github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2887] firefox addon mailvelope not work w/ firejail #1803

New issue

Closed

opened 2026-05-05 08:28:29 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:28:29 -06:00

Owner

Originally created by @OwenChia on GitHub (Aug 3, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2887

Background:
Mailvelope is a browser extension offers email encryption with PGP.

Version:

firejail: 0.9.60
firefox: 68.0.1
mailvelope: latest

Issues:
I followed this instruction, the connection is established, but no gpg key displayed.

using the default profile, not work;
add whitelist ${HOME}/.gnupg, still not work;
run firefox w/o firejail, it works.

and I trying run
firejail --profile=/etc/firejail/firefox.profile --whitelist='${HOME}/.gnupg' gpgme-json -i
with input {"op":"keylist"} , got

Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 461083, child pid 461084
Post-exec seccomp protector enabled
Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destr
oy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,p
rocess_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @def
ault-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,fi
nit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver,
ioperm,iopl,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel
,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,pro
cess_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,userfaultfd,vhangup,vmsplice,
Child process initialized in 118.97 ms
gpgme-json 1.13.0 ready (enter ",help" for help)
> {"op":"keylist"}
> 
===> {
===>    "keys": []
===> }
>

how to make it work?

Originally created by @OwenChia on GitHub (Aug 3, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2887 Background: [Mailvelope](https://www.mailvelope.com) is a browser extension offers email encryption with PGP. Version: + firejail: 0.9.60 + firefox: 68.0.1 + mailvelope: latest Issues: I followed [this](https://github.com/mailvelope/mailvelope/wiki/Mailvelope-GnuPG-integration) instruction, the connection is established, but no gpg key displayed. - using the default profile, not work; - add `whitelist ${HOME}/.gnupg`, still not work; - run firefox w/o firejail, it works. and I trying run `firejail --profile=/etc/firejail/firefox.profile --whitelist='${HOME}/.gnupg' gpgme-json -i` with input `{"op":"keylist"}` , got ``` Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 461083, child pid 461084 Post-exec seccomp protector enabled Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destr oy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,p rocess_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @def ault-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,fi nit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver, ioperm,iopl,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel ,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,pro cess_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,userfaultfd,vhangup,vmsplice, Child process initialized in 118.97 ms gpgme-json 1.13.0 ready (enter ",help" for help) > {"op":"keylist"} > ===> { ===> "keys": [] ===> } > ``` how to make it work?

gitea-mirror

2026-05-05 08:28:29 -06:00

closed this issue
added the
question_old
label

gitea-mirror commented

2026-05-05 08:28:32 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 3, 2019):

Maybe the following firefox.local

noblacklist ${HOME}/.gnupg
mkdir ${HOME}/.gnupg
whitelist ${HOME}/.gnupg

writable-run-user
ignore nodbus

Idea from enigmail in thunderbird.local.

@rusty-snake commented on GitHub (Aug 3, 2019): Maybe the following firefox.local ``` noblacklist ${HOME}/.gnupg mkdir ${HOME}/.gnupg whitelist ${HOME}/.gnupg writable-run-user ignore nodbus ``` Idea from enigmail in [thunderbird.local](https://github.com/netblue30/firejail/blob/master/etc/thunderbird.profile).

gitea-mirror commented

2026-05-05 08:28:34 -06:00

Author

Owner

@OwenChia commented on GitHub (Aug 3, 2019):

it works!
Thank you for your reply.

@OwenChia commented on GitHub (Aug 3, 2019): it works! Thank you for your reply.

gitea-mirror commented

2026-05-05 08:28:35 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 3, 2019):

@OwenChia If you want, you can try if one or both of the last two line are not needed for mailvelope.

@rusty-snake commented on GitHub (Aug 3, 2019): @OwenChia If you want, you can try if one or both of the last two line are not needed for mailvelope.

gitea-mirror commented

2026-05-05 08:28:36 -06:00

Author

Owner

@OwenChia commented on GitHub (Aug 4, 2019):

@rusty-snake
I tried to remove and add those line one by one, found that only noblacklist ${HOME}/.gnupg and whitelist ${HOME}/.gnupg is needed.

@OwenChia commented on GitHub (Aug 4, 2019): @rusty-snake I tried to remove and add those line one by one, found that only `noblacklist ${HOME}/.gnupg` and `whitelist ${HOME}/.gnupg` is needed.

gitea-mirror referenced this issue

2026-05-05 08:44:14 -06:00

[GH-ISSUE #3287] Audacious & Audacity freeze, works with "ignore memory-deny-write-execute" #2064

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1803

No description provided.

Rows
Columns