github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3604] firejail firejail does not work in openSUSE #2260

New issue

Open

opened 2026-05-05 08:57:10 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:57:10 -06:00

Owner

Originally created by @smitsohu on GitHub (Aug 26, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3604

Bug and expected behavior
firejail firejail does not work in openSUSE if the sandbox is configured with a nogroups or noroot option.
It (usually) works in other distributions such as Debian.

Reproduce
Steps to reproduce the behavior:

firejail --noprofile --nogroups firejail or
firejail --noprofile --noroot firejail

Background
The reason is that the distribution sets permission on the Firejail executable to 4750, and group ownership to supplemental group firejail. If the sandbox removes firejail group membership in one way or the other, there is no permission to execute Firejail any more.

Workarounds exist. Either put

ignore noroot
ignore nogroups

in /etc/firejail/globals.local or set permission on Firejail executable to 4755

Originally created by @smitsohu on GitHub (Aug 26, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3604 **Bug and expected behavior** `firejail firejail` does not work in openSUSE if the sandbox is configured with a `nogroups` or `noroot` option. It (usually) works in other distributions such as Debian. **Reproduce** Steps to reproduce the behavior: 1. `firejail --noprofile --nogroups firejail` or 1. `firejail --noprofile --noroot firejail` **Background** The reason is that the distribution sets permission on the Firejail executable to 4750, and group ownership to supplemental group `firejail`. If the sandbox removes `firejail` group membership in one way or the other, there is no permission to execute Firejail any more. Workarounds exist. Either put ``` ignore noroot ignore nogroups ``` in /etc/firejail/globals.local or set permission on Firejail executable to 4755

gitea-mirror added the

enhancement

information_old

labels 2026-05-05 08:57:10 -06:00

gitea-mirror commented

2026-05-05 08:57:12 -06:00

Author

Owner

@smitsohu commented on GitHub (Dec 21, 2020):

noroot should work as of 36f1950fdc

@smitsohu commented on GitHub (Dec 21, 2020): `noroot` should work as of 36f1950fdc889ca42545258dc7cf47d72e46b1a1

gitea-mirror commented

2026-05-05 08:57:13 -06:00

Author

Owner

@kmk3 commented on GitHub (Oct 22, 2021):

@smitsohu commented on Dec 21, 2020:

noroot should work as of
36f1950

Is this resolved then?

@kmk3 commented on GitHub (Oct 22, 2021): @smitsohu commented [on Dec 21, 2020](https://github.com/netblue30/firejail/issues/3604#issuecomment-749255554): > `noroot` should work as of > [36f1950](https://github.com/netblue30/firejail/commit/36f1950fdc889ca42545258dc7cf47d72e46b1a1) Is this resolved then?

gitea-mirror commented

2026-05-05 08:57:15 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 22, 2021):

AFAIK no because of nogroups.

@rusty-snake commented on GitHub (Oct 22, 2021): AFAIK no because of `nogroups`.

gitea-mirror referenced this issue

2026-05-05 10:16:27 -06:00

[PR #2260] [MERGED] Fix Evince profile #4242

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2260

No description provided.

Rows
Columns