mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3312] newsbeuter doesn´t trigger browser when pressing "o" when using firejail #2082
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2082
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Rosika2 on GitHub (Apr 2, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3312
Hello everybody,
I´ve got a problem when running newsbeuter (RSS feed reader for the text console) in firejail.
My system is: BodhiLinux 5.1.0, 32bit (VM).
The command
firejail newsbeuteritself works perfectly. The problem is that I cannot open a browser to read the feed contents.The interactive key-stroke "o" should provide for that. But pressing "o" yields nothing.
Yet all works well when running newsbeuter normally (i.e. not within the sandbox).
Example:
env BROWSER=lynx newsbeuterworks fine and lynx opes up within the terminal.env BROWSER=lynx firejail newsbeuterruns newsbeuter alright but doesn´t trigger the browser.Surely there´s something that could be modified within the "newsbeuter.profile". But I´m stuck here.
Currently it looks like this:
Any help is much appreciated.
Thanks a lot in advance.
Greetings.
Rosika
@rusty-snake commented on GitHub (Apr 2, 2020):
Can you try setting the BROWSER variable with firejail like this
firejail --env=BROWSER=lynx newsbeuter.@Rosika2 commented on GitHub (Apr 2, 2020):
@rusty-snake:
Hello. Nice to hear from you again and thanks for your reply.
Alas
firejail --env=BROWSER=lynx newsbeuterdoesn´t work either.Hitting "o" has no effect a all.
Surely it has got to do something with the profile as running newsbeuter/lynx outside the sandbox works.
Greetings.
Rosika
@Rosika2 commented on GitHub (Apr 2, 2020):
additional info:
What strikes me as odd is the fact that using the
default.profileresults in even stranger behaviour:It basically says that an instance of newsbeuter is already running ((PID: 0) - which simply isn´t true!
Thus: shutdown.
@rusty-snake commented on GitHub (Apr 2, 2020):
firejail --private-bin=lynx newsbeuter. I should realy write some diff tools for firejail profiles.@Rosika2 commented on GitHub (Apr 2, 2020):
Hi,
firejail --private-bin=lynx newsbeuterdidn´t work either.Neither did
firejail --env=BROWSER=lynx --private-bin=lynx newsbeuter.The problem remains. Sorry.
@rusty-snake commented on GitHub (Apr 2, 2020):
Ok then lets ignore any differences between the newsbeuter/newsboat profile and the lynx profile:
--ignore=disable-mnt --ignore=private-bin --ignore=private-etc --ignore=memory-deny-write-execute --ignore=protocol --ignore=tracelog --ignore=nosound --ignore=nodbus --ignore=ipc-namespace --noblacklist=/tmp/.X11-unix '--noblacklist=${RUNUSER}/wayland-*'+ comment everywhitelist ${HOME}/…andinclude whitelist-common.inc.most likely it is one of the following: private-bin, mdwe, protocol (missing unix), whtelist ${HOME}, nodbus, ipc-namespace
@Rosika2 commented on GitHub (Apr 3, 2020):
@rusty-snake:
Hello again and thank you so much for your help.
I finally got everything running.
First of all I tried the lengthy command
env BROWSER=lynx firejail --ignore=disable-mnt --ignore=private-bin --ignore=private-etc --ignore=memory-deny-write-execute --ignore=protocol --ignore=tracelog --ignore=nosound --ignore=nodbus --ignore=ipc-namespace --noblacklist=/tmp/.X11-unix '--noblacklist=${RUNUSER}/wayland-*'which was successful already. Typing "o" opened up lynx alright.
Then I took away one option after another to see which one works/doesn´t work.
It turns out that I need this one:
env BROWSER=lynx firejail --ignore=private-bin --ignore=private-etc newsbeuterSo what do you think, how should I modify the newsbeuter.profile?
Is it O.K. to add
in the profile?
And what about the
private-bin newsbeuter-entry? May that remain in the file?Thanks again for your help.
Greetings.
