github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2747] alpine: client terminates by itself (--noprofile) #1726

New issue

Open

opened 2026-05-05 08:23:43 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:23:43 -06:00

Owner

Originally created by @jose1711 on GitHub (Jun 4, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2747

To reproduce:

install alpine (https://repo.or.cz/alpine.git/bundles)
run firejail --noprofile alpine
do not do anything, just wait
alpine will terminate with Parent is shutting down, bye... message

I've seen this with Raspbian and Arch Linux

Originally created by @jose1711 on GitHub (Jun 4, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2747 To reproduce: - install alpine (https://repo.or.cz/alpine.git/bundles) - run `firejail --noprofile alpine` - do not do anything, just wait - alpine will terminate with `Parent is shutting down, bye...` message I've seen this with Raspbian and Arch Linux

gitea-mirror added the

bug

label 2026-05-05 08:23:43 -06:00

gitea-mirror commented

2026-05-05 08:23:46 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Jun 4, 2019):

Here's a debug log running alpine with debugging level 60.
alpine-debug.txt

@chiraag-nataraj commented on GitHub (Jun 4, 2019): Here's a debug log running `alpine` with debugging level 60. [alpine-debug.txt](https://github.com/netblue30/firejail/files/3254043/alpine-debug.txt)

gitea-mirror commented

2026-05-05 08:23:46 -06:00

Author

Owner

@luca-rei commented on GitHub (Apr 14, 2020):

I know it is an old thread but I can confirm this happen even on Gentoo.
From what I understand alpine needs to be spawned from a subterminal, so as a workaround you could use a launcher and call that .sh from firejail.
Another issue with alpine is that firejail does not permit deleting or renaming over a file in whitelist like a configuration file (.pinerc).
So here the workaround is to save configuration in a file .pinerc-bck, whitelist that one and in the launcher copy that file in .pinerc and on exit copy .pinerc over .pine-bck (copy, not rename or delete).

At the end the launcher should be something like:

#!/bin/bash
cp .pinerc-bck .pinerc
/usr/bin/alpine -passfile ~/.alpinepass
cp .pinerc .pinerc-bck

And the firejail profile:

noblacklist ~/.alpine-launcher
#noblacklist ~/.pinerc
noblacklist ~/.pinerc-bck
noblacklist ~/mail
noblacklist ~/mail/saved-messages
noblacklist ~/mail/sent-mail
noblacklist ~/.pine-interrupted-mail
noblacklist ~/.pine-debug1
noblacklist ~/.bashrc

noblacklist ~/.alpinepass
noblacklist ~/.alpine-smime
noblacklist ~/.alpine-smime/.pwd
noblacklist ~/.alpine-smime/.pwd/MasterPassword.crt
noblacklist ~/.alpine-smime/.pwd/MasterPassword.key
noblacklist ~/.alpine-smime/private
noblacklist ~/.alpine-smime/ca
noblacklist ~/.alpine-smime/public


include /etc/firejail/disable-common.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-interpreters.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-exec.inc
include /etc/firejail/disable-passwdmgr.inc
include /etc/firejail/disable-xdg.inc

include /etc/firejail/whitelist-common.inc
include /etc/firejail/whitelist-var-common.inc
include /etc/firejail/whitelist-usr-share-common.inc


mkfile ~/.alpine-launcher
#mkfile ~/.pinerc
#mkfile ~/.pinerc-bck
mkdir ~/mail
mkdir ~/mail/saved-messages
mkdir ~/mail/sent-mail
mkfile ~/.pine-interrupted-mail
mkfile ~/.pine-debug1
mkfile ~/.bashrc
mkfile ~/.alpinepass
mkdir ~/.alpine-smime
mkdir ~/.alpine-smime/.pwd
mkfile ~/.alpine-smime/.pwd/MasterPassword.crt
mkfile ~/.alpine-smime/.pwd/MasterPassword.key
mkdir ~/.alpine-smime/private
mkdir ~/.alpine-smime/ca
mkdir ~/.alpine-smime/public

whitelist ~/.alpine-launcher
#whitelist ~/.pinerc
whitelist ~/.pinerc-bck
whitelist ~/mail
whitelist ~/mail/saved-messages
whitelist ~/mail/sent-mail
whitelist ~/.pine-interrupted-mail
whitelist ~/.pine-debug1
whitelist ~/.pine-debug2
whitelist ~/.pine-debug3
whitelist ~/.pine-debug4
whitelist ~/.bashrc

whitelist ~/.alpinepass
whitelist ~/.alpine-smime
whitelist ~/.alpine-smime/.pwd
whitelist ~/.alpine-smime/.pwd/MasterPassword.crt
whitelist ~/.alpine-smime/.pwd/MasterPassword.key
whitelist ~/.alpine-smime/private
whitelist ~/.alpine-smime/ca
whitelist ~/.alpine-smime/public
caps.drop all
novideo
machine-id
netfilter
nodbus
nogroups
nonewprivs
noroot
nodvd
notv
shell none
protocol unix,inet,inet6
private-dev
private-tmp
noexec ${HOME}
noexec /tmp
tracelog
ipc-namespace

And launch with:

firejail --net=bond0 --profile=/home/firejail/alpine.profile --x11=none \
  --name=alpine --seccomp /bin/bash -c "source ~/.alpine-launcher"

Of course, adjusting --net according your configuration.

