mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3468] Interfering with Itch.io game #2179
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2179
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Tanath on GitHub (Jun 15, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3468
Bug and expected behavior
I've been attempting to install a game in Itch, and even with firejail disabled by default (
sudo firejail --clean) it still gets interfered with by firejail. The Itch client isn't running in firejail, and the developer of the game doesn't know what firejail is:https://itch.io/t/832898/asks-for-root-authentication-on-linux
Reproduce
Steps to reproduce the behavior:
Environment
Whatever it's running isn't listed in
firejail --listwhen the pw request occurs.@ghost commented on GitHub (Jun 15, 2020):
Hi, I'm having lots of troubles trying to install this to check what might be going wrong. Used makepkg to build itch from AUR on my Arch Linux machine, but the itch-setup command keeps throwing this error:
At the moment I can't even get itch installed to try to reproduce. You mention using
sudo firejail --clean, but I assume you meantsudo firecfg --clean, as firejail doesn't have a --clean option. To ensure firejail is disabled you can run the latter and remove any remaining symlinks in /usr/local/bin that point to /usr/bin/firejail. Looking at the source of itch-setup this seems to be an electron app. If that gets called via firejail it might begin to explain what you are seeing. But without any kind of log we're in the dark I'm afraid.@Tanath commented on GitHub (Jun 16, 2020):
I see the AUR package has been flagged out of date
Flagged out-of-date (2020-06-07), and I haven't seen that error before. You could try downloading the file manually and putting it in the build directory, checking the hash, and updating it in the PKGBUILD if necessary.Sorry, yes, I meant firecfg. And
/usr/local/binis empty. Itch is not running in firejail, which is confirmed withfirejail --listandfirejail --top.@rusty-snake commented on GitHub (Jun 16, 2020):
I really have no idea what's going on. However I've two debugging ideas:
firejail --noprofileis maybe works (if you believe in it hard enough 🤣 )firejail --listandfirejail --toponly show the sandboxes currently running, usingsudo firemondoes not clear the output, so you can also see very short living sandboxes (e.g.firejail ls).@Tanath commented on GitHub (Jun 16, 2020):
Running with
firejail --noprofile itchstill mentions firejail in the popup, I don't get the password prompt, but then it just fails silently and doesn't run the game.When I try with firemon, the only new lines that appear are:
@ghost commented on GitHub (Jun 16, 2020):
I finally got itch installed and did some basic testing. Registering an account, downloading a game, running update checks, login etcetera all succeeded, even with a nicely hardened profile.
@Tanath Could you test this profile without having the firecfg-generated symlinks please?
$ cat ${HOME}/.config/firejail/itch.profile
@ghost commented on GitHub (Jun 16, 2020):
I still don't know what is happening on your end exactly. But a screenshot of that popup would be helpful.
@rusty-snake commented on GitHub (Jun 16, 2020):
@glitsj16
Link from OP: https://itch.io/t/832898/asks-for-root-authentication-on-linux
Screenshot in this thread: https://img.itch.zone/aW1nLzM2NDk5MTIucG5n/original/iZZzIb.png
@Tanath commented on GitHub (Jun 16, 2020):
I should mention I don't have this issue with other Itch games yet. Just the one.
I tried the pasted profile and got:
I tried commenting out that line and got an error:
non-zero exit code 1 (1). Log says error while elevating, pkexec not found in path. I can't copy the text, and it'd be multiple pages to screenshot, so that's the gist of it. Here's the top:@rusty-snake commented on GitHub (Jun 16, 2020):
pkexec is blocked by firejail (
--noblacklist='${PATH}/pkexec'to allow it) and it is the programs that ask you for root-privs.@Tanath commented on GitHub (Jun 16, 2020):
Yeah. I'm more interested in testing with firejail out of the way, but the only way I can think to do that is by completely uninstalling it since it gets run no matter what else I do. However I'm using it.
@rusty-snake commented on GitHub (Jun 16, 2020):
When you used firemon, did you start itch with
firejail --noprofile itchor/usr/bin/itch?@Tanath commented on GitHub (Jun 16, 2020):
Without firejail. Here's with noprofile:
I've tried catching
/tmp/butler-prereqs-plan.json*but it's too short-lived.@rusty-snake commented on GitHub (Jul 1, 2020):
Does this game know about firejail? (
strings path/to/extracted/game/files | grep firejail)@Tanath commented on GitHub (Jul 2, 2020):
No mention of firejail in game files.
@bbhtt commented on GitHub (Jul 2, 2020):
Itch has it's own local per-game Firejail based sandbox (see in preference of the launcher and disable it). Butler is how the Itch manages, downloads and selects the correct launch for every game, I suppose it needs root access for installing it's own sandbox hence it's asking for so.
Itch's own sandbox creates an
isolate-app.profilein/home/korte/.config/itch/apps/hidden-folks/.itch/isolate-app.profilewhere/home/Username/.config/itch/apps/GameName/is folder for each game and.itchis a directory inside every game.Itch's launcher executable is located in
/home/korte/.itch/itch. I had to make some minor modifications to the profile given by @glitsj16, ran the launcher with it$ :~/.itch$ firejail --profile=/home/korte/.config/firejail/itch.profile ./itch, tested my library out and things work fine. As for the game in question, it also works fine. Note that itch's own sandbox needs to be disabled here.itch.profile
Hidden Folks app log png
My test environment:
Itch app downloaded and installed from https://itch.io/app
@Tanath commented on GitHub (Jul 2, 2020):
Ah! Thank you. That solves my issue. I didn't know Itch came with firejail. The password prompt is a one-time request coming from the Itch app not the game.