Rosika
@Minoru commented on GitHub (Apr 3, 2020):
Hi, former Newsbeuter and current Newsboat maintainer here. Both programs use system(3) to execute the browser, which in turn uses
/bin/sh. So I wonder iffirejail --private-bin=sh,lynx newsbeuterwould work. @Rosika2, can you try that? (Don't know much about Firejail, so just a shot in the dark)@Rosika2 commented on GitHub (Apr 3, 2020):
@Minoru:
Hi Alexander and thanks for your suggestion.
I tried the command you provided but sadly it didn´t `work:
So until now the command
env BROWSER=lynx firejail --ignore=private-bin --ignore=private-etc newsbeuterremains the only one to work.But thanks a lot for your input.
Greetings.
Rosika
@rusty-snake commented on GitHub (Apr 3, 2020):
If
firejail --private-bin=sh,lynx --ignore=private-etc newsbeuterworks, can you tryfirejail --private-bin=sh,lynx --private-etc=lynx newsbeuter@Rosika2 commented on GitHub (Apr 4, 2020):
@rusty-snake:
Hi and thanks again.
I tried the two commands - with different results:
firejail --private-bin=sh,lynx --ignore=private-etc newsbeuterdoesn´t work . The same results as before: newsbeuter is alright but lynx won´t open up.firejail --private-bin=sh,lynx --private-etc=lynx newsbeuterhowever works just fine. Newsbeuter and lynx run perfectly.So that´s the command I´m going for.
Thank you so much for your help.
Greetings.
Rosika
@Rosika2 commented on GitHub (Apr 16, 2020):
Hello again,
as everything works fine now an additional question came up:
I´d very much like to use w3m instead of lynx as a browser.
So I thought I could switch over to w3m by using this command:
firejail --private-bin=sh,w3m --private-etc=w3m newsbeuterAlas this won´t work . Pressing "o" won´t trigger any browser at all.
Any ideas how I could get w3m to work as a browser within newsbeuter (in firejail of course)?
Thanks a lot in advance.
Greetings.
Rosika
@rusty-snake commented on GitHub (Apr 16, 2020):
No hints even in the syslog?
Based on the w3m profile, you can try adding this to your newsbeute.local. If it works you can harden it.
@Rosika2 commented on GitHub (Apr 17, 2020):
@rusty-snake:
Hi again and thanks for your help.
So should I create
newsbeuter.localmanually? And then: should I place it in/etc/firejailas well?Greetings.
Rosika
@rusty-snake commented on GitHub (Apr 17, 2020):
Yes. Yes or in
.config/firejail. Alternative you can put it in your newsbeuter.profile anywhere before the# Redirect.Uhh and maybe you need to also
mkdirandwhitelist${HOME}/.w3m.@Rosika2 commented on GitHub (Apr 17, 2020):
@rusty-snake:
Hi and thanks again.
I did all you suggested but unfortunately it still doesn´t work . w3m won´t open up.
I put the
newsbeuter.profilein~/.config.firejailand now it looks like that:Using the command
firejail --private-bin=sh,w3m --private-etc=w3m newsbeuterstill won´t trigger w3m as browser. In fact it has no effect at all.Terminal says:
Greetings.
Rosika
@Minoru commented on GitHub (Apr 17, 2020):
Have you added
browser "w3m"to /home/rosika/.newsbeuter/config? Looks like you didn't, and it tries to run lynx (which is the default browser).@Rosika2 commented on GitHub (Apr 17, 2020):
@Minoru:
Hi Alexander,
thanks.
Well, I created the config-file:
touch ~/.newsbeuter/configand then putbrowser "w3m"as the single entry in it.Now
firejail --private-bin=sh,w3m --private-etc=w3m newsbeuterpartly works.Pressing "o" opens up w3m alright but doesn´t display anything.
The last line says: "<< Viiewing [SSL] <...> No Line"
Thanks again.
Greetings. Rosika.
