gitea-mirror commented

Owner

Originally created by @tomgar on GitHub (Aug 8, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3576

Bug and expected behavior
Rustup is the main tool of the Rust language. With it, you can check its documentation with one command:

rustup doc

, which should open the default browser pointing to an html file in the disk, but it doesn't open. Rustup doesn't complain at all which suggests something dies inside.

I'm using firefox, so I had to add to ~/.config/firejail/firefox.local file some firejail commands so the documentation files appear inside the jail:

whitelist ${HOME}/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/
read-only ${HOME}/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/

No profile or disabling firejail
Rustup will use xdg-open, and since I'm using XFCE, xdg-open will use exo-open. My system is configured with the symlinks in /usr/local/bin, so when I remove the /usr/local/bin/firefox symlink, the documentation appears correctly in the browser.

With the /usr/local/bin/firefox symlink enabled, doing:

xdg-open ~/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/index.html

, works nicely too opening a firejailed firefox which suggests rustup runs xdg-open in a way that firejail prevents that from happening.

Reproduce
Steps to reproduce the behavior:

Set this export to a place where you want to install the rust runtime, for example $HOME/rustup and take note of this directory:

export RUSTUP_HOME=~/rustup

Install rustup in your system using your distribution repositories or do this as seen here https://www.rust-lang.org/tools/install:

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Install a rust toolchain:

rustup default stable

Add the documentation path to a ~/.config/firejail/firefox.local file as already mentioned above at the beginning of this report. In case the doc path is different with this command you can check what rustup's going to open:

rustup doc --path

Then you can do and check the issue with:

rustup doc

If when doing the xdg-open test, the browser doesn't open, export this environment variable first:

export BROWSER=firefox

Environment

Archlinux with XFCE

firejail version 0.9.62

Compile time support:
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- file and directory whitelisting support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- overlayfs support is enabled
	- private-home support is enabled
	- seccomp-bpf support is enabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

What other programs interact with the affected program for the functionality? xdg-open and exo-open, although it's likely that in other environments without exo-open (that's XFCE specific) the same result happens.
Are these listed in the profile? Please, notice that firejail will only kick in as the result of xdg-open / exo-open calling firefox. They're not supposed to be needed inside the jail as demonstrated by calling xdg-open on our own.

Additional context
Doing a strace, it can be seen that firejail is called through the /usr/local/bin/symlink but some operations aren't permitted. Firejail ends when it reaches the need to create the /run/firejail/profile/pid file.

28145 16:40:07.278978 getpid()          = 28145 <0.000004>
28145 16:40:07.278996 setresuid(-1, 0, -1) = -1 EPERM (Operation not permitted) <0.000005>
28145 16:40:07.279014 setresgid(-1, 0, -1) = -1 EPERM (Operation not permitted) <0.000005>
28145 16:40:07.279031 openat(AT_FDCWD, "/run/firejail/profile/28145", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied) <0.000008>
28145 16:40:07.279057 write(2<pipe:[551347]>, "Error: cannot create /run/firejail/profile/28145\n", 49) = -1 EPIPE (Broken pipe) <0.000007>
28145 16:40:07.279085 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=28145, si_uid=1000} ---

Checklist

The upstream profile (and redirect profile if exists) have no changes fixing it.
The upstream profile exists (find / -name 'firejail' 2>/dev/null/fd firejail to locate profiles ie in /usr/local/etc/firejail/PROGRAM.profile)
Programs needed for interaction are listed.
Error was checked in search engine and on issue list without success.

Note: Using the /usr/local/bin/firefox symlink, I don't know how to trigger the debug param with that. Is there an environment variable to tell the firejaill called through the symlink to enable the debug param and dump its output to a file somewhere? Thanks.

