github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #3441] surf browser from suckless doesn't start #2163

New issue
Closed
opened 2026-05-05 08:50:21 -06:00 by gitea-mirror · 6 comments
gitea-mirror commented 2026-05-05 08:50:21 -06:00
Owner
Copy link

Originally created by @hyiltiz on GitHub (Jun 1, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3441

Bug and expected behavior

  • Describe the bug
    surf browser from suckless doesn't start
  • What did you expect to happen?
    surf browser from suckless starts

No profile or disabling firejail

  • What changed calling firejail --noprofile PROGRAM in a shell?
    works as expected
  • What changed calling the program by path=without firejail (check whereis PROGRAM, firejail --list, stat $programpath)?
    firejail calls surf from /usr/local/bin instead of /usr/bin/

Reproduce
Steps to reproduce the behavior:

  1. Run in bash firejail surf
  2. See error as posted below
> surf
Reading profile /etc/firejail/surf.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 204257, child pid 204258
Warning fcopy: skipping /etc/alternatives/view.de.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/vi.ja.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/wine.fr.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/faked.es.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/ex.de.1.gz, cannot find inode
Error fcopy: size limit of 500 MB reached
Warning: skipping crypto-policies for private /etc
Warning: skipping pki for private /etc
Private /etc installed in 32.50 ms
15 programs installed in 22.44 ms
Blacklist violations are logged to syslog
Child process initialized in 136.45 ms
dbus[28]: D-Bus library appears to be incorrectly set up: see the manual page for dbus-uuidgen to correct this issue. (Failed to open "/var/lib/dbus/machine-id": No such file or directory; Failed to open "/etc/machine-id": No such file or directory)
  D-Bus not built with -rdynamic so unable to print a backtrace

Parent is shutting down, bye...

Environment

  • Linux distribution and version (ie output of lsb_release -a)
Distributor ID: Debian
Description:    Debian GNU/Linux bullseye/sid
Release:        testing
Codename:       bullseye
  • Firejail version (output of firejail --version) exclusive or used git commit (git rev-parse HEAD)
> firejail --version
firejail version 0.9.62

Compile time support:
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - file and directory whitelisting support is enabled
        - file transfer support is enabled
        - firetunnel support is enabled
        - networking support is enabled
        - overlayfs support is enabled
        - private-home support is enabled
        - seccomp-bpf support is enabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled
  • What other programs interact with the affected program for the functionality?
    None.
  • Are these listed in the profile?
    No.

Additional context
Other context about the problem like related errors to understand the problem.
None required.