@rusty-snake commented on GitHub (Apr 17, 2020):
noblacklist ${HOME}/.local/share/newsbeuter+whitelist+mkdir( +blacklistin disable-programs.inc) to fix this.Can you try it with
firejail newsbeuter. w3m needs perl and maybe other things, so I would first get it to run w/o private-bin and then figure out which programs are needed.@Rosika2 commented on GitHub (Apr 17, 2020):
@rusty-snake:
O.K. But how exactly? Do I understand it correctly this way:
in the newsbeuter.profile and
in
disable-programs.inc?@Minoru commented on GitHub (Apr 17, 2020):
@rusty-snake
Oh, this isn't an error in need of fixing, it's just a message. Newsbeuter checks if XDG dir is available, and if not, it falls back to the dotdir. Further on we see that ~/.newsbeuter/urls is loaded just fine; that indicates that @Rosika2 is indeed using the dotdir. (Though I understand that the general-purpose Firejail profile would whitelist both dirs)
I think @Rosika2 should concentrate on running w3m standalone. Is Firejail blocking network access for it? I don't see any other reason for w3m to start but fail to connect to the site.
@rusty-snake commented on GitHub (Apr 17, 2020):
It should, will fix this later.
No, but AF_UNIX sockets. @Rosika2 add also
protocol unix,inet,inet6. disable-exec.inc isn't included in the w3m profile. IDK, but I don't think that this is it.@Rosika2 commented on GitHub (Apr 18, 2020):
@Minoru:
Hi and thanks for the comment.
Yes, I think that´s the best way.
Tnx for your help.
Greetings
Rosika
@Rosika2 commented on GitHub (Apr 18, 2020):
@rusty-snake:
Thanks.
Sorry for asking again, bute where should I put the entries? In the
w3m-profile?@rusty-snake commented on GitHub (Apr 18, 2020):
No, in the newsbeuter.profile/.local.
@Rosika2 commented on GitHub (Apr 18, 2020):
@rusty-snake:
Thanks. Yet I seem to be mentally blocked or incapacitated.
I´ve got the
newsbeuter.profilealright. But what and where is the "local"-part ofnewsbeuter.profile/.local?Sorry for asking again.
@Rosika2 commented on GitHub (Apr 18, 2020):
I just looked up
newsbeuter.profile. It says:include newsbeuter.local.But I´ve got no such file.
@rusty-snake commented on GitHub (Apr 18, 2020):
The system behind this is that /etc/firejail/newsbeuter.profile is overridden on every update of firejail. If you want to customize it, you could copy it to ~/.config/firejail/newsbeuter.proifle, but then you don't get fixes/new feature on the next update. There fore every profile has a
include profile_name.localwhich is not distributed with firejail and must be created by the user if he/she want (small) changes in a profile. There is also a globals.local for options applied to every profile.@Rosika2 commented on GitHub (Apr 18, 2020):
@rusty-snake:
Thanks for the clarification. O.K. I´ve learnt something new again.
I now I´ve created the file with
touch /etc/firejail/newsbeuter.localand putprotocol unix,inet,inet6in it.In
/home/rosika/.newsbeuter/configI putbrowser "w3m".The command I used is
firejail --private-bin=sh,w3m --private-etc=w3m newsbeuter.But the problem remains.
Pressing "o" opens up w3m.
"Opening socket" .... and then the web-site should displayed but it remains empty. "No Line".
Pressing "c" however yields the respective url.
In my example: www.zdf.de/nachrichten/panorama/stars-promi-news-bilder-aktuell-april-100.html
Well, we certainly did all we could. It seems w3m is not cut out for this purpose.
I think I´ll have to stick to lynx then.
That doesn´t really matter much. It´s just that I like w3m better. But that´s rather a "luxury problem".
So sorry to have taken up so much of your time.
But your help is much appreciated and I´ve learnt quite a few things, too.
Thanks again to @rusty-snake and @Minoru . Have a nice and healthy weekend.
Greetings.
Rosika
@rusty-snake commented on GitHub (Apr 18, 2020):
@Rosika2 have you tried it with only
firejail newsbeuter? as I sayed above w3m needs perl and maybe some other stuff.@Rosika2 commented on GitHub (Apr 18, 2020):
@rusty-snake:
Yes, I´ve tried but that´s even worse.
Newsbeuter works alright but w3m won´t open up at all. Pressing "o" has no effect at all.