Originally created by @tomgar on GitHub (Aug 8, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3576 **Bug and expected behavior** Rustup is the main tool of the Rust language. With it, you can check its documentation with one command: ``` rustup doc ``` , which should open the default browser pointing to an html file in the disk, but it doesn't open. Rustup doesn't complain at all which suggests something dies inside. I'm using firefox, so I had to add to ~/.config/firejail/firefox.local file some firejail commands so the documentation files appear inside the jail: ``` whitelist ${HOME}/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/ read-only ${HOME}/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/ ``` **No profile or disabling firejail** Rustup will use xdg-open, and since I'm using XFCE, xdg-open will use exo-open. My system is configured with the symlinks in /usr/local/bin, so when I remove the /usr/local/bin/firefox symlink, the documentation appears correctly in the browser. With the /usr/local/bin/firefox symlink enabled, doing: ``` xdg-open ~/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/index.html ``` , works nicely too opening a firejailed firefox which suggests rustup runs xdg-open in a way that firejail prevents that from happening. **Reproduce** Steps to reproduce the behavior: 1. Set this export to a place where you want to install the rust runtime, for example $HOME/rustup and take note of this directory: ``` export RUSTUP_HOME=~/rustup ``` 2. Install rustup in your system using your distribution repositories or do this as seen here https://www.rust-lang.org/tools/install: ``` curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh ``` 3. Install a rust toolchain: ``` rustup default stable ``` 4. Add the documentation path to a ~/.config/firejail/firefox.local file as already mentioned above at the beginning of this report. In case the doc path is different with this command you can check what rustup's going to open: ``` rustup doc --path ``` 5. Then you can do and check the issue with: ``` rustup doc ``` If when doing the xdg-open test, the browser doesn't open, export this environment variable first: ``` export BROWSER=firefox ``` **Environment** - Archlinux with XFCE ``` firejail version 0.9.62 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ``` - What other programs interact with the affected program for the functionality? xdg-open and exo-open, although it's likely that in other environments without exo-open (that's XFCE specific) the same result happens. - Are these listed in the profile? Please, notice that firejail will only kick in as the result of xdg-open / exo-open calling firefox. They're not supposed to be needed inside the jail as demonstrated by calling xdg-open on our own. **Additional context** Doing a strace, it can be seen that firejail is called through the /usr/local/bin/symlink but some operations aren't permitted. Firejail ends when it reaches the need to create the /run/firejail/profile/pid file. ``` 28145 16:40:07.278978 getpid() = 28145 <0.000004> 28145 16:40:07.278996 setresuid(-1, 0, -1) = -1 EPERM (Operation not permitted) <0.000005> 28145 16:40:07.279014 setresgid(-1, 0, -1) = -1 EPERM (Operation not permitted) <0.000005> 28145 16:40:07.279031 openat(AT_FDCWD, "/run/firejail/profile/28145", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied) <0.000008> 28145 16:40:07.279057 write(2<pipe:[551347]>, "Error: cannot create /run/firejail/profile/28145\n", 49) = -1 EPIPE (Broken pipe) <0.000007> 28145 16:40:07.279085 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=28145, si_uid=1000} --- ``` **Checklist** - [X] The upstream profile (and redirect profile if exists) have no changes fixing it. - [X] The upstream profile exists (`find / -name 'firejail' 2>/dev/null`/`fd firejail` to locate profiles ie in `/usr/local/etc/firejail/PROGRAM.profile`) - [X] Programs needed for interaction are listed. - [X] Error was checked in search engine and on issue list without success. Note: Using the /usr/local/bin/firefox symlink, I don't know how to trigger the debug param with that. Is there an environment variable to tell the firejaill called through the symlink to enable the debug param and dump its output to a file somewhere? Thanks.

gitea-mirror added the

bug

workaround

labels 2026-05-05 08:55:46 -06:00

gitea-mirror commented

2026-05-05 08:55:49 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 8, 2020):

Can you try to touch ~/.config/firejail/firefox.profile to simulate --noprofile.

Using the /usr/local/bin/firefox symlink, I don't know how to trigger the debug param with that. Is there an environment variable to tell the firejaill called through the symlink to enable the debug param and dump its output to a file somewhere? Thanks.

