't use the pakages in the Ubuntu repositories because their a bit outdated: > firejail/bionic 0.9.52-2 i386 > sandbox to restrict the application environment > > firejail-profiles/bionic,bionic 0.9.52-2 all > profiles for the firejail application sandbox > > firetools/bionic 0.9.50-1 i386 > Qt frontend for the Firejail application sandbox It seems that Firefox is working fine when I open it from the Unity launcher because I can see it's running after running this command: `firejail --top` if I run `firejail firefox` I get the following output and it doesn't open: `Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 8515, child pid 8516 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Post-exec seccomp protector enabled Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @default-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,finit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver,ioperm,iopl,kexec_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,vhangup,vmsplice, Child process initialized in 89.75 ms Error: execute permission denied for /usr/local/bin/firefox Error: no suitable firefox executable found ` However if I run `firejail --noprofile firefox` is does open. Is this normal? Please forgive me as I am a new user and new to using sandboxing apps in general. I just want to confirm that I have everything setup and working the way it's supposed to. I have apparmor enabled and have these firefox profiles in enforcing mode. > /usr/lib/firefox/firefox{,*[^s][^h]} > /usr/lib/firefox/firefox{,*[^s][^h]}//browser_java > /usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk > /usr/lib/firefox/firefox{,*[^s][^h]}//lsb_release > /usr/lib/firefox/firefox{,*[^s][^h]}//sanitized_helper I'm on Ubuntu 18.04.2 LTS Apparmor support is also enabled in firejail. Also I had a question regarding Firefox. Should I install all my addons before or after setting up Firejail? Thank you so much for you time and for creating an awesome application.
Author
Owner

@rusty-snake commented on GitHub (May 17, 2019):

@VampireFox2 can you try firejail --ignore=apparmor firefox and past firejail --debug firefox.

PS: With 3 ` you can do a codeblock with linebreaks inside.

Also I had a question regarding Firefox. Should I install all my addons before or after setting up Firejail?

You can do both. I would prefer always running firefox in firejail.

<!-- gh-comment-id:493440745 --> @rusty-snake commented on GitHub (May 17, 2019): @VampireFox2 can you try `firejail --ignore=apparmor firefox` and past `firejail --debug firefox`. PS: With 3 ` you can do a codeblock with linebreaks inside. > Also I had a question regarding Firefox. Should I install all my addons before or after setting up Firejail? You can do both. I would prefer always running firefox in firejail.
Author
Owner

@VampireFox2 commented on GitHub (May 17, 2019):

So I ran firejail --ignore=apparmor firefox and got the same output as running firejail firefox.

So towards the end of the output after running firejail --debug firefox this is displayed:

