mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2987] Issues with using Firefox addon VideoDownloadHelper's "companion app" #1868
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1868
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @bobafetthotmail on GitHub (Oct 2, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2987
The popular extension VideoDownloadHelper (for both Firefox and Chrome) relies on an additional application https://www.downloadhelper.net/install-coapp?browser=firefox to be able to download high-resolution media.
I've extracted the archive in (HOME)/dwhelper/net.downloadhelper.coapp/ and ran the "user installation" (which is just generating a config file that links to the application, as I documented here https://github.com/mi-g/vdhcoapp/issues/47#issuecomment-537663897 )
These are the contents of that folder
and then tried adding things to the /etc/firejail/firefox-common-addons.inc
until I ended up with these additions
And each time I restarted Firefox. But it does not seem to work, the addon can't find its "companion app". Anyone has some advice?
EDIT: If I place the "companion app" in the /downloads folder (which is whitelisted and accessible by default) I get
Failed to execute command "/home/alby/Downloads/net.downloadhelper.coapp/bin/net.downloadhelper.coapp-linux-64"as error message in the addon when I ask it to detect the presence of its "companion app"
@rusty-snake commented on GitHub (Oct 2, 2019):
mkdir/whitelistwhitelist ${HOME}/dwhelpershould be enought.browser-allow-drm yesinfirejail.config@rusty-snake commented on GitHub (Oct 2, 2019):
firejail --whitelist='${HOME}/dwhelper --ignore='noexec ${HOME}' firefox@bobafetthotmail commented on GitHub (Oct 2, 2019):
2 and 3. ok removing other lines
As for your second post, I can't run firefox (or thunderbird) from commandline. Other applications (say filezilla) can be called from command line like that.
I converted the "ignore noexec" into configuration.
Now I have added only
whitelist ${HOME}/dwhelperignore noexec ${HOME}/dwhelperto firefox-common-addons.inc
And something is different. Instead of giving "unknown issue" I get
Checking companion app returned: Failed to execute command "/home/alby/dwhelper/net.downloadhelper.coapp/bin/net.downloadhelper.coapp-linux-64"Closer, but still no cigar.
@rusty-snake commented on GitHub (Oct 2, 2019):
ignore noexec ${HOME}/dwhelper->ignore noexec ${HOME}which firejail version?
BTW:
ignore noexec ${HOME}andbrowser-allow-drm yesare the same.`
@bobafetthotmail commented on GitHub (Oct 2, 2019):
Changed to
ignore noexec ${HOME}, still the same error as above.I'm running OpenSUSE Tumbleweed, and latest Firejail release, from what I can tell
@rusty-snake commented on GitHub (Oct 2, 2019):
NOTE:
whitelist ${HOME}/dwhelpershould already in firefox-common-addons.incDoes
net.downloadhelper.coapp-linux-64need an interpreter like python? or is it an ELF file?@bobafetthotmail commented on GitHub (Oct 2, 2019):
Yes it shows as ELF if I open it with a hex editor.
The application https://github.com/mi-g/vdhcoapp is actually javascript and very light, so I think that binary is an all-in-one javascript runtime + dependencies + application.
It seems to be "compiled" with npm (Node JS), only other application it needs is the (static? I don't know) ffmpeg it ships in its own folder
/home/alby/dwhelper/net.downloadhelper.coapp/converter/build/linux/64/@rusty-snake commented on GitHub (Oct 2, 2019):
Can it be execute with
firejail --profile=firefox /home/alby/dwhelper/net.downloadhelper.coapp/bin/net.downloadhelper.coapp-linux-64?@bobafetthotmail commented on GitHub (Oct 2, 2019):
It seems so. If started with no arguments it sits there not printing nothing on console until i Ctrl+C and then it closes, like it does if I invoke it without firejail.
This is with the "install" command so it can actually answer something on the terminal, the
"VdhCoApp: VdhCoApp is ready to be used"
is the application output.
@rusty-snake commented on GitHub (Oct 3, 2019):
Hmm, the profile allows executeing this file, but VDH can't execute it. Can you check if it works with
firejail --noprofile firefoxso we can see if we need to tune the profile or the issues is deeper.@Vincent43 commented on GitHub (Oct 3, 2019):
It may be blocked by apparmor. Please try
ignore apparmorinfirefox.local.@bobafetthotmail commented on GitHub (Oct 5, 2019):
tried with
ignore apparmorand no difference.firejail --noprofile firefoxworks and the addon can detect its "companion app", as I understand this command is running with firejail disabled. I can also call firefox manually from its actual binary path and it also works fine.I mean, it worked fine up and until I installed firejail and ran firecfg to create the symlinks, I'm pretty sure that the issue is in firejail or its profiles.
@pizzadude commented on GitHub (Oct 5, 2019):
Can you try this? This works for me:
put this in ~/.config/firejail/firefox.local
noblacklist ~/net.downloadhelper.coapp
whitelist ~/net.downloadhelper.coapp
(Change the path to where you have it installed)
Also make sure you do this: ~/net.downloadhelper.coapp/bin/net.downloadhelper.coapp-linux-64 install --user
It works since forever in firejail stable, and git versions (currently running from latest git)
@bobafetthotmail commented on GitHub (Oct 5, 2019):
Hm, what you did isn't different from what I also tried (I just edited the main config files, that would be overwritten on update).
I just tried and your method does not work for me.
Maybe this is a distro default configuration of something? What is your distro?
@rusty-snake commented on GitHub (Oct 5, 2019):
@bobafetthotmail have you edited some thing else? e.g.
private-bin@pizzadude commented on GitHub (Oct 5, 2019):
@bobafetthotmail My distro is Fedora 31. I am running firejail from git.
@bobafetthotmail commented on GitHub (Oct 5, 2019):
No I didn't edit anything more than what I said here or you recommended. I rolled back any change to defaults when I tested @pizzadude firefox.local
But I tried adding
ignore apparmorto @pizzadude firefox.local because of what I've seen below, and now it is working.Any way forward?
Hm, Fedora uses SELinux and not AppArmor. The AppArmor config is getting in the way here.
In Yast (graphical system configuration manager for OpenSUSE) I see that AppArmor has an "audit module" and if I ask it to read the logs it does ask me to do something about the problem at hand.
And then a row of buttons:
Inherit | Child | Profile | Named | Unconfined | X ix On | Deny | Abort | FinishI don't know what I should answer, or if this is even supposed to happen (isn't firejail supposed to deal with apparmor on its own?) .
I've answered "Abort" and this closes the window without taking any decision.
Any ideas?
@Vincent43 commented on GitHub (Oct 5, 2019):
You have two choices:
ignore apparmortofirefox.local/home/alby/dwhelper/net.downloadhelper.coapp/bin/** ix,to/etc/apparmor.d/local/firejail-localand restart apparmor or reboot@rusty-snake commented on GitHub (Nov 10, 2019):
@bobafetthotmail
I'm closing here due to inactivity, please fell free to request reopen if you still have this issue.