mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3494] firefox: no internet with whitelist-var-common.inc (resolv.conf) #2198
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2198
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Evernow on GitHub (Jul 5, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3494
Bug and expected behavior
For some reason when using the Firefox firejail profile, Firefox cannot connect to the internet.
Using
firejail --noprofile firefoxallows Firefox to connect.Reproduce
Steps to reproduce the behavior:
firejail firefox(sudo firecfg when launching has the same effect)Environment
LSB Version: n/a
Distributor ID: ManjaroLinux
Description: Manjaro Linux
Release: 20.0.3
Codename: Lysia
KDE
firejail version 0.9.62
Compile time support:
- AppArmor support is enabled
- AppImage support is enabled
- chroot support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- firetunnel support is enabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- seccomp-bpf support is enabled
- user namespace support is enabled
- X11 sandboxing support is enabled
Additional context
Other context about the problem like related errors to understand the problem.
Checklist
find / -name 'firejail' 2>/dev/null/fd firejailto locate profiles ie in/usr/local/etc/firejail/PROGRAM.profile)OUTPUT OF
firejail --debug firefoxhttps://gist.github.com/Evernow/8f6c1b14681fa4dcd9cc82fea7989ae2
/etc/firejail/firefox.profile
https://gist.github.com/Evernow/2af871afb0554f2697857a76c773e6ef
/etc/firejail/firefox-common.profile
https://gist.github.com/Evernow/2bf72d0d41d8d66abccccf6141fb3b1b
Observations:
Other applications such as Discord and Chrome do not suffer from this, however VLC won't launch videos with firejail and qbittorrent works but I cannot launch videos from it (this seems to be #2369).
@ghost commented on GitHub (Jul 5, 2020):
[daniel@daniel-pc ~]$ firejail --debug firefox > firejailfirefox2.log
[...]
Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features
https://gist.github.com/Evernow/8f6c1b14681fa4dcd9cc82fea7989ae2#file-firejail-debug-program-L222
That warning suggests that firefox got started from within another sandboxed application. This is not normal behavior and it might explain why firefox can't connect to the network (e.g. if the sandbox profile in question does not allow network access). I suspect you used firecfg at one time to generate symlinks in /usr/local/bin and XDG desktop files in
{HOME}/.local/share/applications for firejail's desktop integration feature. Can you confirm this? If that is the case (/usr/local/bin/firefox is a symlink to /usr/bin/firejail), you can start a sandboxed firefox simply by running `firefoxor (using the full path to the executable)$ firejail /usr/bin/firefox`.Can you post output from
$ which -a firefoxplease, so we can untangle the situation more precisely?@Evernow commented on GitHub (Jul 5, 2020):
Indeed, I can start firefox using
firefoxandfirejail /usr/bin/firefox[daniel@daniel-pc ~]$ which -a firefox
/usr/local/bin/firefox
/usr/bin/firefox
@rusty-snake commented on GitHub (Jul 5, 2020):
@glitsj16 as long it is the same sandbox (e.g.
firejail firefoxinsidefirejail firefox) it shouldn't be an issue.@Evernow regarding vlc if it works from the commandline, it is likely #836.
@Evernow commented on GitHub (Jul 5, 2020):
It does not work from commandline, upon further testing .wav and .mp3 files play with VLC, video files (mp4 and opening directories such as BDMVs tested) stay loading indefinitely.
firejail --no-profile vlc works fine.
@ghost commented on GitHub (Jul 5, 2020):
@Evernow Use whatever start command you prefer from now on for firefox, that part of your issue should be fixed. If you notice weird theming issues in the web browser, you can try another GTK theme by prepending GTK_THEME="foo".
@Evernow commented on GitHub (Jul 5, 2020):
Apologies if I misspoke, when I said "Indeed, I can start firefox using firefox and firejail /usr/bin/firefox" I meant that it was possible to start firefox using those two commands, but still no internet when I do so.
@Evernow commented on GitHub (Jul 5, 2020):
I built firejail-git from the AUR ( https://aur.archlinux.org/packages/firejail-git/ ) and issues still persist sadly
@rusty-snake commented on GitHub (Jul 5, 2020):
Looks like you need to comment all lines in firefox.profile and uncomment line for line to see which line make the problem.
@Evernow commented on GitHub (Jul 5, 2020):
include firefox-common.profile
That is the line causing the problem.
Going through firefox-common.profile, will go through it again but not having much luck.
@ghost commented on GitHub (Jul 5, 2020):
Correct. Also check firefox-common.local if you have made any overrides.
@Evernow commented on GitHub (Jul 5, 2020):
@glitsj16 @rusty-snake
include whitelist-var-common.incThat's the line in firefox-common.profile causing the issue.
Having issues with whitelist-var-common.inc.
All of these have to be commented out, if a single one isn't then internet does not work in firefox.
@rusty-snake commented on GitHub (Jul 5, 2020):
@Evernow can you run
firejail --build /usr/bin/firefoxto see which files in /var are accessed.What is the output of
ls -l /etc/resolv.conf?@Evernow commented on GitHub (Jul 5, 2020):
Note I uncommented it and internet does work when started with that command.
lrwxrwxrwx 1 root root 31 Jun 17 18:59 /etc/resolv.conf -> /var/lib/expressvpn/resolv.conf
@rusty-snake commented on GitHub (Jul 5, 2020):
--buildis like--noprofile --nonewprivs --caps.drop=all --traceTry to add
whitelist /var/lib/expressvpn/resolv.conftowhitelist-var-common.local.@Evernow commented on GitHub (Jul 5, 2020):
Indeed that seemed to have worked, thank you very much!
Do you want me to open a separate issue for the VLC issue described here https://github.com/netblue30/firejail/issues/3494#issuecomment-653871460 ?
@SkewedZeppelin commented on GitHub (Jul 5, 2020):
Off-topic:
https://github.com/netblue30/firejail/issues/1889#issuecomment-383343814