Dropping all capabilities
Drop privileges: pid 9, uid 1000, gid 1000, nogroups 1
No supplementary groups
configuring 70 seccomp entries in /run/firejail/mnt/seccomp
sbox run: /usr/lib/firejail/fsec-print /run/firejail/mnt/seccomp (null) 
Dropping all capabilities
Drop privileges: pid 10, uid 1000, gid 1000, nogroups 1
No supplementary groups
 line  OP JT JF    K
=================================
 0000: 20 00 00 00000004   ld  data.architecture
 0001: 15 01 00 c000003e   jeq ARCH_64 0003 (false 0002)
 0002: 06 00 00 7fff0000   ret ALLOW
 0003: 20 00 00 00000000   ld  data.syscall-number
 0004: 35 01 00 40000000   jge X32_ABI 0006 (false 0005)
 0005: 35 01 00 00000000   jge read 0007 (false 0006)
 0006: 06 00 00 00050001   ret ERRNO(1)
 0007: 15 3d 00 0000009f   jeq adjtimex 0045 (false 0008)
 0008: 15 3c 00 00000131   jeq clock_adjtime 0045 (false 0009)
 0009: 15 3b 00 000000e3   jeq clock_settime 0045 (false 000a)
 000a: 15 3a 00 000000a4   jeq settimeofday 0045 (false 000b)
 000b: 15 39 00 0000009a   jeq modify_ldt 0045 (false 000c)
 000c: 15 38 00 000000d4   jeq lookup_dcookie 0045 (false 000d)
 000d: 15 37 00 0000012a   jeq perf_event_open 0045 (false 000e)
 000e: 15 36 00 00000137   jeq process_vm_writev 0045 (false 000f)
 000f: 15 35 00 000000b0   jeq delete_module 0045 (false 0010)
 0010: 15 34 00 00000139   jeq finit_module 0045 (false 0011)
 0011: 15 33 00 000000af   jeq init_module 0045 (false 0012)
 0012: 15 32 00 0000009c   jeq _sysctl 0045 (false 0013)
 0013: 15 31 00 000000b7   jeq afs_syscall 0045 (false 0014)
 0014: 15 30 00 000000ae   jeq create_module 0045 (false 0015)
 0015: 15 2f 00 000000b1   jeq get_kernel_syms 0045 (false 0016)
 0016: 15 2e 00 000000b5   jeq getpmsg 0045 (false 0017)
 0017: 15 2d 00 000000b6   jeq putpmsg 0045 (false 0018)
 0018: 15 2c 00 000000b2   jeq query_module 0045 (false 0019)
 0019: 15 2b 00 000000b9   jeq security 0045 (false 001a)
 001a: 15 2a 00 0000008b   jeq sysfs 0045 (false 001b)
 001b: 15 29 00 000000b8   jeq tuxcall 0045 (false 001c)
 001c: 15 28 00 00000086   jeq uselib 0045 (false 001d)
 001d: 15 27 00 00000088   jeq ustat 0045 (false 001e)
 001e: 15 26 00 000000ec   jeq vserver 0045 (false 001f)
 001f: 15 25 00 000000ad   jeq ioperm 0045 (false 0020)
 0020: 15 24 00 000000ac   jeq iopl 0045 (false 0021)
 0021: 15 23 00 000000f6   jeq kexec_load 0045 (false 0022)
 0022: 15 22 00 000000a9   jeq reboot 0045 (false 0023)
 0023: 15 21 00 000000ee   jeq set_mempolicy 0045 (false 0024)
 0024: 15 20 00 00000100   jeq migrate_pages 0045 (false 0025)
 0025: 15 1f 00 00000117   jeq move_pages 0045 (false 0026)
 0026: 15 1e 00 000000ed   jeq mbind 0045 (false 0027)
 0027: 15 1d 00 000000a7   jeq swapon 0045 (false 0028)
 0028: 15 1c 00 000000a8   jeq swapoff 0045 (false 0029)
 0029: 15 1b 00 000000a3   jeq acct 0045 (false 002a)
 002a: 15 1a 00 000000f8   jeq add_key 0045 (false 002b)
 002b: 15 19 00 0000012c   jeq fanotify_init 0045 (false 002c)
 002c: 15 18 00 000000d2   jeq io_cancel 0045 (false 002d)
 002d: 15 17 00 000000cf   jeq io_destroy 0045 (false 002e)
 002e: 15 16 00 000000d0   jeq io_getevents 0045 (false 002f)
 002f: 15 15 00 000000ce   jeq io_setup 0045 (false 0030)
 0030: 15 14 00 000000d1   jeq io_submit 0045 (false 0031)
 0031: 15 13 00 000000fb   jeq ioprio_set 0045 (false 0032)
 0032: 15 12 00 00000138   jeq kcmp 0045 (false 0033)
 0033: 15 11 00 000000fa   jeq keyctl 0045 (false 0034)
 0034: 15 10 00 000000a5   jeq mount 0045 (false 0035)
 0035: 15 0f 00 0000012f   jeq name_to_handle_at 0045 (false 0036)
 0036: 15 0e 00 000000b4   jeq nfsservctl 0045 (false 0037)
 0037: 15 0d 00 00000130   jeq open_by_handle_at 0045 (false 0038)
 0038: 15 0c 00 00000087   jeq personality 0045 (false 0039)
 0039: 15 0b 00 0000009b   jeq pivot_root 0045 (false 003a)
 003a: 15 0a 00 00000136   jeq process_vm_readv 0045 (false 003b)
 003b: 15 09 00 00000065   jeq ptrace 0045 (false 003c)
 003c: 15 08 00 000000d8   jeq remap_file_pages 0045 (false 003d)
 003d: 15 07 00 000000f9   jeq request_key 0045 (false 003e)
 003e: 15 06 00 000000ab   jeq setdomainname 0045 (false 003f)
 003f: 15 05 00 000000aa   jeq sethostname 0045 (false 0040)
 0040: 15 04 00 00000067   jeq syslog 0045 (false 0041)
 0041: 15 03 00 000000a6   jeq umount2 0045 (false 0042)
 0042: 15 02 00 00000099   jeq vhangup 0045 (false 0043)
 0043: 15 01 00 00000116   jeq vmsplice 0045 (false 0044)
 0044: 06 00 00 7fff0000   ret ALLOW
 0045: 06 00 01 00000000   ret KILL
seccomp filter configured
noroot user namespace installed
Dropping all capabilities
NO_NEW_PRIVS set
Drop privileges: pid 1, uid 1000, gid 1000, nogroups 1
No supplementary groups
AppArmor enabled
starting application
LD_PRELOAD=(null)
execvp argument 0: firefox
Child process initialized in 118.20 ms
Searching $PATH for firefox
trying #/usr/local/sbin/firefox#
trying #/usr/local/bin/firefox#
Error: execute permission denied for /usr/local/bin/firefox
Installing /run/firejail/mnt/seccomp seccomp filter
Installing /run/firejail/mnt/seccomp.protocol seccomp filter
Error: no suitable firefox executable found
monitoring pid 11