Here´s the terminal output:
@Rosika2 commented on GitHub (Apr 18, 2020):
No idea if it helps at all.
The weirdest thing:
Although not displaying the website-content at all ("No Line") w3m seems to be functional after all.
When typing an URL directly (example: ubuntuusers.de) after typing "U" for direct url-entry,
the website is displayed alright!
@Minoru commented on GitHub (Apr 18, 2020):
That sounds like Newsbeuter doesn't pass the URL to w3m, but I just took a look at the relevant part of the code and it seems impossible =\ (The code didn't change much since then, so it should work the same even if your distro backported some newer changes)
@Rosika2 commented on GitHub (Apr 18, 2020):
@Minoru:
Thanks for looking that up.
Even weirder:
Only some urls are working. Like ubuntuusers.de which loads perfectly.
But e.g. linuxquestions.org yields the same empty screen with the "No Lines" remark.
But it´s not a specific w3m-problem as both sites (and every site for that matter) load perfectly when starting a standalone instance of w3m.
It´s just the interaction of w3m and newsbeuter that creates this weirdness.
Never mind. As already said, I´ll go for lynx then.
Thanks so much.
Greetings. Rosika
@Minoru commented on GitHub (Apr 18, 2020):
@Rosika2, if you don't mind, I'd still like to delve a bit deeper.
Can you reproduce this without Firejail?
If you have Newsboat installed, can you reproduce it there?
If this is a bug in Newsbeuter and it still exists in Newsboat, I'd like to know about it. Thanks!
@Rosika2 commented on GitHub (Apr 19, 2020):
@Minoru:
Hi Alexander and thank you so much for your persistence.
Well, I´ll be blessed. Up and until now I´ve never tried this.
I did the following:
touch /home/rosika/.newsbeuter/alternative_config2and filled
alterrnative_config2with the following content:The command
newsbeuter -C /home/rosika/.newsbeuter/alternative_config2really works as desired.
Newsbeuter performs perfectly together with w3m, which opens up the url alright.
So the issue seems to be rooted in firejail.
I don´t have newsboat. Yet I may install it.
apt-cache show newsboatsays:So before installing it: do you know if I can install it alongside newsbeuter?
Greetings. Rosika
@Minoru commented on GitHub (Apr 19, 2020):
Great, thanks!
Yes, you can. Newsboat stores its data in ~/.newsboat, so it won't conflict with Newsbeuter. On the first run, Newsboat will copy data from Newsbeuter; afterwards, it'll keep using its own copy.
@Rosika2 commented on GitHub (Apr 19, 2020):
@Minoru:
Hi again and thanks for he info and the link. Much appreciated.
Now that I´ve successfully installed newsboat I can tell you the following:
These commands do work with lynx or w3m as browser:
newsboatfirejail --profile=/etc/firejail/default.profile newsboatfirejail --noprofile newsboatThis doesn´t work:
firejail newsboatThat way newsboat doesn´t seem to be able to read the urls-file:
Greetings. Rosika
@Minoru commented on GitHub (Apr 19, 2020):
I guess this needs to be fixed in order for us to check if the bug is reproducible with Newsboat.
Newsboat's profile appears to whitelist access to ~/.newsboat, so I wonder what's going on. @Rosika2, you sure the urls file is not empty? @rusty-snake, do you have any insights into this (perhaps whitelisting doesn't mean what I think it means)?
@Rosika2 commented on GitHub (Apr 19, 2020):
Hi,
Yes, the urls-file is definitively filled with my example-entries.
N E W_I N F O R M A T I O N :
(don´t know if it helps at all):
Now I performed a direct comparison of those commands:
firejail --profile=/etc/firejail/default.profile newsboat -C /home/rosika2/.config/newsboat/alternative_config2and
firejail --profile=/etc/firejail/default.profile newsbeuter -C /home/rosika2/.newsbeuter/alternative_config2There´s a fundamental difference between them:
The newsboat-command works perfectly (including all browsers)
The newsbeuter-command fails to even start:
There´s definitively no instance of newsbeuter running. I don´t understand the error-message.
