[GH-ISSUE #3110] mupdf: profile does not work for mupdf-gl

gitea-mirror commented

2026-05-05 08:36:53 -06:00

Owner

Originally created by @q3cpma on GitHub (Jan 3, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3110

Hello,

I've found that the mupdf profile was probably made for the mupdf-x11 only and didn't work with mupdf-gl one, which is becoming the standard. To "fix" it, you need to remove private-etc alternatives,fonts, otherwise I get:

libGL error: MESA-LOADER: failed to open radeonsi (search paths /usr/lib64/dri)
libGL error: failed to load driver: radeonsi
libGL error: failed to open /dev/dri/card0: Permission denied
libGL error: failed to load driver: radeonsi
libGL error: MESA-LOADER: failed to open swrast (search paths /usr/lib64/dri)
libGL error: failed to load driver: swrast

which is strange.

And memory-deny-write-execute just makes it freeze during loading.

I guess the profile should handle the whole different binary thing, but I'm not sure why that private-etc would break things like this.

Originally created by @q3cpma on GitHub (Jan 3, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3110 Hello, I've found that the mupdf profile was probably made for the `mupdf-x11` only and didn't work with `mupdf-gl` one, which is becoming the standard. To "fix" it, you need to remove `private-etc alternatives,fonts`, otherwise I get: ``` libGL error: MESA-LOADER: failed to open radeonsi (search paths /usr/lib64/dri) libGL error: failed to load driver: radeonsi libGL error: failed to open /dev/dri/card0: Permission denied libGL error: failed to load driver: radeonsi libGL error: MESA-LOADER: failed to open swrast (search paths /usr/lib64/dri) libGL error: failed to load driver: swrast ``` which is strange. And `memory-deny-write-execute` just makes it freeze during loading. I guess the profile should handle the whole different binary thing, but I'm not sure why that private-etc would break things like this.

gitea-mirror closed this issue

2026-05-05 08:36:54 -06:00

gitea-mirror commented

2026-05-05 08:36:56 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 3, 2020):

Oh yeah, I'm using firejail 0.9.62 on Gentoo.

@q3cpma commented on GitHub (Jan 3, 2020): Oh yeah, I'm using firejail 0.9.62 on Gentoo.

gitea-mirror commented

2026-05-05 08:36:57 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 3, 2020):

Thx for the rerport

And memory-deny-write-execute just makes it freeze during loading.

We should commentd mdwe and leave a note.

To "fix" it, you need to remove private-etc alternatives,fonts

This is a very short private-etc line, we should extend it to fix it. Can you run firejail --build mupdf-gl and post the private-etc line from the output (it is at the end of this huge output).

@rusty-snake commented on GitHub (Jan 3, 2020): Thx for the rerport > And `memory-deny-write-execute` just makes it freeze during loading. We should commentd mdwe and leave a note. > To "fix" it, you need to remove `private-etc alternatives,fonts` This is a very short private-etc line, we should extend it to fix it. Can you run `firejail --build mupdf-gl` and post the private-etc line from the output (it is at the end of this huge output).

gitea-mirror commented

2026-05-05 08:36:58 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 3, 2020):

On Fri, Jan 03, 2020 at 02:03:07AM -0800, rusty-snake wrote:

Thx for the rerport

And memory-deny-write-execute just makes it freeze during loading.

We should commentd mdwe and leave a note.

To "fix" it, you need to remove private-etc alternatives,fonts

This is a very short private-etc line, we should extend it to fix it. Can you run firejail --build mupdf-gl and post the private-etc line from the output (it is at the end of this huge output).

It produces private-etc passwd,drirc,. Really don't know where it comes from, that problem existed with qtwebengine at some point because /usr/lib/llvm/* wasn't properly whitelisted.

@q3cpma commented on GitHub (Jan 3, 2020): On Fri, Jan 03, 2020 at 02:03:07AM -0800, rusty-snake wrote: > Thx for the rerport > > > > And `memory-deny-write-execute` just makes it freeze during loading. > > We should commentd mdwe and leave a note. > > > To "fix" it, you need to remove `private-etc alternatives,fonts` > > This is a very short private-etc line, we should extend it to fix it. Can you run `firejail --build mupdf-gl` and post the private-etc line from the output (it is at the end of this huge output). It produces `private-etc passwd,drirc,`. Really don't know where it comes from, that problem existed with qtwebengine at some point because `/usr/lib/llvm/*` wasn't properly whitelisted.

gitea-mirror commented

2026-05-05 08:37:00 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 3, 2020):

Can you try with private-etc alternatives,fonts,drirc and if this does not work add passwd. /etc/drirc contains infos/configs about "drivers".