FIREJAIL_DEBUG=yes

@rusty-snake commented on GitHub (Aug 8, 2020): Can you try to `touch ~/.config/firejail/firefox.profile` to simulate `--noprofile`. > Using the /usr/local/bin/firefox symlink, I don't know how to trigger the debug param with that. Is there an environment variable to tell the firejaill called through the symlink to enable the debug param and dump its output to a file somewhere? Thanks. `FIREJAIL_DEBUG=yes`

gitea-mirror commented

2026-05-05 08:55:50 -06:00

Author

Owner

@tomgar commented on GitHub (Aug 8, 2020):

Hi @rusty-snake , with an empty firefox profile, still the same result.

Please, notice that rustup doesn't show any stdout / stderr of the command executed by it, so if FIREJAIL_DEBUG=yes doesn't output to anywhere, there's nothing to catch.

Anyway I tried it and still nothing.

Although it's odd, if I export FIREJAIL_DEBUG=yes and then I run firejail firefox, there's no difference. I was expecting for firejail to have the same debug output I get when I call firejail with the --debug param. Given that it seems that firejail throws stuff into the syslog I expected things on it, but checking with journalctl --user -f I didn't see anything.

Thanks.

@tomgar commented on GitHub (Aug 8, 2020): Hi @rusty-snake , with an empty firefox profile, still the same result. Please, notice that rustup doesn't show any stdout / stderr of the command executed by it, so if FIREJAIL_DEBUG=yes doesn't output to anywhere, there's nothing to catch. Anyway I tried it and still nothing. Although it's odd, if I export FIREJAIL_DEBUG=yes and then I run firejail firefox, there's no difference. I was expecting for firejail to have the same debug output I get when I call firejail with the --debug param. Given that it seems that firejail throws stuff into the syslog I expected things on it, but checking with journalctl --user -f I didn't see anything. Thanks.

gitea-mirror commented

2026-05-05 08:55:51 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 8, 2020):

I'm too a rust-developer and have rustup on my system and can reproduce this, but I can not restart my firefox ATM because I have to much open tabs 😞
Regarding empty debug: rustup likely closes/redirect stdout/stderr.
Have you restarted/closed your firefox after the touch? I forgotten to explicitly say this.
If you have restarted firefox, thats are very-bad news, because its not a simple profile switch to fix this.

@rusty-snake commented on GitHub (Aug 8, 2020): 1. I'm too a rust-developer and have rustup on my system and can reproduce this, but I can not restart my firefox ATM because I have to much open tabs :disappointed: 2. Regarding empty debug: rustup likely closes/redirect stdout/stderr. 3. Have you restarted/closed your firefox after the touch? I forgotten to explicitly say this. 4. If you have restarted firefox, thats are very-bad news, because its not a simple profile switch to fix this.

gitea-mirror commented

2026-05-05 08:55:52 -06:00

Author

Owner

@tomgar commented on GitHub (Aug 8, 2020):

About 1) No worries, @rusty-snake .

And yep, unfortunately I made sure no instance of firefox were running when doing the empty profile test. Given the strace I shared, there's something odd at play.

Edit: In the mean time I can just use this command to do the same thing: xdg-open $(rustup --doc --path), which is equivalent to what should happen.

@tomgar commented on GitHub (Aug 8, 2020): About 1) No worries, @rusty-snake . And yep, unfortunately I made sure no instance of firefox were running when doing the empty profile test. Given the strace I shared, there's something odd at play. Edit: In the mean time I can just use this command to do the same thing: xdg-open $(rustup --doc --path), which is equivalent to what should happen.

gitea-mirror commented

2026-05-05 08:55:53 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 9, 2020):

rustup uses opener to open the browser.

I found these:
https://github.com/rust-lang/rustup/issues/1125
https://github.com/Seeker14491/opener/issues/4

$ git clone "https://github.com/Seeker14491/opener" --depth=1 && cd opener/opener-bin && cargo build
$ cargo run ~/Downloads/foobar
Opened path successfully.
$ # ^^ Nothing opens!
$ # Same after `unset BROWSER`
$ # Coment https://github.com/Seeker14491/opener/blob/38e3e1d26886fb7fbb4c692cd6fa1faa228fa011/opener/src/lib.rs#L203-L204
$ cargo run ~/Downloads/foobar
$ # It works, it opens gedit xD.

