mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3549] keepassxc: program does not start on BSPWM #2228
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2228
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @seniorm0ment on GitHub (Jul 26, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3549
The profile firecfg grabbed for Keepassxc seems to not want to allow it to open? If I run ps aux | grep keepassxc
I notice two entries relating to /usr/bin/keepassxc and one called [keepassxc] defunct, If I killall keepassxc they all go away.
I can't get keepassxc open and this is problematic for me lol.
Would appreciate some help, am still new to using Firejail.
I'm running Artix x86_64, 5.7.8.a-1-hardened kernel, BSPWM, Firejail 0.9.62
@rusty-snake commented on GitHub (Jul 26, 2020):
firejail version?
@seniorm0ment commented on GitHub (Jul 26, 2020):
@rusty-snake 0.9.62
@bbhtt commented on GitHub (Jul 26, 2020):
This is too obvious but have you configured the symlinks or tried with
firejail --profile=name.profile /usr/bin/program,firejail --noprofile /usr/bin/programor its default profile on a terminal? If so are there any errors?@rusty-snake commented on GitHub (Jul 26, 2020):
firejail --profile=name /usr/bin/programWhy should it be tested with
default.profileif it has a own profile?defunct is often caused by seccomp (seccomp, protocol, mdwe). If you use hardened-malloc it could also be private-etc.
@seniorm0ment commented on GitHub (Jul 26, 2020):
@kortewegdevries Again, am new to Firejail so not too obvious my bad. firejail --noprofile /usr/bin/keepassxc did launch it no issues.
If I run firejail --profile=keepassxc.profile, it gives me an error inaccessible profile file. I can see and read the profile no issues in /etc/firejail/keepassxc.profile.
As for symlinks, I thought firecfg did this? I do see it under firecfg --list, /usr/local/bin/keepassxc so it seems to be linked.
And even if not, I did setup the hooks file as found in the Arch wiki which seemed it did this on install uograde and removal for anything.
https://wiki.archlinux.org/index.php/Firejail#Using_Firejail_by_default
@rusty-snake commented on GitHub (Jul 26, 2020):
If you had followed the issue template ...
--profile=keepassxc.profiletells firejail to look forkeepassxc.profilein the current working directory.--profile=keepassxctells firejail to look forkeepassxcin.then forkeepassxc.profilein ~/.config/firejail and then in /etc/firejail.So anything in the terminal / syslog?
@bbhtt commented on GitHub (Jul 26, 2020):
I meant to try with
firejail --profile...with the profile it comes with, not the "default.profile". It was missing an "its" :)The pacman hook should work.
@seniorm0ment commented on GitHub (Jul 26, 2020):
I was not provided with an issue template when creating an issue.
Oh, in that case, if I run firejail --profile=keepassxc
It shows a list of reading profile commands which relate to the include commands in the /etc/firejail/keepassxc.profile, then says warning noroot option is not available, then gived an error: shell=none configured, but no program specified
@rusty-snake commented on GitHub (Jul 26, 2020):
How do you opened the issue?
To say "default profile" in firejail context is always confusing, best is "default.profile" or "foo.profile" or "its profile" (no default).
is lost somewher: full command is
firejail --profile=keepassxc /usr/bin/keepassxc@seniorm0ment commented on GitHub (Jul 26, 2020):
@rusty-snake
Ah, my bad. It shows reading profile from /etc/firejail/keepassxc, and reading profile from all the includes like disable-common, disable-devel, etc as specified within the keepassxc profile.
Then it shows the parent and child pid.
Then says Skipping alternatives for private /etc.
Then 3 programs installed in 29.70ms.
Then warning /sbin dir link was not blacklisted.
Then /usr/sbin dir link was not blacklisted.
Then blacklist violations are logged to syslog.
Child process initialized in 125ms.
Sorry I can't copy paste, am on my phone lol.
I'm not seeing anything relating to keepassxc or firejail in /var/log/syslog, however in /var/log/messages.log I see
@rusty-snake commented on GitHub (Jul 26, 2020):
Try to add
seccomp !name_to_handle_atto keepassxc (replaceseccomp).@seniorm0ment commented on GitHub (Jul 26, 2020):
@rusty-snake You're suggesting replacing to
?
Upon doing that, and running firejail --profile=keepassxc /usr/bin/keepassxc at the bottom of the previously stated output, I now see
Still not opening keepassxc though.
