mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3138] tvbrowser updates every time #1969
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1969
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Micha-Btz on GitHub (Jan 10, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3138
Hi,
I have created a profile for tvbowser, which worked correct the last year so far.
Now I have upgraded the tvbroswer to version 4.2.1 and always at the start there is the migration dialog from 4.2 to 4.2.1. So it seems that the upgrade in the user directory not working right. As far as I now, tvbrowser created on update a new dir in ~/.tvbroswer with the new version. I think my profile prevents that, do you have an idea how can I solve this?
Thanks Micha
@rusty-snake commented on GitHub (Jan 10, 2020):
Assuming
/etc/firejail/globals.localand/etc/firejail/default.localare empty/not present.What happens if you start it once without firejail?
Most likely braking options:
whitelist ~/.tvbrowserprivate-cacheprivate-tmpnoexec ${HOME}noexec /tmp@Micha-Btz commented on GitHub (Jan 12, 2020):
Hey,
yes, /etc/firejail/globals.local and /etc/firejail/default.local are empty, so I have removed this.
I have started tvbrowser once without firejail and the update was successfull. And if I now start tvbrower without firejail, the program runs at the ne version.
Now the really strange thing. If I start tvbrowser with firejail again, the program will perform the update and also the tv data will update if they are 3 weeks old.
With this profile I have tested it. Seems to be two different ~/.tvbroswer.
Is there a difference between ${HOME} and ~ in profile?
Can I debug this to see which directorys are really whitelistet and is it possible to start an xterm or so with the tvbrowser profile to check the dirs and file?
@rusty-snake commented on GitHub (Jan 12, 2020):
AFAIK not.
firejail --debug tvbrowserorfirejail --debug-whitelists tvbrowser(there are more --debug-*, see the manpage) andfirejail --profile=tvbrowser bashorfirejail --profile=tvbrowser xtermWe could also bring a tvbrowser-profile upstream, I created a draft based on your profile. (firejail 0.9.62+)
tvbrowser.profile
@Micha-Btz commented on GitHub (Jan 12, 2020):
So, the point is that tvbrowser moved the user home dir from ~/.tvbrowser to ~/.config/tvbrowser.
If I change my profile, it worked again.
I have tested your profile, but I can't get it to work. I need to disable appamor and then it misses java. I have added some lines for java from the other profiles, but something is missing.
@rusty-snake commented on GitHub (Jan 12, 2020):
🎉
@Micha-Btz the allow incude must come before the disable include
tvbrowser.profile
@Micha-Btz commented on GitHub (Jan 12, 2020):
then the profile works.
@rusty-snake commented on GitHub (Jan 17, 2020):
@Micha-Btz just if you have the time: would you be so kind to check which options prefixed
#X:(https://github.com/netblue30/firejail/issues/3138#issuecomment-573402674) can be used. Lines prefixed with#X-:will need additional work.@Micha-Btz commented on GitHub (Jan 17, 2020):
include whitelist-usr-share-common.inc
apparmor leads to permission denided
private-bin tvbrowser
memory-deny-write-execute
private-etc seems to need some arguments. so I take them fro the seahorse profile, but didn't work.
private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf, rpc,services,ssh,ssl
leads to
This I don't understand, why private etc leads to missing access to /usr/java. Also
private-etc java,java-11-openjdk, doesn't work, will leave it out for now.
This is the full profile, maybe we should add $HOME/.tvbrowser for older versions of tvbrowser.
@rusty-snake commented on GitHub (Jan 17, 2020):
Thanks.
Can you try
include whitelist-usr-share-common.incandwhitelist /ust/share/tvbrowser/usr/bin/javais often a symlink to/etc/alternatives/java.Yes.
5b37edbc10/etc/templates/profile.template (L158-L170)@Micha-Btz commented on GitHub (Jan 17, 2020):
include whitelist-usr-share-common.inc and whitelist /usr/share/tvbrowser - works.
with
private-etc java,java-11-openjdk,alternatives,alternatives,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,xdg
the program starts but have a lot of problems. and also my conifg is not available, will leave it out.
@Micha-Btz commented on GitHub (Jan 17, 2020):