github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2941] gnome-schedule is broken #1836

New issue

Closed

opened 2026-05-05 08:30:16 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:30:16 -06:00

Owner

Originally created by @ghost on GitHub (Sep 6, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2941

After recent changes to the gnome-schedule profile this app is now broken:

$ firejail /usr/bin/gnome-schedule
Reading profile /etc/firejail/gnome-schedule.profile
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/allow-python2.inc
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-common.local
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-passwdmgr.local
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-programs.local
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/disable-xdg.local
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 14462, child pid 14473

Error: invalid file type, /etc/at.deny.
Error: proc 14462 cannot sync with peer: unexpected EOF
Peer 14473 unexpectedly exited with status 1

I can only make it work by adding the following to gnome-schedule.local:

noblacklist /etc/at.allow
noblacklist /etc/at.deny
ignore private-etc
private-etc fonts,ld.so.preload,pam.d

Adding noblacklist /etc/at.{allow,deny} was changed in https://github.com/netblue30/firejail/pull/2886 (see 2e9a23d30c (diff-3e7cec4e68d91d1d0d349532367d3659)). Unsure what's the best way to fix this...

Originally created by @ghost on GitHub (Sep 6, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2941 After recent changes to the `gnome-schedule` profile this app is now broken: ``` $ firejail /usr/bin/gnome-schedule Reading profile /etc/firejail/gnome-schedule.profile Reading profile /etc/firejail/globals.local Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-common.local Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-passwdmgr.local Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-programs.local Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/disable-xdg.local Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 14462, child pid 14473 Error: invalid file type, /etc/at.deny. Error: proc 14462 cannot sync with peer: unexpected EOF Peer 14473 unexpectedly exited with status 1 ``` I can only make it work by adding the following to `gnome-schedule.local`: ``` noblacklist /etc/at.allow noblacklist /etc/at.deny ignore private-etc private-etc fonts,ld.so.preload,pam.d ``` Adding noblacklist /etc/at.{allow,deny} was changed in https://github.com/netblue30/firejail/pull/2886 (see https://github.com/netblue30/firejail/commit/2e9a23d30cbcd6357a061f208492382dda215e17#diff-3e7cec4e68d91d1d0d349532367d3659). Unsure what's the best way to fix this...

gitea-mirror closed this issue

2026-05-05 08:30:17 -06:00

gitea-mirror commented

2026-05-05 08:30:18 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 6, 2019):

@glitsj16 your right, probably it's the best to drop private-etc. But why do you need the noblacklists, on my system firejail --ignore=private-etc --profile=gnome-schedule cat /etc/at.deny works?

ignore private-etc
private-etc …

Makes no sens, or?

noblacklist /etc/at.allow
noblacklist /etc/at.deny

Where we blacklist?

Error: invalid file type, /etc/shadow.
Error: proc 4600 cannot sync with peer: unexpected EOF
Peer 4601 unexpectedly exited with status 1

I get this error if private-etc contains files that I can't read.

@rusty-snake commented on GitHub (Sep 6, 2019): @glitsj16 your right, probably it's the best to drop `private-etc`. But why do you need the `noblacklist`s, on my system `firejail --ignore=private-etc --profile=gnome-schedule cat /etc/at.deny` works? ``` ignore private-etc private-etc … ``` Makes no sens, or? ``` noblacklist /etc/at.allow noblacklist /etc/at.deny ``` Where we blacklist? ``` Error: invalid file type, /etc/shadow. Error: proc 4600 cannot sync with peer: unexpected EOF Peer 4601 unexpectedly exited with status 1 ``` I get this error if `private-etc` contains files that I can't read.

gitea-mirror commented

2026-05-05 08:30:19 -06:00

Author

Owner

@ghost commented on GitHub (Sep 6, 2019):

@rusty-snake

But why do you need the noblacklists... ?

Turned out that on my system /etc/at.deny had 0640 permissions. After changing that to 0644 all that is needed to fix the profile is ignore private-etc. Thanks for making me look further than I did before 👍 .

@ghost commented on GitHub (Sep 6, 2019): @rusty-snake > But why do you need the noblacklists... ? Turned out that on my system /etc/at.deny had 0640 permissions. After changing that to 0644 all that is needed to fix the profile is `ignore private-etc`. Thanks for making me look further than I did before :+1: .

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1836

No description provided.

Rows
Columns