mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2720] keepassxc: cannot open URL links in firefox #1711
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1711
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @tinmanx on GitHub (May 22, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2720
After a Firefox update, i dont understand why but when trying to double click to open URL's in KeepassXC it errors out saying profile not accessible. Can you tell me why this happened all of a sudden? Nothing has changed in the profile, been using it as usual.
firejail version 0.9.58.2
Ubuntu 18.04 with xfce4
@chiraag-nataraj commented on GitHub (May 22, 2019):
Things to try:
firejail keepassxc?firejail --noprofile keepassxchelp?firefox(firejailed) open before startingkeepassxc(firejailed) help?@tinmanx commented on GitHub (May 22, 2019):
@chiraag-nataraj
It works with:
firejail --noprofile --appimage KeePassXC-2.4.1-x86_64.AppImageFirefox is not firejailed, but it is started before Keepassxc as usual.
@tinmanx commented on GitHub (May 22, 2019):
The only difference between the output on the terminal now and before the Firefox update, is this error:
Error: Access was denied while trying to open files in your profile directory.Everything else is normal
@chiraag-nataraj commented on GitHub (May 22, 2019):
When keepassxc is running, can you do a
firejail --ls=<pid of keepassxc sandbox> ~/? Does.mozillaappear there?Also, looks like you compiled from Git, since it's reading stuff in
/usr/local/etc/firejail?@chiraag-nataraj commented on GitHub (May 22, 2019):
Also, is this the default
firejailprofile? Have you modified it?@tinmanx commented on GitHub (May 22, 2019):
@chiraag-nataraj yes
.mozilladoes appear in the list ! This is very weird..And yes i compiled from Git. Like i said, this has been working fine for many months and suddenly this happened after Firefox update. Firefox updated from:
firefox (67.0+build1-0ubuntu0.18.04.1) bionictofirefox (67.0+build2-0ubuntu0.18.04.1) bionicyes this is the default keepassxc.profile and no i didnt modify it.
@chiraag-nataraj commented on GitHub (May 22, 2019):
What if you pass
--ignore=private-bin, sofirejail --ignore=private-bin --appimage KeePassXC-<whatever>?@tinmanx commented on GitHub (May 22, 2019):
no that doesnt work either.
I figured out what the problem is... however i do not have a solution for this.
Please ignore the version numbers of firefox that i mentioned, this is what really happened after digging further.
When everything was working, i was on Firefox v66.0.5 (i reverted to this now and the URL openings work as expected)
According to http://security.ubuntu.com/ubuntu/pool/main/f/firefox/ the next version in the list is Firefox 67.0Build2
After updating to Firefox 67.0Build2 today, the URL openings break, ie. gives the above error as explained.
Something has changed between Firefox v66.0.5 and v67.0 with KeepassXC 2.4.1
The only solution is to stay on a previous version of Firefox
Please try reproduce because i just did this now.
@chiraag-nataraj commented on GitHub (May 22, 2019):
Can you try with the non-appimage version? I want to see if it's an appimage-specific problem or if it's an issue with the profile more generally.
Also, I'm currently on firefox 66.0.5 (I'm on Debian
sid...).@tinmanx commented on GitHub (May 22, 2019):
There is only appimages for keepassxc and building it from source which i am not able to do. The rest is windows and mac binaries.
Can you try with building from source on your side? It seems to me that the execution for opening firefox links has somehow changed
@chiraag-nataraj commented on GitHub (May 22, 2019):
No? https://packages.ubuntu.com/bionic/keepassxc It's in the bionic repos.
@tinmanx commented on GitHub (May 22, 2019):
apologies, will check now.
@tinmanx commented on GitHub (May 22, 2019):
When testing on a new PC, im getting a different error now when opening URL:
Unable to detect a web browser to launch 'www.google.com'I tried on firefox v66.04 and firefox v67.0
I used keepassxc from bionic repo as you said.
@chiraag-nataraj commented on GitHub (May 22, 2019):
Can you try with
--ignore=private-bin? I suspect it's looking for browsers, but none are whitelisted in the default profile.@tinmanx commented on GitHub (May 22, 2019):
Ok i tried with:
$ firejail --ignore=private-bin keepassxcand it tries to open, with the same error popup as it does on the appimage.
@chiraag-nataraj commented on GitHub (May 22, 2019):
Hmm...I wonder if
exo-helperorexo-openis throwing the error rather thanfirefox...@chiraag-nataraj commented on GitHub (May 22, 2019):
Or do you get the firefox popup saying "Your profile is missing" or something similar?
