[GH-ISSUE #2912] Skypeforlinux 8.51.0.72 crashes on startup since it's not permitted to use the chroot syscall #1819

New issue

Closed

opened 2026-05-05 08:29:26 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:29:26 -06:00

Owner

Originally created by @lolomokakus on GitHub (Aug 14, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2912

Running Firejail 0.9.60 on Arch linux. I'm not sure why Skype requires this, but adding a seccomp.drop line in skypeforlinux.local with all syscalls in the default list except for chroot makes it work.

My skypeforlinux.local:

whitelist ${HOME}/.config/skypeforlinux
whitelist ${DESKTOP}
whitelist ${DOWNLOADS}
whitelist /dev/disk
whitelist /dev/dri
whitelist /dev/null
whitelist /dev/random
whitelist /dev/shm
whitelist /dev/urandom
whitelist /dev/video0
whitelist /dev/video1
include whitelist-common.inc
seccomp.drop _sysctl,acct,add_key,adjtimex,afs_syscall,bdflush,bpf,break,clock_adjtime,clock_settime,create_module,delete_module,fanotify_init,finit_module,ftime,get_kernel_syms,getpmsg,gtty,init_module,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioperm,iopl,ioprio_set,kcmp,kexec_file_load,kexec_load,keyctl,lock,lookup_dcookie,mbind,migrate_pages,modify_ldt,mount,move_pages,mpx,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,pciconfig_iobase,pciconfig_read,pciconfig_write,perf_event_open,personality,pivot_root,process_vm_readv,process_vm_writev,prof,profil,ptrace,putpmsg,query_module,reboot,remap_file_pages,request_key,rtas,s390_mmio_read,s390_mmio_write,s390_runtime_instr,security,set_mempolicy,setdomainname,sethostname,settimeofday,sgetmask,ssetmask,stime,stty,subpage_prot,swapoff,swapon,switch_endian,sys_debug_setcontext,sysfs,syslog,tuxcall,ulimit,umount,umount2,uselib,userfaultfd,ustat,vhangup,vm86,vm86old,vmsplice,vserver
ignore apparmor

Originally created by @lolomokakus on GitHub (Aug 14, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2912 Running Firejail 0.9.60 on Arch linux. I'm not sure why Skype requires this, but adding a seccomp.drop line in skypeforlinux.local with all syscalls in the default list except for chroot makes it work. My skypeforlinux.local: ``` whitelist ${HOME}/.config/skypeforlinux whitelist ${DESKTOP} whitelist ${DOWNLOADS} whitelist /dev/disk whitelist /dev/dri whitelist /dev/null whitelist /dev/random whitelist /dev/shm whitelist /dev/urandom whitelist /dev/video0 whitelist /dev/video1 include whitelist-common.inc seccomp.drop _sysctl,acct,add_key,adjtimex,afs_syscall,bdflush,bpf,break,clock_adjtime,clock_settime,create_module,delete_module,fanotify_init,finit_module,ftime,get_kernel_syms,getpmsg,gtty,init_module,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioperm,iopl,ioprio_set,kcmp,kexec_file_load,kexec_load,keyctl,lock,lookup_dcookie,mbind,migrate_pages,modify_ldt,mount,move_pages,mpx,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,pciconfig_iobase,pciconfig_read,pciconfig_write,perf_event_open,personality,pivot_root,process_vm_readv,process_vm_writev,prof,profil,ptrace,putpmsg,query_module,reboot,remap_file_pages,request_key,rtas,s390_mmio_read,s390_mmio_write,s390_runtime_instr,security,set_mempolicy,setdomainname,sethostname,settimeofday,sgetmask,ssetmask,stime,stty,subpage_prot,swapoff,swapon,switch_endian,sys_debug_setcontext,sysfs,syslog,tuxcall,ulimit,umount,umount2,uselib,userfaultfd,ustat,vhangup,vm86,vm86old,vmsplice,vserver ignore apparmor ```

gitea-mirror closed this issue

2026-05-05 08:29:27 -06:00

gitea-mirror commented

2026-05-05 08:29:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 18, 2019):

Related to #2854 and #2821 ?all? electron apps now need this.

@rusty-snake commented on GitHub (Aug 18, 2019): Related to #2854 and #2821 ?all? electron apps now need this.

gitea-mirror commented

2026-05-05 08:29:29 -06:00

Author

Owner

@lolomokakus commented on GitHub (Aug 18, 2019):

Yeah, that's probably it. Just running strace -fe chroot electron gave me this:

[pid 31860] chroot("/proc/self/fdinfo/") = 0

before even the usage information was printed.

@lolomokakus commented on GitHub (Aug 18, 2019): Yeah, that's probably it. Just running `strace -fe chroot electron` gave me this: ``` [pid 31860] chroot("/proc/self/fdinfo/") = 0 ``` before even the usage information was printed.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1819

No description provided.

Rows
Columns