mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3018] Cannot start sandbox when installing Firejail with Stow #1891
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1891
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (Oct 29, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3018
I installed Firejail from a 0.9.60 git checkout like such
$ ./configure --disable-apparmor --prefix=/usr/local/stow/firejail-0.9.60$ make && sudo make install-strip$ cd /usr/local/stow$ sudo stow firejail-0.9.60which installs the files in /usr/local as symlinks to /usr/local/stow/firejail-0.9.60.
$ ls -l /usr/local/bin/firejaillrwxrwxrwx 1 root root 36 Oct 29 15:36 /usr/local/bin/firejail -> ../stow/firejail-0.9.60/bin/firejailNow when I'm trying to run some programs I'm getting the following error.
$ firejail mpvReading profile /home/me/.config/firejail/mpv.profileReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/disable-common.incReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/disable-devel.incReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/disable-exec.incReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/disable-interpreters.incReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/disable-passwdmgr.incReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/disable-programs.incReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/disable-xdg.incReading profile /usr/local/stow/firejail-0.9.60/etc/firejail/whitelist-var-common.incParent pid 14609, child pid 1461035 programs installed in 23.10 msWarning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.Warning: cleaning all supplementary groupsWarning: cleaning all supplementary groupsBlacklist violations are logged to syslogChild process initialized in 74.75 msError: cannot find the program in the pathParent is shutting down, bye...In this case mpv is installed in /usr/bin/mpv and there's a symlink in /usr/local/bin pointing to firejail.
$ ls -l $(which mpv)lrwxrwxrwx 1 root root 23 Oct 29 14:58 /usr/local/bin/mpv -> /usr/local/bin/firejailThe issue does not occur when I install directly to /usr/local by doing
./configure --prefix=/usr/localOR when commenting out a private-bin line in my mpv.profile
$ grep private-bin mpv.profileprivate-bin mpv,youtube-dl,python*,envI do not have to comment it out when I install without using Stow.
Any ideas what might be causing this?
@rusty-snake commented on GitHub (Oct 30, 2019):
Referring to @glitsj16 idea in #3020: Have your tried to start with
firejail /usr/bin/mpv?@ghost commented on GitHub (Oct 30, 2019):
Trying that gives me the same error. Strangely enough, what does in fact work is removing the mpv symlink and then starting the sandbox:
$ sudo rm /usr/local/bin/mpv$ firejail mpvworks.
My PATH looks as follows
/usr/local/bin:/home/nemu/.local/python/bin:/home/nemu/.local/bin:/home/nemu/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbinand the full mpv config is here.
https://pastebin.com/raw/spS4Z22G
I switched to the git version by the way but everything's the same.
I've just got firejail installed the regular way now and I can't say I feel too strongly about not being able to use stow, so I personally wouldn't mind if this got low priority.
@ghost commented on GitHub (Oct 30, 2019):
Everything is working as expected again and the problem seems to have been resolved entirely by setting
private-bin-no-local yesin my firejail.config. This is the more restrictive option, right? If so, I'll happily leave it like this and as far as I'm concerned the issue can be closed.
@rusty-snake commented on GitHub (Oct 30, 2019):
OT: Why is there
whitelist /usr/share/libdrm? Do you suggest to add it upstream?IDK. Maybe just an option to fix such issues?
@ghost commented on GitHub (Oct 30, 2019):
mpv said this when I didn't have it whitelisted
/usr/share/libdrm/amdgpu.ids: No such file or directoryIt will output this at any log level. It doesn't seem to do any harm but I can't imagine whitelisting it can do any harm either.
https://gitlab.freedesktop.org/mesa/drm/blob/master/data/amdgpu.ids
So could be upstreamed I guess.
@ghost commented on GitHub (Oct 30, 2019):
@rusty-snake Perhaps we can add /usr/share/libdrm (which on my Arch Linux currently has that one file amdgpu.ids) to wusc to ensure support for AMD systems?
@ghost commented on GitHub (Oct 30, 2019):
I'll re-close this when we have a decision on wusc and /usr/share/libdrm. I can't see what upstream can do about it honestly.
@M83tUt3 You can add whitelist /usr/share/libdrm to your mpv.local to get rid of those warnings. Just keep an eye out when we decide to add it to whitelist-usr-share-common.inc, that would make it redundant.
@rusty-snake commented on GitHub (Oct 30, 2019):
If this is used by more than a few programs, we should move it to wusc.
@rusty-snake commented on GitHub (Oct 30, 2019):
I already add it to mpv (IDK if you see it).
@rusty-snake commented on GitHub (Oct 30, 2019):
IMHO we should move it to wusc.
@ghost commented on GitHub (Oct 30, 2019):
Moved /usr/share/libdrm to wusc via
591d66319f. Also removed it from mpv.profile again via8822422e55.