Checklist

  • The upstream profile (and redirect profile if exists) have no changes fixing it.
  • The upstream profile exists (find / -name 'firejail' 2>/dev/null/fd firejail to locate profiles ie in /usr/local/etc/firejail/PROGRAM.profile)
  • Programs needed for interaction are listed.
  • Error was checked in search engine and on issue list without success.
Originally created by @hyiltiz on GitHub (Jun 1, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3441 **Bug and expected behavior** - Describe the bug `surf` browser from suckless doesn't start - What did you expect to happen? `surf` browser from suckless starts **No profile or disabling firejail** - What changed calling `firejail --noprofile PROGRAM` in a shell? works as expected - What changed calling the program *by path*=without firejail (check `whereis PROGRAM`, `firejail --list`, `stat $programpath`)? `firejail` calls `surf` from `/usr/local/bin` instead of `/usr/bin/` **Reproduce** Steps to reproduce the behavior: 1. Run in bash `firejail surf` 2. See error as posted below ``` > surf Reading profile /etc/firejail/surf.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Warning: networking feature is disabled in Firejail configuration file Parent pid 204257, child pid 204258 Warning fcopy: skipping /etc/alternatives/view.de.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/vi.ja.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/wine.fr.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/faked.es.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/ex.de.1.gz, cannot find inode Error fcopy: size limit of 500 MB reached Warning: skipping crypto-policies for private /etc Warning: skipping pki for private /etc Private /etc installed in 32.50 ms 15 programs installed in 22.44 ms Blacklist violations are logged to syslog Child process initialized in 136.45 ms dbus[28]: D-Bus library appears to be incorrectly set up: see the manual page for dbus-uuidgen to correct this issue. (Failed to open "/var/lib/dbus/machine-id": No such file or directory; Failed to open "/etc/machine-id": No such file or directory) D-Bus not built with -rdynamic so unable to print a backtrace Parent is shutting down, bye... ``` **Environment** - Linux distribution and version (ie output of `lsb_release -a`) ``` Distributor ID: Debian Description: Debian GNU/Linux bullseye/sid Release: testing Codename: bullseye ``` - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`) ``` > firejail --version firejail version 0.9.62 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ``` - What other programs interact with the affected program for the functionality? None. - Are these listed in the profile? No. **Additional context** Other context about the problem like related errors to understand the problem. None required. **Checklist** - [X] The upstream profile (and redirect profile if exists) have no changes fixing it. - [X] The upstream profile exists (`find / -name 'firejail' 2>/dev/null`/`fd firejail` to locate profiles ie in `/usr/local/etc/firejail/PROGRAM.profile`) - [X] Programs needed for interaction are listed. - [X] Error was checked in search engine and on issue list without success.
gitea-mirror commented 2026-05-05 08:50:24 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jun 1, 2020):

What changed calling the program by path=without firejail (check whereis PROGRAM, firejail --list, stat $programpath)?
firejail calls surf from /usr/local/bin instead of /usr/bin/

Why is firejail started when you run /usr/bin/surf?

Can you try firejail --private-etc=machine-id surf.

<!-- gh-comment-id:636940160 --> @rusty-snake commented on GitHub (Jun 1, 2020): > What changed calling the program by path=without firejail (check whereis PROGRAM, firejail --list, stat $programpath)? firejail calls surf from /usr/local/bin instead of /usr/bin/ Why is firejail started when you run `/usr/bin/surf`? Can you try `firejail --private-etc=machine-id surf`.
gitea-mirror commented 2026-05-05 08:50:25 -06:00
Author
Owner
Copy link

@hyiltiz commented on GitHub (Jun 1, 2020):

  • /usr/bin/surf 'google.com' works
  • surf 'google.com' doesn't because /usr/local/bin/surf via firejail is called
  • firejail --private-etc=machine-id surf 'google.com' works
<!-- gh-comment-id:637105967 --> @hyiltiz commented on GitHub (Jun 1, 2020): - `/usr/bin/surf 'google.com'` works - `surf 'google.com'` doesn't because `/usr/local/bin/surf` via `firejail` is called - `firejail --private-etc=machine-id surf 'google.com'` works
gitea-mirror commented 2026-05-05 08:50:26 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jun 1, 2020):

@hyiltiz you can simply add d1dd363 to your surf.profile.

<!-- gh-comment-id:637137129 --> @rusty-snake commented on GitHub (Jun 1, 2020): @hyiltiz you can simply add d1dd363 to your surf.profile.
gitea-mirror commented 2026-05-05 08:50:27 -06:00
Author
Owner
Copy link

@hyiltiz commented on GitHub (Jun 2, 2020):

Why did that fix the issue and how could've known better to fix it myself? I see that it reported Failed to open "/var/lib/dbus/machine-id" but I wasn't sure if that was a side-effect of some other issue, or can just be fixed directly. Why would a browser need my machine-id in the first place?

<!-- gh-comment-id:637215445 --> @hyiltiz commented on GitHub (Jun 2, 2020): Why did that fix the issue and how could've known better to fix it myself? I see that it reported `Failed to open "/var/lib/dbus/machine-id"` but I wasn't sure if that was a side-effect of some other issue, or can just be fixed directly. Why would a browser need my machine-id in the first place?
gitea-mirror commented 2026-05-05 08:50:29 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Jun 2, 2020):

Why did that fix the issue and how could've known better to fix it myself? I see that it reported Failed to open "/var/lib/dbus/machine-id" but I wasn't sure if that was a side-effect of some other issue, or can just be fixed directly.

