github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3092] firefox: u2f does not work if plugged in after launching (private-dev) #1938

New issue

Closed

opened 2026-05-05 08:36:17 -06:00 by gitea-mirror · 14 comments

gitea-mirror commented

2026-05-05 08:36:17 -06:00

Owner

Originally created by @ibahnasy on GitHub (Dec 22, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3092

U2F doesn't work if Firefox is launched with firejail.
Even firejail --ignore=private-dev firefox didn't solve the issue.
There should be a permanent fix in the firejail profile file for Firefox.

Originally created by @ibahnasy on GitHub (Dec 22, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/3092 U2F doesn't work if Firefox is launched with firejail. Even `firejail --ignore=private-dev firefox` didn't solve the issue. There should be a permanent fix in the firejail profile file for Firefox.

gitea-mirror

2026-05-05 08:36:17 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 08:36:20 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 22, 2019):

grep "browser-disable-u2f" /etc/firejail/firejail.config #2531. Firejail version?

@rusty-snake commented on GitHub (Dec 22, 2019): `grep "browser-disable-u2f" /etc/firejail/firejail.config` #2531. Firejail version?

gitea-mirror commented

2026-05-05 08:36:21 -06:00

Author

Owner

@ibahnasy commented on GitHub (Dec 22, 2019):

I set it browser-disable-u2f to no and now it works.

Thanks a lot!

@ibahnasy commented on GitHub (Dec 22, 2019): I set it `browser-disable-u2f` to `no` and now it works. Thanks a lot!

gitea-mirror commented

2026-05-05 08:36:22 -06:00

Author

Owner

@ibahnasy commented on GitHub (Dec 22, 2019):

But the u2f key has to be plugged first before launching Firefox!
Any solution to this case?

@ibahnasy commented on GitHub (Dec 22, 2019): But the u2f key has to be plugged first before launching Firefox! Any solution to this case?

gitea-mirror commented

2026-05-05 08:36:23 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 22, 2019):

What happens with

remove u2f key
start firefox with firejail --noprofile firefox
add u2f key
test u2f

@rusty-snake commented on GitHub (Dec 22, 2019): What happens with - remove u2f key - start firefox with `firejail --noprofile firefox` - add u2f key - test u2f

gitea-mirror commented

2026-05-05 08:36:24 -06:00

Author

Owner

@ibahnasy commented on GitHub (Dec 22, 2019):

In this scenario, the u2f works fine.

@ibahnasy commented on GitHub (Dec 22, 2019): In this scenario, the u2f works fine.

gitea-mirror commented

2026-05-05 08:36:25 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Dec 22, 2019):

private-dev causes any devices attached after sandbox creation to not be available.

@SkewedZeppelin commented on GitHub (Dec 22, 2019): private-dev causes any devices attached after sandbox creation to not be available.

gitea-mirror commented

2026-05-05 08:36:25 -06:00

Author

Owner

@cockytrumpet commented on GitHub (Dec 23, 2019):

I found this issue trying to solve the same problem with my Yubikey, but firefox would crash when I press the button to authenticate even with browser-disable-u2f set to no.

The solution was to remove sys_name_to_handle_at from the seccomp list.

I’m sure there’s a better way to do that, but adding seccomp.keep sys_name_to_handle_at to firefox.local didn’t work.

@cockytrumpet commented on GitHub (Dec 23, 2019): I found this issue trying to solve the same problem with my Yubikey, but firefox would crash when I press the button to authenticate even with `browser-disable-u2f` set to no. The solution was to remove `sys_name_to_handle_at` from the seccomp list. I’m sure there’s a better way to do that, but adding `seccomp.keep sys_name_to_handle_at` to firefox.local didn’t work.

gitea-mirror commented

2026-05-05 08:36:26 -06:00

Author

Owner

@Vincent43 commented on GitHub (Dec 23, 2019):

Did you added some custom rules to firefox profile? This sounds similar to https://github.com/netblue30/firejail/issues/3074#issuecomment-563013316

@Vincent43 commented on GitHub (Dec 23, 2019): Did you added some custom rules to firefox profile? This sounds similar to https://github.com/netblue30/firejail/issues/3074#issuecomment-563013316

gitea-mirror commented

2026-05-05 08:36:26 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 23, 2019):

I’m sure there’s a better way to do that, but adding seccomp.keep sys_name_to_handle_at to firefox.local didn’t work.

seccomp.keep "whitelist" syscall, this means every syscall not listed is blocked.

Replace seccomp with:
Firejail >=0.9.61: seccomp !name_to_handle_at
Firejail <=0.9.60: seccomp.drop @debug,@obsolete,@privileged,@resources,add_key,fanotify_init,i@cpu-emulation,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,ni_syscall,open_by_handle_at,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice

@rusty-snake commented on GitHub (Dec 23, 2019): > I’m sure there’s a better way to do that, but adding `seccomp.keep sys_name_to_handle_at` to firefox.local didn’t work. `seccomp.keep` "whitelist" syscall, this means every syscall not listed is blocked. Replace `seccomp` with: Firejail >=0.9.61: `seccomp !name_to_handle_at` Firejail <=0.9.60: `seccomp.drop @debug,@obsolete,@privileged,@resources,add_key,fanotify_init,i@cpu-emulation,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,ni_syscall,open_by_handle_at,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice`

gitea-mirror commented

2026-05-05 08:36:28 -06:00

Author

Owner

@cockytrumpet commented on GitHub (Dec 23, 2019):

@Vincent43 The only other change I made to the profile was commenting out ?BROWSER_DISABLE_U2F: nou2f which i saw in https://github.com/netblue30/firejail/issues/2531.

Gentoo kernel 5.4.6
firejail 0.9.60-r1
firefox 71.0-r1

@rusty-snake Thanks, I misunderstood what .keep was doing.

@cockytrumpet commented on GitHub (Dec 23, 2019): @Vincent43 The only other change I made to the profile was commenting out `?BROWSER_DISABLE_U2F: nou2f` which i saw in https://github.com/netblue30/firejail/issues/2531. - Gentoo kernel 5.4.6 - firejail 0.9.60-r1 - firefox 71.0-r1 @rusty-snake Thanks, I misunderstood what .keep was doing.

gitea-mirror commented

2026-05-05 08:36:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 17, 2020):

@ibahnasy
I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

@rusty-snake commented on GitHub (Jan 17, 2020): @ibahnasy I'm closing here due to inactivity, please fell free to reopen if you still have this issue.

gitea-mirror commented

2026-05-05 08:36:28 -06:00

Author

Owner

@ibahnasy commented on GitHub (Jan 20, 2020):

How does using no profile affects the security firejail --noprofile firefox?

@ibahnasy commented on GitHub (Jan 20, 2020): How does using no profile affects the security `firejail --noprofile firefox`?

gitea-mirror commented

2026-05-05 08:36:29 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 20, 2020):

You have no seccomp, all caps, no disable-*, ...

@rusty-snake commented on GitHub (Jan 20, 2020): You have no seccomp, all caps, no disable-*, ...

gitea-mirror commented

2026-05-05 08:36:29 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jan 20, 2020):

--noprofile is very close to not using firejail at all.

@Vincent43 commented on GitHub (Jan 20, 2020): `--noprofile` is very close to not using firejail at all.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1938

No description provided.

Rows
Columns