Sandbox monitor: waitpid 11 retval 11 status 256

Parent is shutting down, bye...

I guess it's having some troubles with Firefox.

<!-- gh-comment-id:493522264 --> @VampireFox2 commented on GitHub (May 17, 2019): So I ran `firejail --ignore=apparmor firefox` and got the same output as running `firejail firefox`. So towards the end of the output after running `firejail --debug firefox` this is displayed: ``` Dropping all capabilities Drop privileges: pid 9, uid 1000, gid 1000, nogroups 1 No supplementary groups configuring 70 seccomp entries in /run/firejail/mnt/seccomp sbox run: /usr/lib/firejail/fsec-print /run/firejail/mnt/seccomp (null) Dropping all capabilities Drop privileges: pid 10, uid 1000, gid 1000, nogroups 1 No supplementary groups line OP JT JF K ================================= 0000: 20 00 00 00000004 ld data.architecture 0001: 15 01 00 c000003e jeq ARCH_64 0003 (false 0002) 0002: 06 00 00 7fff0000 ret ALLOW 0003: 20 00 00 00000000 ld data.syscall-number 0004: 35 01 00 40000000 jge X32_ABI 0006 (false 0005) 0005: 35 01 00 00000000 jge read 0007 (false 0006) 0006: 06 00 00 00050001 ret ERRNO(1) 0007: 15 3d 00 0000009f jeq adjtimex 0045 (false 0008) 0008: 15 3c 00 00000131 jeq clock_adjtime 0045 (false 0009) 0009: 15 3b 00 000000e3 jeq clock_settime 0045 (false 000a) 000a: 15 3a 00 000000a4 jeq settimeofday 0045 (false 000b) 000b: 15 39 00 0000009a jeq modify_ldt 0045 (false 000c) 000c: 15 38 00 000000d4 jeq lookup_dcookie 0045 (false 000d) 000d: 15 37 00 0000012a jeq perf_event_open 0045 (false 000e) 000e: 15 36 00 00000137 jeq process_vm_writev 0045 (false 000f) 000f: 15 35 00 000000b0 jeq delete_module 0045 (false 0010) 0010: 15 34 00 00000139 jeq finit_module 0045 (false 0011) 0011: 15 33 00 000000af jeq init_module 0045 (false 0012) 0012: 15 32 00 0000009c jeq _sysctl 0045 (false 0013) 0013: 15 31 00 000000b7 jeq afs_syscall 0045 (false 0014) 0014: 15 30 00 000000ae jeq create_module 0045 (false 0015) 0015: 15 2f 00 000000b1 jeq get_kernel_syms 0045 (false 0016) 0016: 15 2e 00 000000b5 jeq getpmsg 0045 (false 0017) 0017: 15 2d 00 000000b6 jeq putpmsg 0045 (false 0018) 0018: 15 2c 00 000000b2 jeq query_module 0045 (false 0019) 0019: 15 2b 00 000000b9 jeq security 0045 (false 001a) 001a: 15 2a 00 0000008b jeq sysfs 0045 (false 001b) 001b: 15 29 00 000000b8 jeq tuxcall 0045 (false 001c) 001c: 15 28 00 00000086 jeq uselib 0045 (false 001d) 001d: 15 27 00 00000088 jeq ustat 0045 (false 001e) 001e: 15 26 00 000000ec jeq vserver 0045 (false 001f) 001f: 15 25 00 000000ad jeq ioperm 0045 (false 0020) 0020: 15 24 00 000000ac jeq iopl 0045 (false 0021) 0021: 15 23 00 000000f6 jeq kexec_load 0045 (false 0022) 0022: 15 22 00 000000a9 jeq reboot 0045 (false 0023) 0023: 15 21 00 000000ee jeq set_mempolicy 0045 (false 0024) 0024: 15 20 00 00000100 jeq migrate_pages 0045 (false 0025) 0025: 15 1f 00 00000117 jeq move_pages 0045 (false 0026) 0026: 15 1e 00 000000ed jeq mbind 0045 (false 0027) 0027: 15 1d 00 000000a7 jeq swapon 0045 (false 0028) 0028: 15 1c 00 000000a8 jeq swapoff 0045 (false 0029) 0029: 15 1b 00 000000a3 jeq acct 0045 (false 002a) 002a: 15 1a 00 000000f8 jeq add_key 0045 (false 002b) 002b: 15 19 00 0000012c jeq fanotify_init 0045 (false 002c) 002c: 15 18 00 000000d2 jeq io_cancel 0045 (false 002d) 