mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3361] jdownloader profile doesn't work #2112
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2112
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Micha-Btz on GitHub (Apr 16, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3361
Hey,
I don't now since when, the jdownloader profile doesn't work for me. I have tried to recover it, but without luck.
I use some different paths, this are normally located in the .local file, but for test I have put it together.
In the Jdownloader2 start script I have set INSTALL4J_JAVA_HOME_OVERRIDE=/usr/lib/jvm/java-11-openjdk-amd64/ which worked without firejail without problems.
Here is the debug output:
the complete output as file attatched. One thing is strange to me, from debug
Disable /usr/lib/jvm/java-11-openjdk-amd64/bin/java (requested /usr/bin/java)
Disable /usr/lib/jvm/java-11-openjdk-amd64/bin/javac (requested /usr/bin/javac)
Disable /etc/java
As java-allow is set in profil, why it is disabled? I don't understand it.
If is start just a bash for test:
the java binary has 0 byte size, strange. Any idea how to fix this, I'm out of idea.
Thanks Micha
Debian sid.
@Micha-Btz commented on GitHub (Apr 16, 2020):
firejail.txt
@rusty-snake commented on GitHub (Apr 16, 2020):
allow-java.incis loaded afterdisable-devel.incbecause of theinclude /etc/firefox/firefox.profile.@Micha-Btz commented on GitHub (Apr 17, 2020):
you are right, I removed the firefox includes and checked if java is available via bash. It is.
But it is not working.
For some reason the jvm is not available. hm, another idea?
Micha
firejail.txt
@rusty-snake commented on GitHub (Apr 17, 2020):
No, I don't have an idea.
@matu3ba commented on GitHub (Apr 20, 2020):
Could be related to #3360
@Micha-Btz Where is your JVM installed?
@rusty-snake
You can also try to delete the JVM cache file /home/user/.install4jIs there a test command for profiles to see, if this file exists?
@Micha-Btz commented on GitHub (Apr 21, 2020):
jvm is installed in the debian standard path
I can see no difference to the jvm in firejail
I have also tested every single option in the profile through commenting out, no success.
@rusty-snake commented on GitHub (Apr 21, 2020):
Sometimes it is more then one options. As long as
firejail --noprofile jdownloaderworks the issue is with the profile.@Micha-Btz commented on GitHub (Apr 21, 2020):
Ah, ok. I have tested with noprofile and it worked. I have found the problem,
it is disable-exec.inc.
Debians default includes:
The problem is #noexec ${HOME}, can I seperately disable this flag in the profile or must I disable the complete disable-exec.inc?
Also makes ipc-namespace in the profile the gui extremly slow, what is this for?
The manpage tells me Enable IPC namespace, but for what is that needed?
@rusty-snake commented on GitHub (Apr 21, 2020):
just add
ignore noexec ${HOME}like in other profiles.Linux knows differnet namspaces (network, mount, ... see man namespaces). firejail, docker, bubblewrap, systemd-nspawn and so on use namespaces to separate things. In firejail a sandbox has always a own PID-namespace, all other are opt-in by options like
net,hostname,noroot, ....ipc-namespacemakes to sandbox has its own ipc (=System V inter-process-communication) namespace.ipc-namespaceworks fine for CLI-programs and wayland, but break some X11 features.@Micha-Btz commented on GitHub (Apr 21, 2020):
Ok, thanks a lot. For those with a similar problem, the working profile:
@QGB commented on GitHub (Jun 23, 2021):
su qgb bash # sh: "0: Can't open bash"
@rusty-snake commented on GitHub (Jun 23, 2021):
@QGB a bit more context is helpfull. What did you tried? Which distro and firejail version do you use? ...