github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2901] [Teamspeak 3] crashes on opening options window if seccomp is enabled #1815

New issue

Closed

opened 2026-05-05 08:29:08 -06:00 by gitea-mirror · 10 comments

gitea-mirror commented

2026-05-05 08:29:08 -06:00

Owner

Originally created by @corecontingency on GitHub (Aug 12, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2901

Am using Arch Linux with KDE. Problem persists on both Xwayland and Xorg.

It is interesting that the symptoms are very similar to those reported here:
https://github.com/netblue30/firejail/issues/1695

Teamspeak will open fine, and everything will work, but the second you open the options menu, it crashes. This occurs whether I am connected to a voice channel on a server or not.

I manually started disabling options in the default profile, and found that if I put
ignore seccomp
into teamspeak3.local, then everything works fine.

Originally created by @corecontingency on GitHub (Aug 12, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2901 Am using Arch Linux with KDE. Problem persists on both Xwayland and Xorg. It is interesting that the symptoms are very similar to those reported here: https://github.com/netblue30/firejail/issues/1695 Teamspeak will open fine, and everything will work, but the second you open the options menu, it crashes. This occurs whether I am connected to a voice channel on a server or not. I manually started disabling options in the default profile, and found that if I put ignore seccomp into teamspeak3.local, then everything works fine.

gitea-mirror closed this issue

2026-05-05 08:29:09 -06:00

gitea-mirror commented

2026-05-05 08:29:11 -06:00

Author

Owner

@ghost commented on GitHub (Aug 12, 2019):

@corecontingency Thanks for reporting this. If indeed it is seccomp that is the cause of your issue we'll have to edit teamspeak3.profile accordingly. As seccomp is one of the more prominent security features firejail uses, it would be interesting if you could run a few additional tests. Instead of dropping its security features entirely via ignore seccomp, can you find a working profile using seccomp.drop? There are some pointers on how to create the latter here.

@ghost commented on GitHub (Aug 12, 2019): @corecontingency Thanks for reporting this. If indeed it is `seccomp` that is the cause of your issue we'll have to edit teamspeak3.profile accordingly. As `seccomp` is one of the more prominent security features firejail uses, it would be interesting if you could run a few additional tests. Instead of dropping its security features entirely via `ignore seccomp`, can you find a working profile using `seccomp.drop`? There are some pointers on how to create the latter [here](https://github.com/netblue30/firejail/blob/master/etc/templates/syscalls.txt).

gitea-mirror commented

2026-05-05 08:29:11 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Aug 12, 2019):

wild guess: ts3 is trying to ptrace all processes

@SkewedZeppelin commented on GitHub (Aug 12, 2019): wild guess: ts3 is trying to ptrace all processes

gitea-mirror commented

2026-05-05 08:29:12 -06:00

Author

Owner

@corecontingency commented on GitHub (Aug 12, 2019):

Went through it all, and it looks like the problem is chroot.

If you exclude chroot, it will run perfectly with @default-nodebuggers, which blocks the maximum amount of things. For reference, this is what I tested (@default-nodebuggers without chroot), after manually deleting seccomp from /etc/firejail/teamspeak3.profile:

firejail --seccomp.drop=@cpu-emulation,@debug,@obsolete,@resources,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,name_to_handle_at,ni_syscall,open_by_handle_at,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice,@clock,@module,@raw-io,@reboot,@swap,acct,bpf,mount,nfsservctl,pivot_root,setdomainname,sethostname,umount2,vhangup,personality,process_vm_readv,ptrace teamspeak3

wild guess: ts3 is trying to ptrace all processes

Close, but no cigar. :)