002d: 15 17 00 000000cf jeq io_destroy 0045 (false 002e) 002e: 15 16 00 000000d0 jeq io_getevents 0045 (false 002f) 002f: 15 15 00 000000ce jeq io_setup 0045 (false 0030) 0030: 15 14 00 000000d1 jeq io_submit 0045 (false 0031) 0031: 15 13 00 000000fb jeq ioprio_set 0045 (false 0032) 0032: 15 12 00 00000138 jeq kcmp 0045 (false 0033) 0033: 15 11 00 000000fa jeq keyctl 0045 (false 0034) 0034: 15 10 00 000000a5 jeq mount 0045 (false 0035) 0035: 15 0f 00 0000012f jeq name_to_handle_at 0045 (false 0036) 0036: 15 0e 00 000000b4 jeq nfsservctl 0045 (false 0037) 0037: 15 0d 00 00000130 jeq open_by_handle_at 0045 (false 0038) 0038: 15 0c 00 00000087 jeq personality 0045 (false 0039) 0039: 15 0b 00 0000009b jeq pivot_root 0045 (false 003a) 003a: 15 0a 00 00000136 jeq process_vm_readv 0045 (false 003b) 003b: 15 09 00 00000065 jeq ptrace 0045 (false 003c) 003c: 15 08 00 000000d8 jeq remap_file_pages 0045 (false 003d) 003d: 15 07 00 000000f9 jeq request_key 0045 (false 003e) 003e: 15 06 00 000000ab jeq setdomainname 0045 (false 003f) 003f: 15 05 00 000000aa jeq sethostname 0045 (false 0040) 0040: 15 04 00 00000067 jeq syslog 0045 (false 0041) 0041: 15 03 00 000000a6 jeq umount2 0045 (false 0042) 0042: 15 02 00 00000099 jeq vhangup 0045 (false 0043) 0043: 15 01 00 00000116 jeq vmsplice 0045 (false 0044) 0044: 06 00 00 7fff0000 ret ALLOW 0045: 06 00 01 00000000 ret KILL seccomp filter configured noroot user namespace installed Dropping all capabilities NO_NEW_PRIVS set Drop privileges: pid 1, uid 1000, gid 1000, nogroups 1 No supplementary groups AppArmor enabled starting application LD_PRELOAD=(null) execvp argument 0: firefox Child process initialized in 118.20 ms Searching $PATH for firefox trying #/usr/local/sbin/firefox# trying #/usr/local/bin/firefox# Error: execute permission denied for /usr/local/bin/firefox Installing /run/firejail/mnt/seccomp seccomp filter Installing /run/firejail/mnt/seccomp.protocol seccomp filter Error: no suitable firefox executable found monitoring pid 11 Sandbox monitor: waitpid 11 retval 11 status 256 Parent is shutting down, bye... ``` I guess it's having some troubles with Firefox.
Author
Owner

@Vincent43 commented on GitHub (May 17, 2019):

Try sudo aa-disable usr.bin.firefox.

<!-- gh-comment-id:493523399 --> @Vincent43 commented on GitHub (May 17, 2019): Try `sudo aa-disable usr.bin.firefox`.
Author
Owner

@VampireFox2 commented on GitHub (May 17, 2019):

Ok so after comparing these three commands with the previous outputs after disabling the Firefox profiles I get the same output for all of them. Weird... so maybe it's not apparmor. I have no idea what the issue is..

<!-- gh-comment-id:493527034 --> @VampireFox2 commented on GitHub (May 17, 2019): Ok so after comparing these three commands with the previous outputs after disabling the Firefox profiles I get the same output for all of them. Weird... so maybe it's not apparmor. I have no idea what the issue is..
Author
Owner

@VampireFox2 commented on GitHub (May 17, 2019):

Update: "My bad, I had to reboot. It works now".

<!-- gh-comment-id:493532429 --> @VampireFox2 commented on GitHub (May 17, 2019): **Update: "My bad, I had to reboot. It works now".**
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1702
No description provided.