mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3609] firefox: program does not open (seccomp) #2265
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2265
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ghost on GitHub (Aug 28, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3609
Write clear, concise and in textual form.
Bug and expected behavior
Firefox version 80.0 hangs on start due to seccomp, the issue wasn't there before.
Firefox should launch normally.
No profile or disabling firejail
Firefox works fine.
whereis PROGRAM,firejail --list,stat $programpath)?Firefox works fine.
Reproduce
Steps to reproduce the behavior:
firejail /usr/lib/firefox/firefoxfirejail --ignore=seccomp /usr/lib/firefox/firefoxEnvironment
lsb_release -a)Arch linux
firejail --version) exclusive or used git commit (git rev-parse HEAD)firejail version 0.9.62.4
N/A
N/A
Additional context
Other context about the problem like related errors to understand the problem.
Checklist
find / -name 'firejail' 2>/dev/null/fd firejailto locate profiles ie in/usr/local/etc/firejail/PROGRAM.profile)When using
--ignore=seccompoption firefox launches normallydebug output
@rusty-snake commented on GitHub (Aug 28, 2020):
Which syscall is blocked?
journalctl --grep syscall --reverse@bbhtt commented on GitHub (Aug 29, 2020):
Are you using hardened kernel on Arch? If so the new x11 gpu acceleration needs kcmp+compile time support... I don't have any hang, I'm on Arch 5.8.5.arch1-1
@toazd commented on GitHub (Sep 1, 2020):
I may be having the same issue on Arch 5.8.5. No windows show for firefox and there are no console errors to indicate a problem. Adding
--ignore=seccompto thefirejailparameters causes firefox to open fine but I don't know the consequences of using that parameter.Most recent block from
journalctl --grep syscall --reverseafter runningfirejail --apparmor --debug firefoxa few times:Hopefully that helps @rusty-snake ?
@bbhtt commented on GitHub (Sep 1, 2020):
seccomp !chroot--->seccomp !chroot,!kcmpin firefox-common.profile,when firefox enables x11 acceleration by default in >80, the profile needs to be changedSee 3219@toazd commented on GitHub (Sep 1, 2020):
Changing line 49 in
/etc/firejail/firefox-common.profilefromseccomp !chroottoseccomp !chroot,!kcmpcauses firefox to launch as expected and it appears to be working fine (usingfirejail --apparmor firefox).Thank you very much @kortewegdevries 👍
@bbhtt commented on GitHub (Sep 2, 2020):
@tozad , just curious what gpu driver/card are you using on Arch? I changed the about:config and used
env MOZ_X11_EGL firefox %u, and I don't have any hang other than a few flashy graphical glitches. Now on firefox 80.0.1-1, same kernel, profiles that come with the aur package of firejail-git:My journalctl is empty.
@ghost commented on GitHub (Sep 2, 2020):
Yeah hardened kernel. I'm using wayland btw.
@bbhtt commented on GitHub (Sep 2, 2020):
Can you do the same? Open a terminal:
journalctl --follow; open anotherfirejail firefox; assuming it freezes post the last blue line fromjournalctl --follow.@ghost commented on GitHub (Sep 2, 2020):
Sep 02 13:42:22 archers audit[9394]: SECCOMP auid=1000 uid=1000 gid=1000 ses=1 pid=9394 comm="MainThread" exe="/usr/lib/firefox/firefox" sig=31 arch=c000003e syscall=312 compat=0 ip=0x65f4ebf34d5d code=0x0@bbhtt commented on GitHub (Sep 2, 2020):
Same fix for you. I guess:
@toazd commented on GitHub (Sep 2, 2020):
@kortewegdevries
I am using the kernel amdgpu and a 5700XT. Firejail is version 0.9.62.4-1 from the community repository.
I reset my firefox preferences (removed prefs.js) and reverted the
seccomp !chroot,!kcmpchange in/etc/firejail/firefox-common.local(moved there fromfirefox-common.profileyesterday). Firefox started up fine with no other changes:I reset the preferences because I realized after inspecting about:config that I had only partially finished the steps to enable VA-API . I must have gotten interrupted during the process. Either way, I had both
media.ffmpeg.vaapi.enabledandmedia.ffvpx.enabledset totrueand I wasn't usingMOZ_X11_EGL=1. So, I decided to reset just to make sure nothing else would mess with the following tests.I then set
media.ffmpeg.vaapi.enabledtotrueandmedia.ffvpx.enabledtofalse. I then putMOZ_LOG="PlatformDecoderModule:5"andMOZ_X11_EGL=1into/etc/environmentand restarted. Firefox starts up fine and plays videos but VA-API is not used:I have libva-mesa-driver-20.1.6-1 already installed and this is the output from va-info (just confirming that VA-API is supported):
Attempting to start firefox with the OpenGL compositor (
layers.acceleration.force-enabledset totrue) or the WebRender compositor (gfx.webrender.allset totrueand$ MOZ_WEBRENDER=1 firefox) both fail to even open a window unlessseccomp !chroot,!kcmpis set in/etc/firejail/firefox-common.profile(/etc/firejail/firefox-common.localwouldn't work so I guess I was using the wrong file name).With only WebRender enabled (success):
With only OpenGL compositor enabled (failed):
So, now I just need to figure out which file name to use for persistent changes instead of
/etc/firejail/firefox-common.local. My first guess is/etc/firejail/firefox.localbut I am not sure.@bbhtt commented on GitHub (Sep 2, 2020):
Thanks, I guess I'm the exception here, I also use same drivers+webgl (usually have it disabled but I turned on for testing) on Arch but weird, it doesn't hang for me.
@rusty-snake commented on GitHub (Sep 2, 2020):
This is #3219.
@bbhtt commented on GitHub (Sep 3, 2020):
PR 3301 works? Somehow I'm not affected by this on Ubuntu (mesa from oibaf ppa) or on Arch mesa 20.1.6-1, I have a R7 or R5 card. Only time I saw that behavior was for miniutube on Arch only but not on Ubuntu. The arch package has the fix while I think Ubuntu package does not.
@ghost commented on GitHub (Sep 4, 2020):
I can confirm that this happens only with amdgpu mesa driver. Some older version of firefox (maybe 78 or 79) did work fine without
seccomp=!kcmpas I was didn't need to modify firefox profile before.Closing this one as the same issue already exists #3219