[GH-ISSUE #2995] Epiphany needs bwrap

gitea-mirror commented

2026-05-05 08:32:42 -06:00

Owner

Originally created by @mkdy on GitHub (Oct 8, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2995

A fresh version of Epiphany browser (3.34.1-1) uses bwrap for some purposes (have no idea why).
I've created epiphany.local and filled it with:
noblacklist ${PATH}/bwrap
However, it seems that bwrap itself needs some permissions such as internet access.

Originally created by @mkdy on GitHub (Oct 8, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2995 A fresh version of Epiphany browser (3.34.1-1) uses bwrap for some purposes (have no idea why). I've created `epiphany.local` and filled it with: `noblacklist ${PATH}/bwrap` However, it seems that `bwrap` itself needs some permissions such as internet access.

gitea-mirror closed this issue

2026-05-05 08:32:43 -06:00

gitea-mirror commented

2026-05-05 08:32:46 -06:00

Author

Owner

@Vincent43 commented on GitHub (Oct 8, 2019):

bwrap is very similar to firejail itself sandboxing tool (used by flatpak) and I guess Epiphany uses it for that. Perhaps we have to drop epiphany support as overlapping sandboxes can't work.

@Vincent43 commented on GitHub (Oct 8, 2019): bwrap is very similar to firejail itself sandboxing tool (used by flatpak) and I guess Epiphany uses it for that. Perhaps we have to drop epiphany support as overlapping sandboxes can't work.

gitea-mirror commented

2026-05-05 08:32:46 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 8, 2019):

Confirming. Fedora 31 BETA VM with firejail-git.

$ LC_ALL=C epiphany 
Reading profile /etc/firejail/epiphany.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Parent pid 41676, child pid 41677
Child process initialized in 142.89 ms

** (epiphany:5): ERROR **: 17:02:33.800: Unable to fork a new child process: Failed to execute child process ?/usr/bin/bwrap? (Permission denied)

Parent is shutting down, bye...
$ LC_ALL=C firejail --noprofile epiphany 
Parent pid 41762, child pid 41763
Child process initialized in 11.65 ms
Warning: an existing sandbox was detected. /usr/bin/epiphany will run without any additional sandboxing features
bwrap: Can't mount proc on /newroot/proc: Operation not permitted

(epiphany:2): GLib-GObject-WARNING **: 17:02:50.308: ../gobject/gsignal.c:2647: instance '0x55c894894390' has no handler with id '2782'

Parent is shutting down, bye...

@rusty-snake commented on GitHub (Oct 8, 2019): Confirming. Fedora 31 BETA VM with firejail-git. ``` $ LC_ALL=C epiphany Reading profile /etc/firejail/epiphany.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Parent pid 41676, child pid 41677 Child process initialized in 142.89 ms ** (epiphany:5): ERROR **: 17:02:33.800: Unable to fork a new child process: Failed to execute child process ?/usr/bin/bwrap? (Permission denied) Parent is shutting down, bye... $ LC_ALL=C firejail --noprofile epiphany Parent pid 41762, child pid 41763 Child process initialized in 11.65 ms Warning: an existing sandbox was detected. /usr/bin/epiphany will run without any additional sandboxing features bwrap: Can't mount proc on /newroot/proc: Operation not permitted (epiphany:2): GLib-GObject-WARNING **: 17:02:50.308: ../gobject/gsignal.c:2647: instance '0x55c894894390' has no handler with id '2782' Parent is shutting down, bye... ```

gitea-mirror commented

2026-05-05 08:32:48 -06:00

Author

Owner

@smitsohu commented on GitHub (Oct 10, 2019):

It is probably similar to Chrome, only the (sometimes setuid) sandbox binary is different.

@smitsohu commented on GitHub (Oct 10, 2019): It is probably similar to Chrome, only the (sometimes setuid) sandbox binary is different.

gitea-mirror commented

2026-05-05 08:32:49 -06:00

Author

Owner

@FOSSONLY commented on GitHub (Oct 12, 2019):

@Vincent43
In fact, Firejail had no support for the Epiphany browser so far. The existing profile called Epiphany refers to a game of the same name. You should better use the Firefox profile for Epiphany.