@luca-rei commented on GitHub (Apr 14, 2020): I know it is an old thread but I can confirm this happen even on Gentoo. From what I understand alpine needs to be spawned from a subterminal, so as a workaround you could use a launcher and call that .sh from firejail. Another issue with alpine is that firejail does not permit deleting or renaming over a file in whitelist like a configuration file (.pinerc). So here the workaround is to save configuration in a file .pinerc-bck, whitelist that one and in the launcher copy that file in .pinerc and on exit copy .pinerc over .pine-bck (*copy*, not rename or delete). At the end the launcher should be something like: ```sh #!/bin/bash cp .pinerc-bck .pinerc /usr/bin/alpine -passfile ~/.alpinepass cp .pinerc .pinerc-bck ``` And the firejail profile: ``` noblacklist ~/.alpine-launcher #noblacklist ~/.pinerc noblacklist ~/.pinerc-bck noblacklist ~/mail noblacklist ~/mail/saved-messages noblacklist ~/mail/sent-mail noblacklist ~/.pine-interrupted-mail noblacklist ~/.pine-debug1 noblacklist ~/.bashrc noblacklist ~/.alpinepass noblacklist ~/.alpine-smime noblacklist ~/.alpine-smime/.pwd noblacklist ~/.alpine-smime/.pwd/MasterPassword.crt noblacklist ~/.alpine-smime/.pwd/MasterPassword.key noblacklist ~/.alpine-smime/private noblacklist ~/.alpine-smime/ca noblacklist ~/.alpine-smime/public include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-interpreters.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-exec.inc include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-xdg.inc include /etc/firejail/whitelist-common.inc include /etc/firejail/whitelist-var-common.inc include /etc/firejail/whitelist-usr-share-common.inc mkfile ~/.alpine-launcher #mkfile ~/.pinerc #mkfile ~/.pinerc-bck mkdir ~/mail mkdir ~/mail/saved-messages mkdir ~/mail/sent-mail mkfile ~/.pine-interrupted-mail mkfile ~/.pine-debug1 mkfile ~/.bashrc mkfile ~/.alpinepass mkdir ~/.alpine-smime mkdir ~/.alpine-smime/.pwd mkfile ~/.alpine-smime/.pwd/MasterPassword.crt mkfile ~/.alpine-smime/.pwd/MasterPassword.key mkdir ~/.alpine-smime/private mkdir ~/.alpine-smime/ca mkdir ~/.alpine-smime/public whitelist ~/.alpine-launcher #whitelist ~/.pinerc whitelist ~/.pinerc-bck whitelist ~/mail whitelist ~/mail/saved-messages whitelist ~/mail/sent-mail whitelist ~/.pine-interrupted-mail whitelist ~/.pine-debug1 whitelist ~/.pine-debug2 whitelist ~/.pine-debug3 whitelist ~/.pine-debug4 whitelist ~/.bashrc whitelist ~/.alpinepass whitelist ~/.alpine-smime whitelist ~/.alpine-smime/.pwd whitelist ~/.alpine-smime/.pwd/MasterPassword.crt whitelist ~/.alpine-smime/.pwd/MasterPassword.key whitelist ~/.alpine-smime/private whitelist ~/.alpine-smime/ca whitelist ~/.alpine-smime/public caps.drop all novideo machine-id netfilter nodbus nogroups nonewprivs noroot nodvd notv shell none protocol unix,inet,inet6 private-dev private-tmp noexec ${HOME} noexec /tmp tracelog ipc-namespace ``` And launch with: ```sh firejail --net=bond0 --profile=/home/firejail/alpine.profile --x11=none \ --name=alpine --seccomp /bin/bash -c "source ~/.alpine-launcher" ``` Of course, adjusting `--net` according your configuration.

gitea-mirror commented

2026-05-05 08:23:47 -06:00

Author

Owner

@ghost commented on GitHub (Jun 8, 2021):

it's still broken. Same behavior.

ubuntu 18.04 32bit
firejail 0.9.64.4 from the ppa, all compile options on.

@ghost commented on GitHub (Jun 8, 2021): it's still broken. Same behavior. ubuntu 18.04 32bit firejail 0.9.64.4 from the ppa, all compile options on.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1726

No description provided.

Rows
Columns