@rusty-snake commented on GitHub (Aug 9, 2020): rustup uses `opener` to open the browser. I found these: https://github.com/rust-lang/rustup/issues/1125 https://github.com/Seeker14491/opener/issues/4 ``` $ git clone "https://github.com/Seeker14491/opener" --depth=1 && cd opener/opener-bin && cargo build $ cargo run ~/Downloads/foobar Opened path successfully. $ # ^^ Nothing opens! $ # Same after `unset BROWSER` $ # Coment https://github.com/Seeker14491/opener/blob/38e3e1d26886fb7fbb4c692cd6fa1faa228fa011/opener/src/lib.rs#L203-L204 $ cargo run ~/Downloads/foobar $ # It works, it opens gedit xD. ```

gitea-mirror commented

2026-05-05 08:55:54 -06:00

Author

Owner

@tomgar commented on GitHub (Aug 9, 2020):

Thank you for the insight, @rusty-snake. After commenting those two lines, opener can open a firejailed firefox successfully, although the stdout of firejail is now leaking in the terminal.

Now it's up to @netblue30 to decide how to approach this.

@tomgar commented on GitHub (Aug 9, 2020): Thank you for the insight, @rusty-snake. After commenting those two lines, opener can open a firejailed firefox successfully, although the stdout of firejail is now leaking in the terminal. Now it's up to @netblue30 to decide how to approach this.

gitea-mirror commented

2026-05-05 08:55:55 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 9, 2020):

although the stdout of firejail is now leaking in the terminal.

You can use quite at the first line in a profile to suppress firejails output.

@rusty-snake commented on GitHub (Aug 9, 2020): > although the stdout of firejail is now leaking in the terminal. You can use `quite` at the first line in a profile to suppress firejails output.

gitea-mirror commented

2026-05-05 08:55:56 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 9, 2020):

The issue seems to be that firejail silently fails if stderr is piped but not consumed.

works

use std::io::prelude::*;
use std::process::{Command, Stdio};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let child = Command::new("firejail")
        .args(&["firefox", "~/Downloads/Firefox/foobar"])
        .stderr(Stdio::piped())
        .spawn()?;

    if let Some(mut stderr) = child.stderr {
        let mut string = String::new();
        stderr.read_to_string(&mut string)?;
        println!("{}", string);
    }

    Ok(())
}

broken

use std::io::prelude::*;
use std::process::{Command, Stdio};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let child = Command::new("firejail")
        .args(&["firefox", "~/Downloads/Firefox/foobar"])
        .stderr(Stdio::piped())
        .spawn()?;

    Ok(())
}

@rusty-snake commented on GitHub (Aug 9, 2020): The issue seems to be that firejail silently fails if stderr is piped but not consumed. <details><summary> works </summary> ```rust use std::io::prelude::*; use std::process::{Command, Stdio}; fn main() -> Result<(), Box<dyn std::error::Error>> { let child = Command::new("firejail") .args(&["firefox", "~/Downloads/Firefox/foobar"]) .stderr(Stdio::piped()) .spawn()?; if let Some(mut stderr) = child.stderr { let mut string = String::new(); stderr.read_to_string(&mut string)?; println!("{}", string); } Ok(()) } ``` </details> <details><summary> broken </summary> ```rust use std::io::prelude::*; use std::process::{Command, Stdio}; fn main() -> Result<(), Box<dyn std::error::Error>> { let child = Command::new("firejail") .args(&["firefox", "~/Downloads/Firefox/foobar"]) .stderr(Stdio::piped()) .spawn()?; Ok(()) } ``` </details>

gitea-mirror commented

2026-05-05 08:55:58 -06:00

Author

Owner

@sak96 commented on GitHub (Nov 22, 2020):

% FIREJAIL_DEBUG=yes firejail --ls=$(firejail --list | grep firefox | cut -f 1 -d:) ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc
Error: cannot access /.../.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc

% FIREJAIL_DEBUG=yes firejail --ls=$(firejail --list | grep firefox | cut -f 1 -d:) ~
...
Warning: not remounting /.../.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc
Warning: not remounting /.../.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc
...
dr-------- root     root              40 .rustup
...

