mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3456] jitsi-meet-electron AppImage not launched if run with Firejail ! #2171
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2171
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Nokia808 on GitHub (Jun 6, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3456
Write clear, concise and in textual form.
Bug and expected behavior
I have jitsi-meet-electron AppImage located in:
/home/myusername/.local/share/myportables/jitsi-meet-x86_64.AppImage
I edit entry of this package in my applications menu as following:
firejail --profile=jitsi-meet-desktop --appimage /home/myusername/.local/share/myportables/jitsi-meet-x86_64.AppImage
then tried to launch if from edited entry, but it did not run at all !
I tried again after delete "--profile=jitsi-meet-desktop" but same thing occured !
I did not received error message in both cases.
Then I remove all firejail related text & tried again & it launched normally !
It should be launched
Environment
Additional context
jitsi-meet-electron can be downloaded from:
https://github.com/jitsi/jitsi-meet-electron/releases
@rusty-snake commented on GitHub (Jun 6, 2020):
Add
whitelist ${HOME}/.local/share/myportablesto~/.config/firejail/jitsi-meet-desktop.localand try again. If it is still broken, try with--noprofile.@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
Hi. There is no such file ! I navigate to ~/.config folder & enter to it & search inside it for "firejail" but there is no "firejail" inside ! Please notice that I do not use "sudo fcg" command.
@rusty-snake commented on GitHub (Jun 9, 2020):
~/.config/firejailis for customizations from the user, if you never did this before you must create it.There is no such command.
@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
This is complicated ! Do you recommend to change location of AppImage package ? I understood from all that that the problem caused location blacklisted by default ..... If this, then what location you recommend ?
Regarding "sudo fcg", I meant "sudo cfg". Sorry, I will correct it.
@rusty-snake commented on GitHub (Jun 9, 2020):
whitelist-common.inchas?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit. IDK for what it is.You can use this to setup
~/.local/share/myportablesas place for all you appimage:@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
Many thanks for this support !
I will do it, but I like to know the following:
@rusty-snake commented on GitHub (Jun 9, 2020):
$HOME/.config/firejailwith/etc/firejail. For the better you should read the DESCRIPTION section inman firejail-profile.@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
sorry I don't get you
I meant: if I change location of AppImage from /home.muusername/.local/share/myportables to be located, instead, within /home/myusername/Downloads or /home/myusername/external-packages , then does this by itself solve this issue & avoiding need to perform the commands that you instruct me to do ?
@rusty-snake commented on GitHub (Jun 9, 2020):
The issue with jitsi-meet-desktop is that it is a whitelisting profile and has now whitelist command for
/home/myusername/.local/share/myportables/jitsi-meet-x86_64.AppImage. If you then executefirejail --profile=jitsi-meet-desktop --appimage /home/myusername/.local/share/myportables/jitsi-meet-x86_64.AppImageit fails.You can solve this either by adding this whitelist to jitsi-meet-desktop.local (https://github.com/netblue30/firejail/issues/3456#issuecomment-640083440) or in general for all you appimages with whitelisting profiles (https://github.com/netblue30/firejail/issues/3456#issuecomment-641225397). The second solutions also blocks access from other sandboxes to these appimages.
@rusty-snake commented on GitHub (Jun 9, 2020):
If
firejail --noprofile --appimage /home/myusername/.local/share/myportables/jitsi-meet-x86_64.AppImagefails too, jitsi-meet-desktop.AppImage has a general issues with firejail.@Nokia808 commented on GitHub (Jun 9, 2020):
Only 2 thing remain, you said:
The second solutions also blocks access from other sandboxes to these appimages.
Does this related by any way for Flatpak sandbox ? I'm using flatpak heavily & afraid from any confliction with flatpak ... What you mean by "other sandboxes" ? Do you mean SELinux or other Firejail sandboxes ?
I'm using /home/myusername/.local/share/myportables to store other non-AppImage portable programs. So, does the approach you gave me (second solution) affect non-AppImage portable packages by any way ?
I have no other questions. Just above before closing this issue.
