mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3372] Game clone hero refuses to run #2117
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2117
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @GreatBigWhiteWorld on GitHub (Apr 20, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3372
Describe the bug
game "clone hero" refuses to run
Behavior change on disabling firejail
game runs normally
To Reproduce
firejail path-to-clonehero/clonehero
Expected behavior
game starts
Desktop (please complete the following information):
Additional context
console output:
EDIT by @rusty-snake: code-block
@rusty-snake commented on GitHub (Apr 20, 2020):
From the manpage:
seccomp(look in the journal for such messages) or bydisable-programs/disable-common.@GreatBigWhiteWorld commented on GitHub (Apr 20, 2020):
Thank you for the reply. Using --noprofile works! I'll do more research to have a better solution.
@GreatBigWhiteWorld commented on GitHub (Apr 21, 2020):
@rusty-snake
I did some readings but I still don't understand:
If I use "firejail --noprofile", is it the same as that I don't use firejail at all?
@rusty-snake commented on GitHub (Apr 21, 2020):
allmost, you get only buildin protections (
nonewprivsif set in firejail.config,disable-mntif set in firejail.config, some paths under /sys are blacklisted, new PID-namespace, ...) Otherthings likeseccomp,whitelist,private-*,disbale-*,noroot, ... are set by the profile.You can copy
/usr/share/doc/firejail/profile.templateto~/clonehero.profile. Then you can start it withfirejail --profile=~/clonehero.profile path/to/cloneheroand start uncommenting if you want to get a profile for it.@GreatBigWhiteWorld commented on GitHub (Apr 21, 2020):
OK. Thank you. So this is the way to create a profile for a new program!
@ghost commented on GitHub (Apr 21, 2020):
Indeed. It gets even better. You can let firejail build a whitelist profile automatically with the
--buildor--build=my-new-profileoptions. Check the man page for details. Really interesting info is created this way to get a fine-tuned profile. Just a tip.@rusty-snake commented on GitHub (Apr 21, 2020):
@glitsj16 the issue with
--buildis that it is outdated IMHO.@ghost commented on GitHub (Apr 21, 2020):
Sad but true. The speed by which firejail is picking up new stuff has its drawbacks I guess. It's very hard to let things trickle-down properly throughout the codebase. Still, it gives the user some extra information to work with. I'd hate to see those options disappear.
@GreatBigWhiteWorld commented on GitHub (Apr 21, 2020):
Hi, thanks for the tip. I just did it with --build=clonehero.profile and it worked. So when you say it's outdated it might have some security issues? That said, it's still better than --noprofile.
If I need to go through the uncomment for each method, I actually don't know if I can succeed to create one with my very limited knowledge about linux.
@rusty-snake commented on GitHub (Apr 21, 2020):
No, it's just missing newer features.
@ghost commented on GitHub (Apr 21, 2020):
@GreatBigWhiteWorld I believe
being outdatedin this context means these --build/--build=foo options might not generate profiles that support each and every newly introduced firejail option(s). But IMO security of the generated profiles is not affected. Especially because these are so-calledwhitelistprofiles, the tightest security profile one can get with firejail: they only allow the minimal set of options needed to run the application, nothing more, nothing less. It is always wise to compare the generated profile (syntax) with the latest browser profiles for example, which are probably still used the most and very up-to-date.