github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2840] memory-deny-write-execute breaks several applications #1776

New issue

Closed

opened 2026-05-05 08:26:42 -06:00 by gitea-mirror · 13 comments

gitea-mirror commented

2026-05-05 08:26:42 -06:00

Owner

Originally created by @setpill on GitHub (Jul 8, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2840

At least mumble, galculator and pavucontrol are affected.

Originally created by @setpill on GitHub (Jul 8, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2840 At least mumble, galculator and pavucontrol are affected.

gitea-mirror closed this issue

2026-05-05 08:26:43 -06:00

gitea-mirror commented

2026-05-05 08:26:44 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 8, 2019):

Fixed in 704fc8b, Thanks for reporting.

@rusty-snake commented on GitHub (Jul 8, 2019): Fixed in 704fc8b, Thanks for reporting.

gitea-mirror commented

2026-05-05 08:26:45 -06:00

Author

Owner

@setpill commented on GitHub (Jul 9, 2019):

Thanks for the quick response :)

@setpill commented on GitHub (Jul 9, 2019): Thanks for the quick response :)

gitea-mirror commented

2026-05-05 08:26:46 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 9, 2019):

It would be great if we could test graphical programs in our CI to catch errors like this... any ideas if this is possible?

CC: @reinerh since you've been working on our CI recently 😄

@Fred-Barclay commented on GitHub (Jul 9, 2019): It would be great if we could test graphical programs in our CI to catch errors like this... any ideas if this is possible? CC: @reinerh since you've been working on our CI recently :smile:

gitea-mirror commented

2026-05-05 08:26:46 -06:00

Author

Owner

@reinerh commented on GitHub (Jul 9, 2019):

@Fred-Barclay Yes, it would be possible. I think the tests (in test/ directory) already run some graphical programs.
It would be easy to run all tests also in our CI, but for now I didn't enable it, as it's a bit unrealiable.
See e.g. in Debian CI and Ubuntu CI.

@reinerh commented on GitHub (Jul 9, 2019): @Fred-Barclay Yes, it would be possible. I think the tests (in test/ directory) already run some graphical programs. It would be easy to run all tests also in our CI, but for now I didn't enable it, as it's a bit unrealiable. See e.g. in [Debian CI](https://ci.debian.net/packages/f/firejail/unstable/amd64/) and [Ubuntu CI](http://autopkgtest.ubuntu.com/packages/f/firejail).

gitea-mirror commented

2026-05-05 08:26:47 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jul 10, 2019):

We obviously can't test all graphical apps in CI, especially across various distros. The truth is that mdwe is unreliable in gtk/qt apps and perhaps in all gui apps and shouldn't be used there.

@Vincent43 commented on GitHub (Jul 10, 2019): We obviously can't test all graphical apps in CI, especially across various distros. The truth is that `mdwe` is unreliable in gtk/qt apps and perhaps in all gui apps and shouldn't be used there.

gitea-mirror commented

2026-05-05 08:26:47 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 10, 2019):

@Vincent43 I'm inclined to agree but I'd really like using mdwe as much as possible 😄 . Isn't Arch the distro that usually has issues with it?

@Fred-Barclay commented on GitHub (Jul 10, 2019): @Vincent43 I'm inclined to agree but I'd really like using `mdwe` as much as possible :smile: . Isn't Arch the distro that usually has issues with it?

gitea-mirror commented

2026-05-05 08:26:48 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 10, 2019):

Isn't Arch the distro that usually has issues with it?

We need ~~?IS_ARCH: mdwe~~ ?NOT_ARCH: mdwe 😺

Yes if an app works fine with mdwe except on some distors, it is normaly Arch, Manjaro, ...

@rusty-snake commented on GitHub (Jul 10, 2019): > Isn't Arch the distro that usually has issues with it? _We need ~`?IS_ARCH: mdwe`~ `?NOT_ARCH: mdwe` :smiley_cat:_ Yes if an app works fine with `mdwe` except on some distors, it is normaly Arch, Manjaro, ...

gitea-mirror commented

2026-05-05 08:26:48 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jul 10, 2019):

It would be interesting to find out what's causing the difference there.

@Vincent43 commented on GitHub (Jul 10, 2019): It would be interesting to find out what's causing the difference there.

gitea-mirror commented

2026-05-05 08:26:48 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 10, 2019):

$ grep -l "#1803" *
authenticator.profile
autokey-common.profile
baobab.profile
bitwarden.profile
clawsker.profile
d-feet.profile
enpass.profile
eo-common.profile
exfalso.profile
font-manager.profile
galculator.profile
geekbench.profile
mpDris2.profile
mumble.profile
ocenaudio.profile
pavucontrol.profile
QMediathekView.profile
qtox.profile
subdownloader.profile
viewnior.profile
youtube-dl.profile

ytdl not only GUI.

BTW: Should we reopen?

@rusty-snake commented on GitHub (Jul 10, 2019): ``` $ grep -l "#1803" * authenticator.profile autokey-common.profile baobab.profile bitwarden.profile clawsker.profile d-feet.profile enpass.profile eo-common.profile exfalso.profile font-manager.profile galculator.profile geekbench.profile mpDris2.profile mumble.profile ocenaudio.profile pavucontrol.profile QMediathekView.profile qtox.profile subdownloader.profile viewnior.profile youtube-dl.profile ``` **ytdl** not only GUI. BTW: Should we reopen?

gitea-mirror commented

2026-05-05 08:26:49 -06:00

Author

Owner

@setpill commented on GitHub (Jul 11, 2019):

If a bug is reopened, it would make more sense to reopen #1803 than this one.

@setpill commented on GitHub (Jul 11, 2019): If a bug is reopened, it would make more sense to reopen #1803 than this one.

gitea-mirror commented

2026-05-05 08:26:49 -06:00

Author

Owner

@topimiettinen commented on GitHub (Jul 11, 2019):

Regarding Arch specific breakage: recently mdwe was enhanced to block also memfd_create() system call. Maybe a library in Arch has started using it?

@topimiettinen commented on GitHub (Jul 11, 2019): Regarding Arch specific breakage: recently mdwe was enhanced to block also `memfd_create()` system call. Maybe a library in Arch has started using it?

gitea-mirror commented

2026-05-05 08:26:50 -06:00

Author

Owner

@setpill commented on GitHub (Jul 13, 2019):

How recent is that enhancement? #1803 was opened in March 2018 so if it's after that it is not the (only) cause.

@setpill commented on GitHub (Jul 13, 2019): How recent is that enhancement? #1803 was opened in March 2018 so if it's after that it is not the (only) cause.

gitea-mirror commented

2026-05-05 08:26:50 -06:00

Author

Owner

@topimiettinen commented on GitHub (Jul 13, 2019):

OK, that was added in March 2019, 59e3061.

@topimiettinen commented on GitHub (Jul 13, 2019): OK, that was added in March 2019, 59e3061.

gitea-mirror referenced this issue

2026-05-05 10:13:11 -06:00

[PR #1776] [MERGED] Apparmor: blacklist /proc and /sys access from firejail #4068

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1776

No description provided.

Rows
Columns