08d9927942/etc/templates/profile.template (L169)

@rusty-snake commented on GitHub (Jan 3, 2020): Can you try with `private-etc alternatives,fonts,drirc` and if this does not work add `passwd`. /etc/drirc contains infos/configs about "drivers". https://github.com/netblue30/firejail/blob/08d99279428041f20f922c7df2c9df574ec34bda/etc/templates/profile.template#L169

gitea-mirror commented

2026-05-05 08:37:01 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 3, 2020):

On Fri, Jan 03, 2020 at 02:45:40AM -0800, rusty-snake wrote:

Can you try with private-etc alternatives,fonts,drirc and if this does not work add passwd. /etc/drirc contains infos/configs about "drivers".

Doesn't work. By adding ld.so.cache to private-etc, it does. There's probably a mesa/opengl specific incl to use to get it, right?

@q3cpma commented on GitHub (Jan 3, 2020): On Fri, Jan 03, 2020 at 02:45:40AM -0800, rusty-snake wrote: > Can you try with `private-etc alternatives,fonts,drirc` and if this does not work add `passwd`. /etc/drirc contains infos/configs about "drivers". Doesn't work. By adding ld.so.cache to private-etc, it does. There's probably a mesa/opengl specific incl to use to get it, right?

gitea-mirror commented

2026-05-05 08:37:02 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 3, 2020):

Does this work? private-etc alternatives,fonts,drirc,glvnd,bumblebee,nvidia,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload

@rusty-snake commented on GitHub (Jan 3, 2020): Does this work? `private-etc alternatives,fonts,drirc,glvnd,bumblebee,nvidia,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload`

gitea-mirror commented

2026-05-05 08:37:02 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 3, 2020):

Yes, but like I said, I only needed ld.so.cache (should probably add ld.*). But it looks like a hack to specify it that way.

@q3cpma commented on GitHub (Jan 3, 2020): Yes, but like I said, I only needed `ld.so.cache` (should probably add ld.*). But it looks like a hack to specify it that way.

gitea-mirror commented

2026-05-05 08:37:03 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 3, 2020):

Ah, looks like there's no common file for it, indeed.

@q3cpma commented on GitHub (Jan 3, 2020): Ah, looks like there's no common file for it, indeed.

gitea-mirror commented

2026-05-05 08:37:04 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 3, 2020):

Now, the real problem is that firejail should use $(basename -- "$(readlink -f -- "$1")") as binary name to find the appropriate profile, then use the symlink name.

@q3cpma commented on GitHub (Jan 3, 2020): Now, the real problem is that firejail should use `$(basename -- "$(readlink -f -- "$1")")` as binary name to find the appropriate profile, then use the symlink name.

gitea-mirror commented

2026-05-05 08:37:04 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 3, 2020):

Yes, but like I said, I only needed ld.so.cache (should probably add ld.*). But it looks like a hack to specify it that way.

So for you it is private-etc alternatives,fonts,ld.so.cache, right?

@rusty-snake commented on GitHub (Jan 3, 2020): > Yes, but like I said, I only needed `ld.so.cache` (should probably add ld.*). But it looks like a hack to specify it that way. So for you it is `private-etc alternatives,fonts,ld.so.cache`, right?

gitea-mirror commented

2026-05-05 08:37:05 -06:00

Author

Owner

@q3cpma commented on GitHub (Jan 3, 2020):

On Fri, Jan 03, 2020 at 06:43:05AM -0800, rusty-snake wrote:

Yes, but like I said, I only needed ld.so.cache (should probably add ld.*). But it looks like a hack to specify it that way.

So for you it is private-etc alternatives,fonts,ld.so.cache, right?

Yes, but I added the rest of ld.*. The .cache might disappear anytime.

@q3cpma commented on GitHub (Jan 3, 2020): On Fri, Jan 03, 2020 at 06:43:05AM -0800, rusty-snake wrote: > > Yes, but like I said, I only needed `ld.so.cache` (should probably add ld.*). But it looks like a hack to specify it that way. > > So for you it is `private-etc alternatives,fonts,ld.so.cache`, right? Yes, but I added the rest of ld.*. The .cache might disappear anytime.

Rows
Columns

[GH-ISSUE #3110] mupdf: profile does not work for mupdf-gl #1948