@corecontingency commented on GitHub (Aug 12, 2019): Went through it all, and it looks like the problem is `chroot`. If you exclude `chroot`, it will run perfectly with `@default-nodebuggers`, which blocks the maximum amount of things. For reference, this is what I tested (`@default-nodebuggers` without `chroot`), after manually deleting `seccomp` from `/etc/firejail/teamspeak3.profile`: `firejail --seccomp.drop=@cpu-emulation,@debug,@obsolete,@resources,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,name_to_handle_at,ni_syscall,open_by_handle_at,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice,@clock,@module,@raw-io,@reboot,@swap,acct,bpf,mount,nfsservctl,pivot_root,setdomainname,sethostname,umount2,vhangup,personality,process_vm_readv,ptrace teamspeak3` > wild guess: ts3 is trying to ptrace all processes Close, but no cigar. :)

gitea-mirror commented

2026-05-05 08:29:13 -06:00

Author

Owner

@ghost commented on GitHub (Aug 13, 2019):

@corecontingency Great, thanks for presenting your findings. I'm inclined to include/edit the profile according to your findings, but let's give other contributors some time to respond. Much appreciated!

@ghost commented on GitHub (Aug 13, 2019): @corecontingency Great, thanks for presenting your findings. I'm inclined to include/edit the profile according to your findings, but let's give other contributors some time to respond. Much appreciated!

gitea-mirror commented

2026-05-05 08:29:13 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 13, 2019):

So it seems same issue as in firefox and electron apps. Maybe we should consider dropping chroot from default seccomp list as its usage is growing among various apps.

@Vincent43 commented on GitHub (Aug 13, 2019): So it seems same issue as in firefox and electron apps. Maybe we should consider dropping `chroot` from default seccomp list as its usage is growing among various apps.

gitea-mirror commented

2026-05-05 08:29:14 -06:00

Author

Owner

@Vincent43 commented on GitHub (Aug 14, 2019):

We have another app broken in same way. We really should remove chroot.

@Vincent43 commented on GitHub (Aug 14, 2019): We have another [app broken in same way](https://github.com/netblue30/firejail/issues/2912). We really should remove `chroot`.

gitea-mirror commented

2026-05-05 08:29:14 -06:00

Author

Owner

@ghost commented on GitHub (Aug 14, 2019):

@corecontingency As you can read in the comments above the issue you so kindly reported and helped to debug will be fixed shortly. Awaiting a decision on how to do it exactly. Please bare with us on this on.

@ghost commented on GitHub (Aug 14, 2019): @corecontingency As you can read in the comments above the issue you so kindly reported and helped to debug will be fixed shortly. Awaiting a decision on how to do it exactly. Please bare with us on this on.

gitea-mirror commented

2026-05-05 08:29:15 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 18, 2019):

ts3 use electron? if so it should be removed. (see #2912, #2854 and #2821)

@rusty-snake commented on GitHub (Aug 18, 2019): ts3 use electron? if so it should be removed. (see #2912, #2854 and #2821)

gitea-mirror commented

2026-05-05 08:29:15 -06:00

Author

Owner

@ghost commented on GitHub (Aug 21, 2019):

@Vincent43 I went ahead and dropped chroot in the profile only. Maybe you should open a new issue to drop chroot from seccomp alltogether...

@ghost commented on GitHub (Aug 21, 2019): @Vincent43 I went ahead and dropped chroot in the profile only. Maybe you should open a new issue to drop chroot from seccomp alltogether...

gitea-mirror commented

2026-05-05 08:29:16 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 21, 2019):

to drop chroot from seccomp alltogether.

@glitsj16 NO, @Vincent43 has talk about the idea to add a +/-SYSCALL syntax to seccomp. Whats IMHO one of the best solutions.

BTW: seccomp need also some other rework, I will open a issue in the next days.

@rusty-snake commented on GitHub (Aug 21, 2019): > to drop chroot from seccomp alltogether. @glitsj16 NO, @Vincent43 has talk about the idea to add a `+/-SYSCALL` syntax to seccomp. Whats IMHO one of the best solutions. BTW: seccomp need also some other rework, I will open a issue in the next days.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1815

No description provided.

Rows
Columns