% cat firefox.local
whitelist ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/
read-only ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/

% firejail --version
firejail version 0.9.64

Compile time support:
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file and directory whitelisting support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- overlayfs support is enabled
	- private-home support is enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

not sure what i have done wrong. the browser is opening proper link. but it doesn't have access to the folder.

@sak96 commented on GitHub (Nov 22, 2020): ```zsh % FIREJAIL_DEBUG=yes firejail --ls=$(firejail --list | grep firefox | cut -f 1 -d:) ~/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc Error: cannot access /.../.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc ``` --- ```zsh % FIREJAIL_DEBUG=yes firejail --ls=$(firejail --list | grep firefox | cut -f 1 -d:) ~ ... Warning: not remounting /.../.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc Warning: not remounting /.../.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc ... dr-------- root root 40 .rustup ... ``` --- ```config % cat firefox.local whitelist ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/ read-only ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/ ``` --- ```zsh % firejail --version firejail version 0.9.64 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` not sure what i have done wrong. the browser is opening proper link. but it doesn't have access to the folder.

gitea-mirror commented

2026-05-05 08:55:59 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 22, 2020):

With the firefox.local below you should be able to open the docs in your firefox by entering the path in the urlbar (file:///home/USER/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/). (You can create a bookmark for it). rustup doc will still be broken.

noblacklist ${HOME}/.rustup
whitelist ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/
read-only ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/

Reason: ${HOME}/.rustup is blacklisted in disable-devel.inc.

@rusty-snake commented on GitHub (Nov 22, 2020): With the firefox.local below you should be able to open the docs in your firefox by entering the path in the urlbar (`file:///home/USER/rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/`). (You can create a bookmark for it). `rustup doc` will still be broken. ``` noblacklist ${HOME}/.rustup whitelist ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/ read-only ${HOME}/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/share/doc/ ``` Reason: `${HOME}/.rustup` is `blacklist`ed in disable-devel.inc.

gitea-mirror commented

2026-05-05 08:56:01 -06:00

Author

Owner

@sak96 commented on GitHub (Nov 22, 2020):

@rusty-snake. thanks
i previously tried the noblacklist ${HOME}/.rustup/ seems extra slash was the culprit.
thanks again.

my current config is

noblacklist ${HOME}/.rustup
whitelist ${HOME}/.rustup/toolchains/*/share/doc/
read-only ${HOME}/.rustup/toolchains/*/share/doc/

rustup doc doesn't seem to be broken for me.
my version of rust is

% rustup -V
rustup 1.22.1 (2020-07-08)

@sak96 commented on GitHub (Nov 22, 2020): @rusty-snake. thanks i previously tried the `noblacklist ${HOME}/.rustup/` seems extra slash was the culprit. thanks again. my current config is ```config noblacklist ${HOME}/.rustup whitelist ${HOME}/.rustup/toolchains/*/share/doc/ read-only ${HOME}/.rustup/toolchains/*/share/doc/ ``` rustup doc doesn't seem to be broken for me. my version of rust is ```zsh % rustup -V rustup 1.22.1 (2020-07-08) ```

gitea-mirror commented

2026-05-05 08:56:01 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 10, 2021):

Workaround

If you frequently change toolchains bookmarking isn't enough.
However, you can use xdg-open to open the --path of the docs.

xdg-open "$(rustup doc --path)"

Based on this you can make a shell-script. Name it e.g. rustup-doc and place it somewhere in $PATH.

#!/bin/bash
exec xdg-open "$(rustup doc --path "$@")"

@rusty-snake commented on GitHub (Feb 10, 2021): # Workaround If you frequently change toolchains bookmarking isn't enough. However, you can use `xdg-open` to open the `--path` of the docs. ```bash xdg-open "$(rustup doc --path)" ``` Based on this you can make a shell-script. Name it e.g. `rustup-doc` and place it somewhere in `$PATH`. ```bash #!/bin/bash exec xdg-open "$(rustup doc --path "$@")" ```

gitea-mirror referenced this issue

2026-05-05 10:16:10 -06:00

[PR #2240] [MERGED] Fix tar.profile on Debian based distributions #4229

Rows
Columns

[GH-ISSUE #3576] firefox: cannot open docs in ~/.rustup #2240

Workaround