@rusty-snake commented on GitHub (Jul 26, 2020):
No,
seccomp !name_to_handel_at.@seniorm0ment commented on GitHub (Jul 26, 2020):
Ah, it removed the seccomp line from output so seemed to work, but still not launching.
The only notable error left I see is the
@rusty-snake commented on GitHub (Jul 26, 2020):
Start it with
firejail --profile=keepassxc /usr/bin/keepassxc,firejail keepassxcorkeepassxc(firecfg).@seniorm0ment commented on GitHub (Jul 26, 2020):
@rusty-snake
Doesn't work, that's what gave the shell error.
This worked, how come when just launching through Rofi it has issues? When launching other programs through Rofi, it uses firejail no issue if they have a profile.
Also this doesn't follow my bspc (bspwmrc) rule to send keepassxc to desktop 10, no issues with other programs using firejail?
bspc rule -a keepassxc desktop='^10' follow=on focus=onAre you suggesting just
keepassxc? If so it does the same as the previous.@rusty-snake commented on GitHub (Jul 26, 2020):
If you execute firecfg, all tree should do the same.
@seniorm0ment commented on GitHub (Jul 26, 2020):
Ah, executing firecfg fixed the issue with rofi, and now keepassxx launches no issues.
But keepassxc still doesn't follow my bspc rule as it used to?
And lastly, does this mean there's an issue with the default profile for keepassxc I assume? Will this be fixed? Or is this just a "me issue" I had?
@rusty-snake commented on GitHub (Jul 26, 2020):
What??
Only if keepassxc is firejailed?
@seniorm0ment commented on GitHub (Jul 26, 2020):
Forget that, I think it fixed itself after rerunning firecfg.
It seems to be working now.
Yeah it was having no issues moving Keepassxc to desktop 10 on launch, via the bspc rule I stated above, before setting up Firejail. Now it just launched on whatever display I'm currently on instead of going to desktop 10. Any ideas on how to fix so it follows my bspc rule?
@rusty-snake commented on GitHub (Jul 31, 2020):
Looks like you need to try which option cause this behaviour. (Maybe one of
machine-id,private-etc,net none,protocol?)@seniorm0ment commented on GitHub (Jul 31, 2020):
Hmm, disabling any of those plus the others didn't seem to fix it. I tried running
firejail --noprofile /usr/bin/keepassxcand that isn't working either which makes no sense because that simply ignores firejail profile correct?I also notice that if I open keepassxc, then open a new window next to it, it ignores my rules about gaps. So it seems like keepassxc is now ignoring my bspwmrc?
Now BSPWM does use a script for it's config, it's in .config/bspwm/bwpsmrc and that is chmod +x so it's executable, I did try adding a noblacklist to that path in the firejail profile and that seemed to not work as well.
Either way, the issue seems to be keepassxc not reading my bspwmrc because it ignores the gaps, and that's where you set the rule to which window it opens on which would explain why it's not opening to desktop 10. But I can't figure out what is causing the issue.
@seniorm0ment commented on GitHub (Aug 19, 2020):
Still was having issues with getting KeepassXC to be pushed to desktop 10.
But, I am having another issue. So, I just ran a full update, and all my Firecfg profiles reset. I have a hook added, to autograb the Firecfg profiles (as provided by the arch wiki), I figured it would preserve the profiles I edited, on updates if any changes were made, but it looks like it completely replaces them? Is there a way to get Firecfg profiles to auto apply to programs on install, or when they are newly added and found when updating a program, but don't overwrite profiles that are already there or have changed? Or warn if there's an update to one of the Firecfg profiles I have edited, or something idk..?
Anyways, the specific issue I'm having is the same as creating this thread, KeepassXC is not opening to GUI anymore. I can't even get the secocmp fix to work, or the noprofile or specifically specifying the profile. I added
seccomp !name_to_handle_at, then rerunningsudo firecfgas previously fixed, it did not fix this time.Not sure what's going on.
@bbhtt commented on GitHub (Aug 19, 2020):
On Debian you get a Y/N/I/O option to preserve your current profile,install the updated one or compare side by side during a upgrade, I don't think there is something similar with pacman. It is always better to put your local changes in
~/.config/firejail/since system-wide profiles will get replaced as it is written on top of each profile.That's what the hook does?
This looks like a different error, are you on 0.9.62.4-1?