However, I'm not sure how good it is for programs to bring their own sandbox. So the security is in the hands of the developers, and the user loses any flexibility to define it, if you don't want to change the source code. Personally, I would always use Firejail, because I don't think any program should be able to control its own security. For me, this is something that has to be centrally enforced, to which every program has to subordinate itself. What do the others think about it?

@FOSSONLY commented on GitHub (Oct 12, 2019): @Vincent43 In fact, Firejail had no support for the Epiphany browser so far. The existing profile called Epiphany refers to a game of the same name. You should better use the Firefox profile for Epiphany. However, I'm not sure how good it is for programs to bring their own sandbox. So the security is in the hands of the developers, and the user loses any flexibility to define it, if you don't want to change the source code. Personally, I would always use Firejail, because I don't think any program should be able to control its own security. For me, this is something that has to be centrally enforced, to which every program has to subordinate itself. What do the others think about it?

gitea-mirror commented

2026-05-05 08:32:50 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 12, 2019):

The existing profile called Epiphany refers to a game of the same name.

IMHO we should say this explicit in the profile that is not for epiphany (aka GNOME Web) and remove it form firecfg.config since it cause name conflicts. Maybe also rename to epiphany_game.profile or similar.

@rusty-snake commented on GitHub (Oct 12, 2019): > The existing profile called Epiphany refers to a game of the same name. IMHO we should say this explicit in the profile that is not for epiphany (aka GNOME Web) and remove it form `firecfg.config` since it cause name conflicts. Maybe also rename to `epiphany_game.profile` or similar.

gitea-mirror commented

2026-05-05 08:32:51 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 12, 2019):

What do the others think about it?

👍 💯 IMHO a tight firejail sandbox is better, if possible. For chromium this would mean starting with --no-sandbox and hardening the FJ profile. Anyway the fox is better 😇

@rusty-snake commented on GitHub (Oct 12, 2019): > What do the others think about it? :+1: :100: IMHO a tight firejail sandbox is better, if possible. For `chromium` this would mean starting with `--no-sandbox` and hardening the FJ profile. Anyway the fox is better :innocent:

gitea-mirror commented

2026-05-05 08:32:52 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Oct 14, 2019):

Whoa there
epiphany.profile is indeed for GNOME Web
Must've slipped through the cracks with the automated descriptions pull
4666466fc6

@SkewedZeppelin commented on GitHub (Oct 14, 2019): Whoa there epiphany.profile is indeed for GNOME Web Must've slipped through the cracks with the automated descriptions pull 4666466fc61b15faa162ec5a2d599a2987283164

gitea-mirror commented

2026-05-05 08:32:52 -06:00

Author

Owner

@Vincent43 commented on GitHub (Oct 14, 2019):

@SkewedZeppelin nice, should we sunset it though, considering it's broken with 3.34+?

@Vincent43 commented on GitHub (Oct 14, 2019): @SkewedZeppelin nice, should we sunset it though, considering it's broken with 3.34+?

gitea-mirror commented

2026-05-05 08:32:53 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 14, 2019):

Adding a note about broke for 3.34+ and removing form firecfg, but leaving for now for e.g. debian users.

@rusty-snake commented on GitHub (Oct 14, 2019): Adding a note about broke for 3.34+ and removing form firecfg, but leaving for now for e.g. debian users.

gitea-mirror commented

2026-05-05 08:32:54 -06:00

Author

Owner

@msva commented on GitHub (Jul 21, 2024):

actually, it looks like it is possible (at least, for now) to kinda "mitigate" this problem by setting WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS variable value to 1 in firejail profile

Or by creating one of this files inside "jail": 0678a98c86/Source/WTF/wtf/glib/Sandbox.cpp (L42)
0678a98c86/Source/WTF/wtf/glib/Sandbox.cpp (L35)