@tinmanx commented on GitHub (May 22, 2019):
The popup i get is this:
in addition to the terminal error:
Error: Access was denied while trying to open files in your profile directory.@tinmanx commented on GitHub (May 22, 2019):
this is the same for appimage and the repo version
@chiraag-nataraj commented on GitHub (May 22, 2019):
Okay yeah, that is a Firefox error. It doesn't make sense, though, since
~/.mozillashould exist. Can you make sure~/.mozilla/firefox/exists within the sandbox?@tinmanx commented on GitHub (May 22, 2019):
yes it exists
drwx------ 1000 1004 4096 .mozillaYeah it does not make sense. This is also a new fresh VM, so, i dont know what the issue could be.
Did you try this on debian?
@chiraag-nataraj commented on GitHub (May 22, 2019):
Yes, and it actually worked. My firefox is tightly sandboxed though...
@tinmanx commented on GitHub (May 22, 2019):
With what version firefox? you said 66.0.5 , Use the 67.0 version because thats the one with the actual issue.
@chiraag-nataraj commented on GitHub (May 22, 2019):
So are you saying that once you did
--ignore=private-bin, the error disappeared for 66.0.4?@chiraag-nataraj commented on GitHub (May 22, 2019):
Yes, right now I've been using 66.0.5. Let me download 67 from Mozilla's site and see if I run into the same issue.
@chiraag-nataraj commented on GitHub (May 22, 2019):
I had no issue with Firefox 67.0 (from Mozilla's site) running with a fresh profile and keepassxc sandboxed with the default profile (from git master).
@SkewedZeppelin commented on GitHub (May 22, 2019):
iirc 67 changes how profiles are handled and
--no-remoteis default now?@chiraag-nataraj commented on GitHub (May 22, 2019):
Hmm, I thought it was just that they automatically set up a new profile for release, nightly, dev, beta, etc? I don't think they do
--no-remoteby default, since I was able to open a link just fine (once I put--private-bin=firefoxto addfirefoxto the sandbox).@chiraag-nataraj commented on GitHub (May 22, 2019):
@tinmanx, can you download firefox from mozilla's website, close all open firefox windows, and do the following?
cdto the directory where you extractedfirefox(from thetar.bz2file).ff=$(mktemp -d)./firefox --profile "$ff"firejail --private-bin=firefox keepassxcThis should: (a) make sure you're running with a clean profile and (b) ensure you're opening it in the mozilla version rather than the bionic version.
[edit] Hopefully Xfce won't mess with this...
@tinmanx commented on GitHub (May 22, 2019):
@chiraag-nataraj i take it this is the portable version of firefox and you putting a profile into memory to test?
I tried this as you said, but i get the below error:
Launch failed (/usr/local/bin/firefox https://www.google.com/)@tinmanx commented on GitHub (May 22, 2019):
Just note that, by default usually in my own situation Firefox is not jailed at all.
@rusty-snake commented on GitHub (May 22, 2019):
@tinmanx
-no-remoteis an firefox arg.firefox --help:remote commands means something like "open a new window" or "open URL XY in a new tab".
@chiraag-nataraj commented on GitHub (May 22, 2019):
Yes. For this test, I didn't jail firefox (even though I normally do).
@tinmanx commented on GitHub (May 22, 2019):
What do you mean from git master?
im using the following:
firejail 0.9.58.2
keepassxc 2.4.1
Did you use Firefox 67.0 tar.bz2 or did you install from your debian repo?
Guys this is very strange, im telling you something was changed in Firefox 67.0. We need to find out what it is. Firefox v66.0.5 works perfectly as it always did, even in previous versions.
@chiraag-nataraj commented on GitHub (May 22, 2019):
I used
firejailfrom git master (so0.9.60~rc2), not0.9.58.2,keepassxc2.3.4(latest version in Debian), andfirefoxdownloaded from Mozilla (so67.0`).I didn't attempt to install
firefoxat all — just ran it from the directory I extracted to (happened to be in my Downloads folder).@chiraag-nataraj commented on GitHub (May 22, 2019):
If you use a new Firefox profile, does it work? You can (easily) create a new profile by going to
about:profiles.@openffchrome commented on GitHub (May 22, 2019):
i have a big problem since FF 67 too, when i click on a link from an sandboxed application it launch a whole new firefox instance with a new profile instead of using my firefox instance which is already launched in background! it really ruin my pc use :/
@tinmanx commented on GitHub (May 22, 2019):
No it doesnt, i tried that now.
