mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3482] Unable to launch Firefox for SSO from Zoom profile #2193
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2193
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @delbonis on GitHub (Jun 29, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3482
Write clear, concise and in textual form.
Bug and expected behavior
Zoom fails to launch Firefox in order to be able to use the SSO feature. Also launching Firefox directly but using the Zoom profile gives the same error.
No profile or disabling firejail
firejail --noprofile PROGRAMin a shell? Works normally.whereis PROGRAM,firejail --list,stat $programpath)? Works normally.Reproduce
Steps to reproduce the behavior:
firejail --profile=/etc//firejail/zoom --private=$somewhere /opt/zoom/ZoomLaunchernortheastern, in my case), which should launch FirefoxI'm not confident this is not user error, so some guidance would be appreciated.
Environment
lsb_release -a)firejail --version) exclusive or used git commit (git rev-parse HEAD) 0.9.62Additional context
It seems that it's really Firefox failing with the profile directories not being set up properly. It would be fine to launch a sandboxed Firefox profile, but I'm not sure with how Firefox manages those to be able to fix it myself.
Checklist
find / -name 'firejail' 2>/dev/null/fd firejailto locate profiles ie in/usr/local/etc/firejail/PROGRAM.profile)debug output
firejail --debug --profile=/etc/firejail/zoom.profile --private=/opt/zoom/home/ /opt/zoom/ZoomLauncher@rusty-snake commented on GitHub (Jun 29, 2020):
What does the XXXXXXXX mean?
Does it work w/o --private? Likely not, but in order to make it work, you propertly need to drop it.
Without
--privateand this in zoom.local it may work.zoom.local@delbonis commented on GitHub (Jun 30, 2020):
OOPS I meant to fill that in after my zoom meeting ended. Updated.
That launches Firefox properly. Although after the SSO flow finishes it opens a
zoommtg://link, which the jailed Zoom process doesn't know what to do with.If I kill the jailed Zoom process and launch it as
/opt/zoom/ZoomLauncher zoommtg://blahwith the link the website tried to open it does work correctly and properly logs me in. I'm not sure if there's a better way around this or if I'll just have to live with it.Out of curiosity, is there anything important in
$HOME/.mozilla/that Zoom would have access to now?@rusty-snake commented on GitHub (Jul 1, 2020):
With the three lines in my last comment no. zoom has read-only access to ${HOME}/.mozilla/firefox/profiles.ini (where firefox stores the names and paths to your firefox-profiles) and nothing more. No bookmarks, no history, no extensions, …
I guess this is due to the firejailed firefox. Probably you would need to weaken the firefox sandbox.
@rusty-snake commented on GitHub (Sep 1, 2020):
I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
@jennydaman commented on GitHub (Sep 25, 2020):
If anyone encounters this thread in the future, I found a solution:
zoommtg://northeastern.zoom.us/sso?token=XXXXXXXXXXXXlinkfirejail --profile=/etc/firejail/zoom.profile xdg-open "zoommtg://northeastern.zoom.us/sso?token=XXXXXXXXXXXX"@mbennett-uoe commented on GitHub (Feb 23, 2021):
I think it's because the jailed zoom process doesn't get passed the link when it's called by Firefox (which is what @jennydaman's comment above will do manually)
If you replace
/usr/bin/zoomwith a bash script that runs the firejail command (as per alexjung's guide, you can pass through all arguments by appending$@to the end of the command in the script.Combined with @rusty-snake's suggestions for whitelisting the firefox config, this allows firejailed Zoom to open firefox for signing into SSO, and then allows the returned zoomtg:// link to be correctly passed from firefox back to a firejailed zoom instance.