@msva commented on GitHub (Jul 21, 2024): actually, it looks like it is possible (at least, for now) to kinda "mitigate" this problem by setting [WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS](https://github.com/WebKit/WebKit/blob/0678a98c864ee36f0114ea4e7d303fd07788a822/Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp#L105) variable value to `1` in firejail profile Or by creating one of this files inside "jail": https://github.com/WebKit/WebKit/blob/0678a98c864ee36f0114ea4e7d303fd07788a822/Source/WTF/wtf/glib/Sandbox.cpp#L42 https://github.com/WebKit/WebKit/blob/0678a98c864ee36f0114ea4e7d303fd07788a822/Source/WTF/wtf/glib/Sandbox.cpp#L35

gitea-mirror commented

2026-05-05 08:32:54 -06:00

Author

Owner

@ghost commented on GitHub (Jul 21, 2024):

@msva

looks like it is possible ...by setting WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1

Very nice find! Can you open a PR to add this to our epiphany.profile?

Side note:

Going over the referenced ProcessLauncherGlib.cpp file I noticed that this env var replaces the now deprecated WEBKIT_FORCE_SANDBOX env var. We set the latter in the bijiben.profile:

969e29b756/etc/profile-a-l/bijiben.profile (L62)

@ghost commented on GitHub (Jul 21, 2024): @msva > looks like it is possible ...by setting WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 Very nice find! Can you open a PR to add this to our epiphany.profile? Side note: Going over the referenced [ProcessLauncherGlib.cpp](https://github.com/WebKit/WebKit/blob/0678a98c864ee36f0114ea4e7d303fd07788a822/Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp#L117) file I noticed that this env var replaces the now deprecated `WEBKIT_FORCE_SANDBOX` env var. We set the latter in the `bijiben.profile`: https://github.com/netblue30/firejail/blob/969e29b756e91e00b1b0b5f86f9f4d8801ad987b/etc/profile-a-l/bijiben.profile#L62

gitea-mirror commented

2026-05-05 08:32:55 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 21, 2024):

Can you open a PR to add this to our epiphany.profile?

No, we should not add this.

@rusty-snake commented on GitHub (Jul 21, 2024): > Can you open a PR to add this to our epiphany.profile? No, we should not add this.

gitea-mirror commented

2026-05-05 08:32:55 -06:00

Author

Owner

@ghost commented on GitHub (Jul 21, 2024):

No, we should not add this.

@rusty-snake Unsafe to do so?

@ghost commented on GitHub (Jul 21, 2024): > No, we should not add this. @rusty-snake Unsafe to do so?

gitea-mirror commented

2026-05-05 08:32:56 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 21, 2024):

Yes

epiphany+bwrap is more secure than firejail+epiphany-bwrap. If people still want to do this against my/our advise, for the more-secure-felling-but-less-secure-in-reality, we could add a comment (I really do not want to promote those unsafe debugging hacks).

@rusty-snake commented on GitHub (Jul 21, 2024): Yes epiphany+bwrap is more secure than firejail+epiphany-bwrap. If people still want to do this against my/our advise, for the more-secure-felling-but-less-secure-in-reality, we could add a comment (I really do not want to promote those unsafe debugging hacks).

gitea-mirror commented

2026-05-05 08:32:56 -06:00

Author

Owner

@ghost commented on GitHub (Jul 21, 2024):

@rusty-snake

I totally agree. We already have a comment in epiphany.profile referring to this issue, so I think we're good as-is. Thanks for your explaining!

On that note, we should drop the unsafe workaround in bijiben.profile. As far as I understand the deprecated env var won't work any longer anyway.

@ghost commented on GitHub (Jul 21, 2024): @rusty-snake I totally agree. We already have a comment in epiphany.profile referring to this issue, so I think we're good as-is. Thanks for your explaining! On that note, we should drop the unsafe workaround in `bijiben.profile`. As far as I understand the deprecated env var won't work any longer anyway.

Rows
Columns

[GH-ISSUE #2995] Epiphany needs bwrap #1877