github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #284] Cannot run lxterminal #199

New issue

Closed

opened 2026-05-05 05:18:10 -06:00 by gitea-mirror · 11 comments

gitea-mirror commented

2026-05-05 05:18:10 -06:00

Owner

Originally created by @liloman on GitHub (Feb 8, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/284

Hi,

I just started to use this tool for firefox with vimperator.
Everything is working right but if I do:
:!pcmanfm

I can launch a file explorer without restriction. ❓

Is it a common issue? Cause if I understand right the child should have the same privileges as his parent.

Cheers and great tool 👍

Originally created by @liloman on GitHub (Feb 8, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/284 Hi, I just started to use this tool for firefox with vimperator. Everything is working right but if I do: :!pcmanfm I can launch a file explorer without restriction. :question: Is it a common issue? Cause if I understand right the child should have the same privileges as his parent. Cheers and great tool :+1:

gitea-mirror

2026-05-05 05:18:10 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:18:16 -06:00

Author

Owner

@brunonova commented on GitHub (Feb 8, 2016):

I don't use PCManFM, but maybe when it's already running and you execute pcmanfm, the running instance of PCManFM "captures it" and opens a new window?

Some programs do this, like Firefox and Nautilus.

@brunonova commented on GitHub (Feb 8, 2016): I don't use PCManFM, but maybe when it's already running and you execute `pcmanfm`, the running instance of PCManFM "captures it" and opens a new window? Some programs do this, like Firefox and Nautilus.

gitea-mirror commented

2026-05-05 05:18:17 -06:00

Author

Owner

@liloman commented on GitHub (Feb 8, 2016):

It possible, I was thinking on something related to dbus/Polkit.

PD: It seems that debugging is not working with journalctl so you have to up syslog??

@liloman commented on GitHub (Feb 8, 2016): It possible, I was thinking on something related to dbus/Polkit. PD: It seems that debugging is not working with journalctl so you have to up syslog??

gitea-mirror commented

2026-05-05 05:18:19 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 9, 2016):

I think PCManFM listens on a regular Unix socket. The only thing is doing is opening a new file manager, it doesn't take any commands over the socket.

@netblue30 commented on GitHub (Feb 9, 2016): I think PCManFM listens on a regular Unix socket. The only thing is doing is opening a new file manager, it doesn't take any commands over the socket.

gitea-mirror commented

2026-05-05 05:18:21 -06:00

Author

Owner

@liloman commented on GitHub (Feb 9, 2016):

I've been testing and I can't launch a terminal for example but I can execute /bin commands inside the namespace.

I don't know why It isn't "totally" blacklisted. ❔

Btw my bad, to see the logs from journalctl:

journalctl  SYSLOG_IDENTIFIER=firejail

Nice tools both indeed .

@liloman commented on GitHub (Feb 9, 2016): I've been testing and I can't launch a terminal for example but I can execute /bin commands inside the namespace. I don't know why It isn't "totally" blacklisted. :grey_question: Btw my bad, to see the logs from journalctl: ``` bash journalctl SYSLOG_IDENTIFIER=firejail ``` Nice tools both indeed .

gitea-mirror commented

2026-05-05 05:18:22 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 9, 2016):

I have blacklisted some terminals in /etc/firejail/disable-common.inc. These programs listen on Unix sockets and unlike PCManFM accept commands coming on the socket. This effectively allows an intruder to break out of the sandbox. You can still start a terminal using --noblacklist:

$ firejail --noblacklist=/usr/bin/lxterminal lxterminal

@netblue30 commented on GitHub (Feb 9, 2016): I have blacklisted some terminals in /etc/firejail/disable-common.inc. These programs listen on Unix sockets and unlike PCManFM accept commands coming on the socket. This effectively allows an intruder to break out of the sandbox. You can still start a terminal using --noblacklist: ``` $ firejail --noblacklist=/usr/bin/lxterminal lxterminal ```

gitea-mirror commented

2026-05-05 05:18:23 -06:00

Author

Owner

@liloman commented on GitHub (Feb 10, 2016):

Even launching it from a lxterminal:

firejail --noblacklist=/usr/bin/lxterminal lxterminal
Reading profile /usr/local/etc/firejail/generic.profile
Reading profile /usr/local/etc/firejail/disable-mgmt.inc
Reading profile /usr/local/etc/firejail/disable-secret.inc
Reading profile /usr/local/etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 10033, child pid 10034

Child process initialized
/bin/bash: /bin/lxterminal: Permiso denegado

parent is shutting down, bye...

