mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2706] Can't get tor-browser to run with Firejail #1704
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1704
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (May 17, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2706
Hi!
I can't get tor-browser to run with Firejail.
I edited "torbrowser-launcher.profile".
then edited:
disable-programs.incI typed in terminal...
$ firejail torbrowser-launcherA error appears:
Firejail don't found the EXEC file of tor-browser.
When I typed in terminal
/mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser... tor-browser starts.How can I fix that?
Please help, thanks!
@rusty-snake commented on GitHub (May 17, 2019):
noexec /tmpandprivate-tmp@ghost commented on GitHub (May 23, 2019):
ok, thanks, I'll try it out.
@ghost commented on GitHub (May 23, 2019):
I renamed my tor-browser-profile to: "start-tor-browser.profile"
When I start "firejail /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser"
I edited: "disable-programs.inc"
blacklist /mnt/tor-browser-tmpfs/tor_browser/Browser/.cache
blacklist /mnt/tor-browser-tmpfs/tor_browser/Browser/.config
#blacklist ${HOME}/.local/share/torbrowser
I got these errors:
Reading profile /etc/firejail/start-tor-browser.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Parent pid 23374, child pid 23375
Private /etc installed in 27.31 ms
TESTING warning: noblacklist /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser not matched by a proper blacklist command in disable*.inc
Blacklist violations are logged to syslog
Child process initialized in 223.39 ms
Error: no suitable /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser executable found
Parent is shutting down, bye...
What I have do do to fix that? How can I add the exec file "start-tor-browser" so firejail can find it?
Please help, thanks!
@rusty-snake commented on GitHub (May 23, 2019):
@cokeflash use the following profile (save as e.g. $HOME/.config/firejail/torbrowser.profile):
and run it with
firejail --profile=torbrowser /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browseralso which firejail version are you using?
EDIT: I updated the profile.
EDIT: second update.
@rusty-snake commented on GitHub (May 23, 2019):
Alternative you use my "HOWTO: Firejailed Tor Browser". But this is still not fully finish.
@ghost commented on GitHub (May 25, 2019):
Ok, thanks! I'll try it out.
@ghost commented on GitHub (May 25, 2019):
firejail --profile=torbrowser /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser
Error: cannot access profile file
Can I save the torbrowser.profile to /etc/firejail? ...(where firejail stores other profiles...)
@ghost commented on GitHub (May 25, 2019):
Version: 0.9.52-2
@ghost commented on GitHub (May 25, 2019):
Copied the torbrowser.profile to /etc/firejail... same error, cannot access profile file.
@rusty-snake commented on GitHub (May 25, 2019):
@cokeflash because of your (old) firejail version. I update the profile above again. You can copy it to
${HOME}/.config/firejail/tor-browser.profileand try executingfirejail --profile=$HOME/.config/firejail/tor-browser.profile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser@ghost commented on GitHub (May 25, 2019):
Thanks, I'll try it out tomorrow.
Must I set another permission of the torbrowser.profile?
User or root?
Read+Write - Read - Read?
@rusty-snake commented on GitHub (May 25, 2019):
The file will read as root, so you can set what you want ;)
The issue above was that your firejail version needs absolut paths for profiles.
@ghost commented on GitHub (May 26, 2019):
I run this command: # firejail --profile=/etc/firejail/torbrowser.profile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser
...but FireJail is shutting down :-(
Reading profile /etc/firejail/torbrowser.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 6407, child pid 6408
Child process initialized in 204.06 ms
Parent is shutting down, bye...
Some idea?
I use AppArmor,too in my OS.
@ghost commented on GitHub (May 26, 2019):
AppArmor is blocking torbrowser with FireJail.
When I run /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser alone, then it works without FireJail.
@ghost commented on GitHub (May 26, 2019):
[url=https://postimg.cc/5HRmJ7VS][img]https://i.postimg.cc/5HRmJ7VS/App-Armor-denied.png[/img][/url]
@rusty-snake commented on GitHub (May 26, 2019):
@cokeflash OK, then remove the
apparmorline in the profile and try again.@ghost commented on GitHub (May 27, 2019):
AppArmor torbrowser denied-message is gone but torbrowser with firejail don't start.
See:
firejail firejail --profile=/etc/firejail/torbrowser.profile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser
Reading profile /etc/firejail/torbrowser.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 31505, child pid 31506
Child process initialized in 239.04 ms
Parent is shutting down, bye...
@ghost commented on GitHub (May 27, 2019):
Could it be that AppArmor is blocking Firejail to run TorBrowser? I also have an AppArmor profile for FireJail called 'firejail-default' and for the TorBrowser 'home. tor-browser. firefox' ...
Do I have to change anything?
@rusty-snake commented on GitHub (May 27, 2019):
@cokeflash ok, then comment every line in tor-browser.profile and uncomment line for line and try after any uncomment.
Does one of the following work?
firejail --ignore=private-bin --profile=/etc/firejail/torbrowser.profile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browserfirejail --noprofile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browserHave you edited /etc/firejail.config?
@ghost commented on GitHub (May 27, 2019):
No, i don't edited 'firejail.config'.
Must I edit something? Or add something?
@rusty-snake commented on GitHub (May 27, 2019):
Nope.
@ghost commented on GitHub (May 28, 2019):
I'll try it out at weekend.
@ghost commented on GitHub (May 30, 2019):
Not working:
firejail --ignore=private-bin --profile=/etc/firejail/torbrowser.profile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser
Working:
firejail --noprofile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-browser
Do I edit this line
private-bin bash,cp,dirname,env,expr,file,getconf,gpg,grep,id,ln,mkdir,python*,readlink,rm,sed,sh,tail,test,tor-browser-en,torbrowser-launcher
to
private-bin bash,cp,dirname,env,expr,file,firefox,firefox.real,getconf,gpg,grep,id,ln,mkdir,python*,readlink,rm,sed,sh,tail,test,start-tor-browser
I disabled all lines in my torbrowser.profile, then it starts with:
firejail --profile=/etc/firejail/torbrowser.profile /mnt/tor-browser-tmpfs/tor_browser/Browser/start-tor-
Some line/lines in my torbrowser profile is blocking to start torbrowser.
@rusty-snake commented on GitHub (May 30, 2019):
@cokeflash can you then try uncomment line for line and try after every uncomment (don't forget to save the file aber uncommenting).
Actually, I think that may be an
includeorseccompit the issue.@ghost commented on GitHub (May 30, 2019):
shell none
blocks torbrowser to start with FireJail-profil of torbrowser.
What to do? Remove it? Or edit it?
@rusty-snake commented on GitHub (May 30, 2019):
@cokeflash then remove
shell nonefrom tor-browser.profile or comment it.PS: Some else issue with starting tor browser or can we close?
@ghost commented on GitHub (May 30, 2019):
'SOLVED'
...is working :-) Thanks for your help.