I also found this: https://www.reddit.com/r/firefox/comments/brh3s7/firefox_67_forces_a_new_profile_is_there_any_way/ not sure if this might be of any help to you that you can maybe figure out if its using an incorrect profile.
[Edit]
check this:
https://www.reddit.com/r/firefox/comments/broebr/just_updated_to_firefox_67_and_have_a_new_profile/
and this:
https://bugzilla.mozilla.org/show_bug.cgi?id=1553526
@tinmanx commented on GitHub (May 22, 2019):
I am under the impression that when firejail is trying to open a URL, Firefox forces a brand new instance and profile, which wont work, (because when firefox is closed in general and you try to open a link, its the exact same error i get)
@chiraag-nataraj commented on GitHub (May 23, 2019):
Something's very weird because that is not the behavior I experienced. When I had
firefox67.0 running (although it wasn't officially installed),keepassxcopened links in the running instance.@tinmanx commented on GitHub (May 24, 2019):
@chiraag-nataraj i dont know what to tell you. I also tried this on a fresh Ubuntu 18.04 no xfce4 or anything like that. just plain Ubuntu 18.04 Desktop. Same issue after installed firefox from repo.
Can you try installing firefox from Debian repo, delete ~/.mozilla and open firefox for it to create new profile. Then run keepassxc with firejail so you can tell me
@chiraag-nataraj commented on GitHub (May 24, 2019):
Interesting, once I installed it system-wide, I had the same issue. Can you try this profile for
keepassxcand report back? (NB: It assumes your database is stored in~/.config/keepassxcfor simplicity...you can add other whitelist paths if you want).~/.config/firejail/keepassxc.profile:~/.config/firejail/common.inc:@chiraag-nataraj commented on GitHub (May 28, 2019):
@tinmanx, any luck with the
keepassxcprofile I posted above?@chiraag-nataraj commented on GitHub (May 31, 2019):
@tinmanx, I'm not sure how to proceed from here. If the profile I sent you works, then we can figure out which directive is causing the issue in the stock profile and we can fix it. But I can't do that unless someone else tests the profile...
@tinmanx commented on GitHub (Jun 1, 2019):
@chiraag-nataraj sorry for the late response - i havent been able to log on for a while.
I did the tests right now. Please see findings below:
I tried to run it with:
firejail keepassxcbut when clicking the link, it gave an error in terminal:Launch failed (/usr/sbin/firefox https://www.site.com/)and it didnt open.
So i tried with:
firejail --ignore=private-bin keepassxcand the following happened:I already had firefox open..so when clicking the link it prompted with this screenshot
so i chose it and it opened a brand new instance of firefox, so it didnt open a new tab in the existing firefox profile.
On another note:
I still dont know why I have to run
firejail --ignore=private-bin keepassxcand if i runfirejail keepassxcit wont launch the site.@tinmanx commented on GitHub (Jun 1, 2019):
Is it possible you could also do these tests on your side?
@chiraag-nataraj commented on GitHub (Jun 1, 2019):
The profile I posted worked fine when firefox was already open. I suspect you have to tweak the profile a bit. I really don't know what it might take, since I've been on a highly-customized Debian sid/experimental setup for quite some time now (AwesomeWM and manual mimetype configuration if required).
From the looks of it, it's probably something to do with
xdg-opennot having access to its config files (andxdg-opennot being whitelisted inprivate-bin).Honestly, the safest (and most secure) option is to manually copy the URLs and paste them. I've been doing this for a long time now since it allows for much stricter sandboxes.
If someone else is out there running Ubuntu and wants to help @tinmanx troubleshoot, please have at it! I'm at my wit's end at this point, since the profile above worked for me.
@tinmanx, one more thing you can try is commenting
whitelist ${HOME}/.config/keepassxcin the profile and seeing if it works then. If so, that points to additional directories you need to whitelist in your home directory.@tinmanx commented on GitHub (Jun 1, 2019):
@chiraag-nataraj
running
firejail --ignore=private-bin keepassxcnow while having commented outwhitelist ${HOME}/.config/keepassxcit worked and opened up the link in the same firefox instance.So knowing this.. what can you do to actually fix this?