Are you doing this with an actual program or as an example?
@seniorm0ment commented on GitHub (Aug 19, 2020):
Ah, ok this makes more sense.
firejail version 0.9.62.4, just updated it when I ran the system update.
Oh, that's my mistake, my brain has been all over the place lately.
firejail --noprofile /usr/bin/keepassxclaunches it. Still doesn't actually solve the issue though ofc.@bbhtt commented on GitHub (Aug 19, 2020):
Runs fine for me on Arch with the profile you gave, did you change anything/does the original profile end in the same error?
@seniorm0ment commented on GitHub (Aug 19, 2020):
Running using the profile below (same as originally, which should be what you ran)
The profile (the only edit from stock is changed
seccomptoseccomp !name_to_handle_at):@bbhtt commented on GitHub (Aug 20, 2020):
No both runs okay for me. I was concerned about the second line more...
Try commenting
shell noneand appendsh,zsh,bash,whichin private bin. And run withfirejail --profile=/path/to/changed/profile/ /usr/bin/keepassxcin a terminal. If this works, and you want to make this change permanent:Create a keepassxc.profile in config/firejail, paste all the contents of
/etc/firejail/keepassxc.profileto it and edit in your changes.Now assuming you have made the symlinks using sudo firecfg or in your case the hook, and it is in your path, type keepassxc on a terminal and it'll load the profile in config, check the output on terminal etc...By the way, are you using a script to launch firejailed programs, what's "rofi"?
@seniorm0ment commented on GitHub (Aug 20, 2020):
Shell error gone, new one though.
Not sure where it's trying to pull
execvpfrom. I don't see anything like that in the config unless I'm missing it. I searchedvpandexec, nothing showed forvp,execonly resolved one line which seemed irrelevant.rofi is a dmenu alternative (tiling wm). It is working perfectly fine with my other programs, I confirmed with
firejail --listand they all show. Also previously above, when I had KeepassXC working with firejail rofi was launching it in firejail no issues, I believe it is irrelevant.@bbhtt commented on GitHub (Aug 20, 2020):
What shell are you using? zsh? Did you add them to private-bin? execvp is not a program but a system call...
@seniorm0ment commented on GitHub (Aug 20, 2020):
zsh, correct.
Yes, unless I did it incorrectly?
Just append too the
private-binline as done below, correct?@bbhtt commented on GitHub (Aug 20, 2020):
Commenting
private-binworks?@seniorm0ment commented on GitHub (Aug 20, 2020):
Nope :/, same
execvp: No such file or directoryissue.@bbhtt commented on GitHub (Aug 20, 2020):
Calling it from a terminal
$ keepassxchas the same effect with/without the two changes I said? or keeping shell none and private-bin commented:firejail --shell=/bin/zsh (or /bin/bash) --profile=keepassxc /usr/bin/keepassxc?@seniorm0ment commented on GitHub (Aug 20, 2020):
Correct, except one was the shell error, now it's just the
execvperror after doing the changes.This give's me an
invalid option --profile=firejailprofiledir after --joinerror@bbhtt commented on GitHub (Aug 20, 2020):
The
execvpis caused becauseshell noneis commented, it should've been gone if the shell (bash,sh,zsh etc) was allowed in private-bin orprivate-binwas commented, I don't know why it is still gives the same error.Your first error "shell none but no program" happens when you try
firejail --profile=abcd <>without specifying an executable in "<>", I still don't know why after specifying keepassxc there, it occurs.How did you run that?
Try clearing up the symlinks
sudo firecfg --clean, followed bysudo firecfg, remove the keppassxc profile in config, followed by$ keepassxcon a terminal. What happens?@seniorm0ment commented on GitHub (Aug 20, 2020):
I tried both
firejail --shell=/bin/zsh --profile=keepassxc /usr/bin/keepassxc&firejail --shell=/bin/zsh (or /bin/bash) --profile=/home/gravity/.config/firejail/keepassxc.profile /usr/bin/keepassxcRan
sudo firtecfg --clean,sudo firecfg, removedkeepassxcfrom.config/firejail..Now it works right there, although there are a ton of warnings and errors in the output.
@bbhtt commented on GitHub (Aug 21, 2020):
The warnings are harmless,it's because 3d drivers are blocked by "no3d",you don't need 3d drivers unless it's a game or a video player etc.