@rusty-snake commented on GitHub (Jun 9, 2020):
Other firejail sandboxes (started w/o --appimage). (flatpak sandboxes have never access to this location; under the condition that you don't call flatpaks with
--filesystem=homepermission "sandboxed").If you firejail them, you need to add
noblacklist/whitelistthis in there profiles. Then I would suggest you to use~/.local/share/myappimages.@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
But I have many flatpaks with --filesystem=home permission & without it they are loss many of their functionalities ... What in this case ?
@rusty-snake commented on GitHub (Jun 9, 2020):
They can write to your
.bashrc, access.mozilla/firefoxand do what every they want with your sensitive files. I would can them "sandboxed".Some flatpaks really need host/home permission, other just have it even if they don't need it, then you need to manualy change this.
@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
So, if flatpak has --filesystem=home there will be no confliction with firjail sandbox ... This good. I was though that you mean by "other sandbox" any sandbox, but it is only limited to Firejail sandboxes ...
I will use second solution, but instead of using /home/myusername/.local/share/myappimages I will use /home/myusername/.local/share/myportables/myappimages I will make subfolders for portable packages: "myappimages" , "mytars" , .... & so on. This is better.
Just for learning: how to create jitsi-meet-desktop.local in 2nd solution ? To make /home/myusername/.config/firejail we should run:
mkdir -p $HOME/.config/firejail
What about creation of jitsi-meet-desktop.local inside thus created directory ?
@rusty-snake commented on GitHub (Jun 9, 2020):
jitsi-meet-desktop .profile
includes whitelist-common .inc, whichincludes whitelist-common .local, this file will be created by:@Nokia808 commented on GitHub (Jun 9, 2020):
I perform 2nd solution but it failed ! What I have to do now ! Re-open this issue or file issue for jitsi-meet-electron repository on GitHub ?
Note: I did not use "myappimages" but I used "appimages", so that the path is:
home/myusername/.local/share/myportables/appimages
this should not have any adverse impact as long as "s" at end of word so it "appimages" not "appimage" isn't it ? I found "myappimages" too long ...
The command became:
firejail --profile=jitsi-meet-desktop --appimage /home/myusername/.local/share/myportables/appimages/jitsi-meet-x86_64.AppImage
@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
I tried command from terminal & the output was:
Error: no profile with name "jitsi-meet-desktop" found.@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
I tried again, but this time with --noprofile & it succeeded ! Jitsi meet launched ! To be sure I run "firejail --list" & output was:
@Nokia808 commented on GitHub (Jun 9, 2020):
@rusty-snake
It seem that my firejail package from official Fedora repositories does not include jitsi-meet-desktop profile ... Do I have to file a bug on RedHat BugZilla ?
@Nokia808 commented on GitHub (Jun 9, 2020):
I edit my previous comment because you already answered my on the 2nd part of my previous comment in your kind comment https://github.com/netblue30/firejail/issues/3456#issuecomment-641259674
So, I removed that part.
I re-opened this issue waiting your replay about absence of "jitsi-meet-desktop" profile from version 0.9.62, is it from Fedora package or from your side ...
@Fred-Barclay commented on GitHub (Jun 9, 2020):
@Nokia808 jitsi-meet-desktop.profile was added after we released version 0.9.62 (see https://github.com/netblue30/firejail/blob/master/RELNOTES#L35). It should be included after we cut the 0.9.64 version. So it's not a Fedora/Red Hat issue, only that we haven't made a new release yet after adding this profile.
Cheers!
Fred
@Nokia808 commented on GitHub (Jun 9, 2020):
@Fred-Barclay
Now every thing clear. We was rotated about some thing still in master branch but not included in a released version !
However, I learn too much from your support, most importantly "jitsi-meet-desktop" profile will never work unless perform solution 1 https://github.com/netblue30/firejail/issues/3456#issuecomment-640083440 or solution 2 https://github.com/netblue30/firejail/issues/3456#issuecomment-641225397 otherwise it will fail ...
No further need to open this issue.