I saw no tests with --noblacklist. Maybe when I have some time and make some test.

PS: It's a fresh git installation.

@liloman commented on GitHub (Feb 10, 2016): Even launching it from a lxterminal: ``` bash firejail --noblacklist=/usr/bin/lxterminal lxterminal Reading profile /usr/local/etc/firejail/generic.profile Reading profile /usr/local/etc/firejail/disable-mgmt.inc Reading profile /usr/local/etc/firejail/disable-secret.inc Reading profile /usr/local/etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 10033, child pid 10034 Child process initialized /bin/bash: /bin/lxterminal: Permiso denegado parent is shutting down, bye... ``` I saw no tests with --noblacklist. Maybe when I have some time and make some test. PS: It's a fresh git installation.

gitea-mirror commented

2026-05-05 05:18:24 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 11, 2016):

/bin/bash: /bin/lxterminal: Permiso denegado

Start it like this:

$ firejail --noblacklist=/bin/lxterminal lxterminal

Probably you are running Arch Linux. Arch is merging /bin and /usr/bin directory into a single directory.

@netblue30 commented on GitHub (Feb 11, 2016): > /bin/bash: /bin/lxterminal: Permiso denegado Start it like this: ``` $ firejail --noblacklist=/bin/lxterminal lxterminal ``` Probably you are running Arch Linux. Arch is merging /bin and /usr/bin directory into a single directory.

gitea-mirror commented

2026-05-05 05:18:26 -06:00

Author

Owner

@liloman commented on GitHub (Feb 11, 2016):

You're right I'm running Fedora who was the impulsor (Lennart) of this merging. :)

firejail --noblacklist=/bin/lxterminal lxterminal
Reading profile /usr/local/etc/firejail/generic.profile
Reading profile /usr/local/etc/firejail/disable-mgmt.inc
Reading profile /usr/local/etc/firejail/disable-secret.inc
Reading profile /usr/local/etc/firejail/disable-common.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 10684, child pid 10685

Child process initialized
/bin/bash: /bin/lxterminal: Permiso denegado

parent is shutting down, bye...

It's often a susprise how things can work differently in one distro and another. 🏄

@liloman commented on GitHub (Feb 11, 2016): You're right I'm running Fedora who was the impulsor (Lennart) of this merging. :) ``` bash firejail --noblacklist=/bin/lxterminal lxterminal Reading profile /usr/local/etc/firejail/generic.profile Reading profile /usr/local/etc/firejail/disable-mgmt.inc Reading profile /usr/local/etc/firejail/disable-secret.inc Reading profile /usr/local/etc/firejail/disable-common.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 10684, child pid 10685 Child process initialized /bin/bash: /bin/lxterminal: Permiso denegado parent is shutting down, bye... ``` It's often a susprise how things can work differently in one distro and another. :surfer:

gitea-mirror commented

2026-05-05 05:18:27 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 11, 2016):

I'll have to fix it, thanks!

@netblue30 commented on GitHub (Feb 11, 2016): I'll have to fix it, thanks!

gitea-mirror commented

2026-05-05 05:18:28 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 13, 2016):

Fixed! Try:

$ firejail lxterminal

@netblue30 commented on GitHub (Feb 13, 2016): Fixed! Try: ``` $ firejail lxterminal ```

gitea-mirror commented

2026-05-05 05:18:31 -06:00

Author

Owner

@liloman commented on GitHub (Feb 13, 2016):

Working!.

Nice. :)

@liloman commented on GitHub (Feb 13, 2016): Working!. Nice. :)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#199

No description provided.

Rows
Columns