mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3175] udiskie fails to open drive with seccomp blocking request_key #1990
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1990
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @carloabelli on GitHub (Jan 22, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3175
udiskie fails to automatically open my drive when running under firejail.
When running udiskie without firejail, I get the notification that the drive has been added, then a popup to enter the drive password (the drive is LUKS encrypted).
When running under firejail, the notification that the drive has been added appears, but no prompt for my password appears. Unfortunately
udiskie -vdoesn't show any errors.Adding
ignore seccomptoudiskie.localfixes the issue.Debugging the blocked syscalls it appears that
request_keyis being blocked and causing the hang.@carloabelli commented on GitHub (Jan 22, 2020):
Can confirm that adding
seccomp !request_keyresolves the issue.@rusty-snake commented on GitHub (Jan 22, 2020):
@carloabelli open a PR
@carloabelli commented on GitHub (Jan 22, 2020):
@rusty-snake Done. Wasn't sure if the workaround was sufficient here like it was in #2681. I have also opened a PR for that issue in case it is now best practice to fix the default profiles.