Greetings. Rosika
@Minoru commented on GitHub (Apr 19, 2020):
The most common cause for this is "wrong" location for the cache file, but I don't see this happening in your case. Another reason might be inaccessible location for the cache file, but again, this doesn't look like your case. (We intend to improve the message in Newsboat, just haven't gotten around to it yet; see https://github.com/newsboat/newsboat/issues/314)
@Rosika2, thanks for keeping digging! Can you try without
-C? Would results be the same?(I understand Newsboat works fine, so technically I'm all done here, but I'm puzzled by Newsbeuter behaving like it does. It should work the same as Newsboat here, I don't see any material difference in this regard)
@Rosika2 commented on GitHub (Apr 19, 2020):
Hi and thanks for the link,
You´re welcome. It´s my pleasure.
firejail --profile=/etc/firejail/default.profile newsbeuteralso fails to start. The same as before.
firejail --profile=/etc/firejail/default.profile newsboatworks well (including both browsers)
Yes, but only when using the
default.profile. If thenewsboat.profileis loaded pressing "o" won´t trigger any browser at all.Thank you so much for your help.
Greetings. Rosika
@Minoru commented on GitHub (Apr 19, 2020):
I'm out of ideas now. :( Firejail profile looks okay to me, and if Newsbeuter works outside of Firejail, I don't see why it should fail inside it. Sorry for taking up so much of your time investigating this, @Rosika2.
Got it. @rusty-snake, perhaps newsboat.profile should include lynx.profile, so the default configuration works without any intervention from the user? I don't know anything about Firejail, though; if it's hard to "subtract" profiles later, i.e. deny access to lynx once the user switches to some other browser, I'd understand why lynx is not part of newsboat.profile.
@Rosika2 commented on GitHub (Apr 19, 2020):
@Minoru:
Sorry for taking up so much of your time investigating this,That´s really O.K.
I´m glad for your help and I´ve learnt a lot, to say the least.
Anyway I can proceed now with using newsbeuter and newsboat as well.
So thank you again for your help and persistence.
Have a nice (and healthy) Sunday and many greetings.
Rosika
@matu3ba commented on GitHub (Apr 19, 2020):
@Minoru This would mean user-based installation derivement of the setup or dynamic loading. Additionally this would mean even more complexity on maintaining.
I will formulate something in the issue formular about the interaction of programs/default programs.
@rusty-snake commented on GitHub (Apr 19, 2020):
I can't really follow this anymore, if there's anything left please post it.
FYI:
default.profileincludesdisable-programs.incwhichblacklists~/.newsbeuterand so on.@Rosika2 commented on GitHub (Apr 20, 2020):
@rusty-snake:
Thank you so much for your help.
Tnx also for the
default.profileexplanation.Greetings. Rosika
@Rosika2 commented on GitHub (Apr 20, 2020):
@all:
UPDATE
Sorry for getting back to you again although we decided to close the thread but I just want to let anybody who is interested know: S U C C E S S !!!!!!!!
You wouldn´t believe but I finally got it running the way I wanted to.
What I did was the following:
I took the command
firejail--ignore=disable-mnt --ignore=private-bin --ignore=private-etc --ignore=memory-deny-write-execute --ignore=protocol --ignore=tracelog --ignore=nosound --ignore=nodbus --ignore=ipc-namespace --noblacklist=/tmp/.X11-unix '--noblacklist=${RUNUSER}/wayland-*' newsbeuterwhich @rusty-snake suggested 18 days ago.
To be more precise: I used these firejail-options with
newsbeuter -C /home/rosika/.newsbeuter/alternative_config2The alternative_config2 looks like this:
And now it worked. w3m opens up alright, plus: it doesn´t show "No Line" any more but displays the website correctly.
As a second step I took away one option after another to see whether the reduced command still worked.
I finally arrived at this minimal working command:
firejail --ignore=private-bin newsbeuter -C /home/rosika/.newsbeuter/alternative_config2So after all the investigation it seems that
--ignore=private-binholds the key to success.Thanks again to all of you for your help.
Greetings.
Rosika