@seniorm0ment commented on GitHub (Aug 21, 2020):
Alright understood, not sure exactly what broke or what happened but seems to still be working. Thank you.
That just brings me back to the previous issue I left off on, which was getting KeepassXC to follow my BSPC (BSPWM) rule to open to Desktop 10. Still haven't figured that out, if anyone ends up figuring it out please let me know.
@bbhtt commented on GitHub (Aug 21, 2020):
Is it a shell script? I think,for a script to execute itself we need to add shell to private-bin,ignore noexec ${HOME},the program that executes the script(part of your WM) and how it is executed,a noblacklist and a whitelist (if needed). If noprofile fails it's hard.
An example program that follows the rule when firejailed?
@seniorm0ment commented on GitHub (Aug 21, 2020):
Yeah, the BSPWMRC is a shell script.
You lost me a bit,
shelltoprivate-binorzshtoprivate-bin? are you also suggesting changingshell noneline toshell zsh?ignore noexec ${HOME}/.config/bspwm/bspwmrcnoblacklist ${HOME}/.config/bspwm/bspwmrcwhitelist ${HOME}/.config/bspwm/bspwmrcI'm confused what you mean by this?
What exactly are you asking for here?
With this config, keepassxc opens, but it is not my keepassxc. It seems like a completely uncustomized fresh keepassxc. Also it does not follow the rule to send to desktop 10 still. Hmm..
@bbhtt commented on GitHub (Aug 21, 2020):
If
--noprofilefails it is hard to follow the config,I meant is there any program that follows the BSPWM rules when firejailed?Two posts above it was reading the profile in/etc/firejail, how is it now reading/home/gravity/.config/firejail/keepassxc.profile?Nevermind I saw the change you made: Don't add the whitelist bspwm else you would need to whitelist every directory in the noblacklist secition of the profile. Also this is not needed since there is no corresponding blacklist of it
noblacklist ${HOME}/.config/bspwm...@seniorm0ment commented on GitHub (Aug 21, 2020):
Ah, yeah Telegram and Firefox follow it no issue
That's the telegram profile.
Ok, I removed the whitelist line, it fixed the issue with Keepassxc opening fresh, and now seems to be my config. It still does not seem to want to follow the bspwmrc rule though.
@bbhtt commented on GitHub (Aug 21, 2020):
Comment out
private-binand check. Isbspc monitoran executable, meaning you can execute it in a terminal?When you said
did you comment all options in the profile? If that's the case, there isn't much we can do to make it follow the desktop rule, sorry. You can try switching your shell to bash to see if anything changes...
Remove these:
noblacklist ${HOME}/.config/bspwm,whitelist ${HOME}/.config/bspwm, ignore noexec ${HOME}/.config/bspwm/bspwmrc, (zshfromprivate-binfor now sinceshell noneis set we don't need it) from your profile in config directory that's not how they work.@seniorm0ment commented on GitHub (Aug 21, 2020):
I assume you mean these?
Just tried commenting them, did not fix it.
Didn't do anything.
Alright, removed. I thought you were suggesting to add them which is why I did. Now we're pretty much back where we were. Keepassxc still launches fine, just doesn't follow the bspwm rules ofc.
Does it make any sense that I don't have issues with Telegram or Firefox following the rules? It just seems to be KeepassXC?
@bbhtt commented on GitHub (Aug 21, 2020):
Not only those three, when rusty-snake asked you to comment the profile, it was the whole profile, meaning each line, like brute force the line(s) that might cause the issue, those three were examples... Ideally you don't need to touch the noblacklist and include lines in this brute-force, the last-section of
private-*(bin was most likely, but it was not) and the middle part.I meant it could be a possibility that we need to do those, that's why I asked you to show me another profile that's working under bspwm... since they were not needed anymore I told you to remove them. And not having shell is better than having it in
private-binsecurity-wise@seniorm0ment commented on GitHub (Aug 21, 2020):
Ah okay, my misunderstanding. I'll try it when I get home in a bit and report back.
Which I did, I sent the Telegram profile above.
@rusty-snake commented on GitHub (Oct 1, 2020):
still need help?
@seniorm0ment commented on GitHub (Oct 2, 2020):
With KeepassXC working no, however getting the window to open on workspace number in bsowm still having issues, i can't remember if I tried the last method I left off here, think I forgot otherwise I would've responded. I'll try sometime this week.