That's not easy to answer in a few sentences, but I'll try. Generally speaking, the more you familiarize yourself with all the firejail options, the Linux filesystem layout etc., the better your chances become to detect potential issues in sandbox profiles. Logging output is key, which implies starting applications from terminal, which not all users do or are willing to do. As you know, security is always a matter of degrees, certainties are urban myths at best.

In this particular case, seeing the failure to open /var/lib/dbus/machine-id is one clue that D-Bus was involved in breaking surf. Another clue is present in the filesystem, as that path is symlinked to /etc/machine-id. Finally, seeing that the surf.profile limits access to /etc via the private-etc option, a trained and experienced collaborator as @rusty-snake can put these pieces of information together quickly and suggest a fix.

Like with so many things in life, the more you put yourself into this 'behind-the-scenes' position, the easier it gets. Practice helps in other words. Give it a try, most if not all information is out there. Fine-tuning firejail profiles to your own particular workflow is almost always possible (via the .local override files).

Why would a browser need my machine-id in the first place?

Now that's a very good question indeed. It seems to be related to having access to the audio layer. If you don't need audio in the surf web browser, it's possible to add firejail's machine-id option to a surf.local file to harden things a bit. That generates a new, random id inside the sandbox, which does break audio support, but keeps the browser functioning otherwise.

Let's hope this brief attempt to answer your questions enables you to improve your firejail sandboxing skills, regards!

<!-- gh-comment-id:637239675 --> @ghost commented on GitHub (Jun 2, 2020): > Why did that fix the issue and how could've known better to fix it myself? I see that it reported Failed to open "/var/lib/dbus/machine-id" but I wasn't sure if that was a side-effect of some other issue, or can just be fixed directly. That's not easy to answer in a few sentences, but I'll try. Generally speaking, the more you familiarize yourself with all the firejail options, the Linux filesystem layout etc., the better your chances become to detect potential issues in sandbox profiles. Logging output is key, which implies starting applications from terminal, which not all users do or are willing to do. As you know, security is always a matter of degrees, certainties are urban myths at best. In this particular case, seeing the failure to open /var/lib/dbus/machine-id is one clue that D-Bus was involved in breaking surf. Another clue is present in the filesystem, as that path is symlinked to /etc/machine-id. Finally, seeing that the surf.profile limits access to /etc via the private-etc option, a trained and experienced collaborator as @rusty-snake can put these pieces of information together quickly and suggest a fix. Like with so many things in life, the more you put yourself into this 'behind-the-scenes' position, the easier it gets. Practice helps in other words. Give it a try, most if not all information is out there. Fine-tuning firejail profiles to your own particular workflow is almost always possible (via the .local override files). > Why would a browser need my machine-id in the first place? Now that's a very good question indeed. It seems to be related to having access to the audio layer. If you don't need audio in the surf web browser, it's possible to add firejail's `machine-id` option to a surf.local file to harden things a bit. That generates a new, random id inside the sandbox, which does break audio support, but keeps the browser functioning otherwise. Let's hope this brief attempt to answer your questions enables you to improve your firejail sandboxing skills, regards!
gitea-mirror commented 2026-05-05 08:50:29 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jun 2, 2020):

Why would a browser need my machine-id in the first place?

Access to /etc/machine-id (see man 5 machine-id for more info) is needed for PulseAudio and sometimes DBus (depending on compiler-flags?).

<!-- gh-comment-id:637339837 --> @rusty-snake commented on GitHub (Jun 2, 2020): > Why would a browser need my machine-id in the first place? Access to /etc/machine-id (see `man 5 machine-id` for more info) is needed for PulseAudio and sometimes DBus (depending on compiler-flags?).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2163
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?