github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3124] Digikam broken #1959

New issue

Closed

opened 2026-05-05 08:37:21 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 08:37:21 -06:00

Owner

Originally created by @curiosity-seeker on GitHub (Jan 5, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3124

Digikam 6.4.0 doesn't start here on Arch Linux.

After modifying the profile it works again:

ignore seccomp
seccomp.keep access,arch_prctl,bind,brk,capget,capset,chdir,chmod,chroot,clock_getres,clock_gettime,clone,close,connect,creat,dup,dup2,epoll_create1,epoll_ctl,epoll_wait,eventfd2,execve,exit,exit_group,fadvise64,fallocate,fchmod,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents64,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getpriority,getrandom,getresgid,getresuid,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,kill,linkat,lseek,lstat,madvise,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,newfstatat,openat,pipe,pipe2,poll,ppoll,prctl,pread64,prlimit64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rmdir,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setaffinity,sched_setscheduler,seccomp,sendmsg,sendto,setpriority,set_robust_list,setsockopt,set_tid_address,shmat,shmctl,shmdt,shmget,shutdown,socket,socketpair,stat,statfs,statx,sysinfo,times,umask,uname,unlink,unshare,wait4,waitid,write,writev

Can someone reproduce?

Originally created by @curiosity-seeker on GitHub (Jan 5, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3124 Digikam 6.4.0 doesn't start here on Arch Linux. After modifying the profile it works again: ``` ignore seccomp seccomp.keep access,arch_prctl,bind,brk,capget,capset,chdir,chmod,chroot,clock_getres,clock_gettime,clone,close,connect,creat,dup,dup2,epoll_create1,epoll_ctl,epoll_wait,eventfd2,execve,exit,exit_group,fadvise64,fallocate,fchmod,fcntl,fdatasync,flock,fstat,fstatfs,ftruncate,futex,getcwd,getdents64,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getpriority,getrandom,getresgid,getresuid,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,kill,linkat,lseek,lstat,madvise,memfd_create,mkdir,mmap,mprotect,msync,munmap,nanosleep,newfstatat,openat,pipe,pipe2,poll,ppoll,prctl,pread64,prlimit64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rmdir,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_get_priority_max,sched_get_priority_min,sched_getscheduler,sched_setaffinity,sched_setscheduler,seccomp,sendmsg,sendto,setpriority,set_robust_list,setsockopt,set_tid_address,shmat,shmctl,shmdt,shmget,shutdown,socket,socketpair,stat,statfs,statx,sysinfo,times,umask,uname,unlink,unshare,wait4,waitid,write,writev ``` Can someone reproduce?

gitea-mirror closed this issue

2026-05-05 08:37:22 -06:00

gitea-mirror commented

2026-05-05 08:37:24 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jan 6, 2020):

Works for me.

@Vincent43 commented on GitHub (Jan 6, 2020): Works for me.

gitea-mirror commented

2026-05-05 08:37:25 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Jan 6, 2020):

Works for me.

What exactly? The original profile or my modifications?

@curiosity-seeker commented on GitHub (Jan 6, 2020): > Works for me. What exactly? The original profile or my modifications?

gitea-mirror commented

2026-05-05 08:37:26 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 6, 2020):

@curiosity-seeker which syscall is blocked with the original profile? journalctl --grep=SECCOMP --reverse

@rusty-snake commented on GitHub (Jan 6, 2020): @curiosity-seeker which syscall is blocked with the original profile? `journalctl --grep=SECCOMP --reverse`

gitea-mirror commented

2026-05-05 08:37:27 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Jan 6, 2020):

Okay, checked again.

seccomp !chroot

seems to work.

EDIT: journalctl also showed the following syscalls: brk, exit, exit_group, select

@curiosity-seeker commented on GitHub (Jan 6, 2020): Okay, checked again. `seccomp !chroot` seems to work. EDIT: journalctl also showed the following syscalls: brk, exit, exit_group, select

gitea-mirror commented

2026-05-05 08:37:28 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jan 6, 2020):

What exactly? The original profile or my modifications?

Original profile works for me out of the box. I think chroot need looks unusual here.

@Vincent43 commented on GitHub (Jan 6, 2020): > What exactly? The original profile or my modifications? Original profile works for me out of the box. I think `chroot` need looks unusual here.

gitea-mirror commented

2026-05-05 08:37:29 -06:00

Author

Owner

@smitsohu commented on GitHub (Jan 6, 2020):

Seems that QtWebengine is a dependency via marble-common

@Vincent43 Do you see an effect if you enable unprivileged user namespaces?

@smitsohu commented on GitHub (Jan 6, 2020): Seems that QtWebengine is a [dependency](https://www.archlinux.org/packages/extra/x86_64/digikam) via [marble-common](https://www.archlinux.org/packages/extra/x86_64/marble-common) @Vincent43 Do you see an effect if you enable unprivileged user namespaces?

gitea-mirror commented

2026-05-05 08:37:30 -06:00

Author

Owner

@Vincent43 commented on GitHub (Jan 7, 2020):

Do you see an effect if you enable unprivileged user namespaces?

Yes, this is it. After enabling unprivileged user namespaces I can reproduce the results.

@Vincent43 commented on GitHub (Jan 7, 2020): > Do you see an effect if you enable unprivileged user namespaces? Yes, this is it. After enabling unprivileged user namespaces I can reproduce the results.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1959

No description provided.

Rows
Columns