Is this profile of keepassxc.profile and commenting out
whitelist ${HOME}/.config/keepassxcsecure?@chiraag-nataraj commented on GitHub (Jun 1, 2019):
Okay, this means you need to figure out which other directories need to be whitelisted for
xdg-opento work. I can't help you there since I don't use that mechanism for opening programs (as I mentioned earlier).Not as secure as whitelisting just the specific directories it needs to function. Again, if you care about security, keep the profile as-is and just copy-paste the URL.
@tinmanx commented on GitHub (Jun 1, 2019):
@chiraag-nataraj if you dont use the first whitelist..does it by default allow all directories?
if this is the case, how was it working before the firefox upgrade? was it less secure previously??
@chiraag-nataraj commented on GitHub (Jun 1, 2019):
Yes. If there are no blacklists or whitelists (and my profiles tend to take a whitelist approach), then all directories in
~(your home directory) are able to be accessed.I never had a setup where clicking on a link worked without relaxing many settings on the sandbox. Looking at the
keepassxcprofile provided in this repository (not the one I posted above), it seems it allowskeepassxcaccess to your.mozilladirectory, which means it theoretically could access anything stored in yourfirefoxprofile. I suppose we decided it's an acceptable compromise to not break everyone's setup.Personally, I find that whenever I need to allow a program to access configuration files that aren't its own, I should change my workflow. So in this case, if I took a look at the profile and realized that clicking on links only works because
keepassxchas access to myfirefoxdata, I would create a stricter profile in~/.config/firejailwithout that and copy and paste the links.I mean, in this case, you might deem it an acceptable risk as long as
keepassxcdoesn't have internet access (sonet noneorprotocol unixor similar is enabled in the sandbox). Otherwise, it's not even a question in my mind.@tinmanx commented on GitHub (Jun 11, 2019):
@chiraag-nataraj i appreciate your input and you make great points, however this is not really a solution to the actual problem. Knowing that
net noneprovides network block is enough for most users. This again shouldn't be an excuse to render the link-launcher useless and tedious.Also, saying that xdg-open is somehow the cause of it being blocked wouldn't make sense, because this has to do with a Firefox update. i mean ive downgraded and upgraded the Firefox versions like 10 times and i get the same results.
A basic and simple question, what exactly could have changed from Firefox 66.0.5 to Firefox 67.0 which causes keepassxc not being able to launch links anymore from firejail?
@tinmanx commented on GitHub (Jun 18, 2019):
@chiraag-nataraj i just found out i am having the same issue and not being able to click links on a jailed cherrytree.profile too. Never used to be like this.
Do you think i should open a bug report on mozilla? Can you please assist? I cant be the only one with this issue. Il do whatever else that i can to make this work again.
@chiraag-nataraj commented on GitHub (Jun 18, 2019):
I really don't know. Every new
firefoxrelease adds so many things (and changes so many things) that I'm not entirely even sure what could have done this.I don't think opening a bug report on Firefox's bugzilla will be useful at all — they will just redirect you back here an close as NOTABUG.
As I've already mentioned, this functionality requires you to at the minimum whitelist your firefox folder (
~/.mozilla) in all programs where you would like to click on links and have them open. This has not changed and is still the case. To me, that represents a lot more trust than I am willing to give random programs (especially internet-connected ones).Given your input above, I think the thing that's broken is that
firefox(or whatever is calling it) now requires additional directories to be whitelisted (in addition to~/.mozilla) before it will work. This might have happened with afirefoxupdate, but I don't thinkfirefoxbroke it.You will have to play around with whitelisting directories in your home directory (build off of the profile I sent you) and don't worry too much about the
private-binfor now (you can comment it if you want, we can deal with that later) — just focus on getting the home directory whitelist to work.You might be able to use the
--debugand--tracearguments for firejail or run it from the terminal to hopefully get more output, which might give you a better idea of what's going on.@rusty-snake commented on GitHub (Jun 18, 2019):
As @SkewedZeppelin already said "67 changes how profiles are handled"
(Source: https://www.ghacks.net/2019/05/21/firefox-67-0-release-information/)
@chiraag-nataraj commented on GitHub (Jun 18, 2019):
@rusty-snake Yes, but I'm not quite sure if that's the issue here. In particular, it doesn't explain why the firejail profile that worked for me seems to not work for OP or why this broke in the first place.
The profile handling you're describing is more related to versioning firefox profiles such that each one is associated with a specific firefox channel (release, beta, nightly). It pretty much has nothing to do with this issue (afaik).
@rusty-snake commented on GitHub (Aug 22, 2019):
@tinmanx @chiraag-nataraj I go ahead and close this for now.