github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3009] Franz 5.4.0 not working with seccomp #1887

New issue

Closed

opened 2026-05-05 08:33:15 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:33:15 -06:00

Owner

Originally created by @schferbe on GitHub (Oct 25, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3009

I'm on Archlinux

$ uname -a
Linux tinkerpad 5.3.7-arch1-1-ARCH #1 SMP PREEMPT Fri Oct 18 00:17:03 UTC 2019 x86_64 GNU/Linux

running firejail

$ yay -Qs firejail 
local/firejail 0.9.60-1
    Linux namespaces sandbox program
local/firetools 0.9.58-2
    Graphical user interface of Firejail

and franz from the AUR.

$ yay -Qs franz
local/franz-bin 5.4.0-1
    Franz is a free messaging app for services like WhatsApp, Slack, Messenger
    and many more

After the update of franz 5.4.0 it won't start with the provided profile. If I comment out the seccomp in /etc/firejail/franz.profile it works.

Originally created by @schferbe on GitHub (Oct 25, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/3009 I'm on Archlinux ``` $ uname -a Linux tinkerpad 5.3.7-arch1-1-ARCH #1 SMP PREEMPT Fri Oct 18 00:17:03 UTC 2019 x86_64 GNU/Linux ``` running firejail ``` $ yay -Qs firejail local/firejail 0.9.60-1 Linux namespaces sandbox program local/firetools 0.9.58-2 Graphical user interface of Firejail ``` and franz from the AUR. ``` $ yay -Qs franz local/franz-bin 5.4.0-1 Franz is a free messaging app for services like WhatsApp, Slack, Messenger and many more ``` After the update of franz 5.4.0 it won't start with the provided profile. If I comment out the `seccomp` in `/etc/firejail/franz.profile` it works.

gitea-mirror closed this issue

2026-05-05 08:33:17 -06:00

gitea-mirror commented

2026-05-05 08:33:19 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 25, 2019):

Which syscall is blocked? (syscalls.txt, firejail_seccomp_notify.sh)

@rusty-snake commented on GitHub (Oct 25, 2019): Which syscall is blocked? ([syscalls.txt](https://github.com/netblue30/firejail/blob/master/etc/templates/syscalls.txt#L90), [firejail_seccomp_notify.sh](https://gist.github.com/rusty-snake/7ed6b2a5bed3a6a9709b0faf9fcc86ab))

gitea-mirror commented

2026-05-05 08:33:20 -06:00

Author

Owner

@schferbe commented on GitHub (Oct 26, 2019):

Okt 26 10:52:31 hostname kernel: audit: type=1326 audit(1572079951.745:79): auid=1000 uid=1000 gid=1000 ses=2 pid=2475 comm="franz" exe="/usr/lib/franz/franz" sig=31 arch=c000003e syscall=161 compat=0 ip=0x7f9da9d5ae9d code=0x0

$ firejail --debug-syscalls | grep 161
161	- chroot

But when I change seccomp to seccomp !chroot in /etc/firejail/franz.profile starting franz leads to the following error:

$ franz
Reading profile /etc/firejail/franz.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Error: invalid syscall list

Do I need the firejail_seccomp_notify.sh or is it just a script to automate the task from syscalls.txt?

@schferbe commented on GitHub (Oct 26, 2019): ``` Okt 26 10:52:31 hostname kernel: audit: type=1326 audit(1572079951.745:79): auid=1000 uid=1000 gid=1000 ses=2 pid=2475 comm="franz" exe="/usr/lib/franz/franz" sig=31 arch=c000003e syscall=161 compat=0 ip=0x7f9da9d5ae9d code=0x0 ``` ``` $ firejail --debug-syscalls | grep 161 161 - chroot ``` But when I change `seccomp` to `seccomp !chroot` in `/etc/firejail/franz.profile` starting franz leads to the following error: ``` $ franz Reading profile /etc/firejail/franz.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Error: invalid syscall list ``` Do I need the `firejail_seccomp_notify.sh` or is it just a script to automate the task from `syscalls.txt`?

gitea-mirror commented

2026-05-05 08:33:21 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 26, 2019):

Do I need the firejail_seccomp_notify.sh or is it just a script to automate the task from syscalls.txt?

Nope, just an automated debuging script from me that notify you if blocked syscalls are called.

But when I change seccomp to seccomp !chroot in /etc/firejail/franz.profile starting franz leads to the following error:

The new seccomp exception syntax is only supported in git-master. For older version use this:

-seccomp
+seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice

@rusty-snake commented on GitHub (Oct 26, 2019): > Do I need the firejail_seccomp_notify.sh or is it just a script to automate the task from syscalls.txt? Nope, just an automated debuging script from me that notify you if blocked syscalls are called. > But when I change `seccomp` to `seccomp !chroot` in `/etc/firejail/franz.profile` starting franz leads to the following error: The new seccomp exception syntax is only supported in git-master. For older version use this: ```diff -seccomp +seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice ```

gitea-mirror commented

2026-05-05 08:33:22 -06:00

Author

Owner

@schferbe commented on GitHub (Oct 26, 2019):

That works. The new syntax is definitely nicer.

@schferbe commented on GitHub (Oct 26, 2019): That works. The new syntax is definitely nicer.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1887

No description provided.

Rows
Columns