github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #3634] Discord 0.0.12 not starting #2286

New issue
Closed
opened 2026-05-05 08:58:30 -06:00 by gitea-mirror · 7 comments
gitea-mirror commented 2026-05-05 08:58:30 -06:00
Owner
Copy link

Originally created by @r1bnc on GitHub (Sep 18, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3634

Write clear, concise and in textual form.

Bug and expected behavior

  • Describe the bug.
    Discord 0.0.12 installed via deb package from the official Discord website won't run with firejail, it does work when the noprofile flag is set and without firejail.
  • What did you expect to happen?
    Start normally

No profile or disabling firejail

  • What changed calling firejail --noprofile PROGRAM in a shell?
    it runs fine.
  • What changed calling the program by path=without firejail (check whereis PROGRAM, firejail --list, stat $programpath)?

Reproduce
Steps to reproduce the behavior:

  1. Run in bash firejail PROGRAM
  2. See error ERROR
  3. Click on '....'
  4. Scroll down to '....'

Environment

  • Linux distribution and version (ie output of lsb_release -a)
    Distributor ID: Debian
    Description: Debian GNU/Linux 10 (buster)
    Release: 10
    Codename: buster

  • Firejail version (output of firejail --version) exclusive or used git commit (git rev-parse HEAD)
    firejail version 0.9.62.4
    firejail from buster-backports repo:
    Compile time support:

    • AppArmor support is enabled
    • AppImage support is enabled
    • chroot support is enabled
    • file and directory whitelisting support is enabled
    • file transfer support is enabled
    • firetunnel support is enabled
    • networking support is enabled
    • overlayfs support is enabled
    • private-home support is enabled
    • seccomp-bpf support is enabled
    • user namespace support is enabled
    • X11 sandboxing support is enabled

  • What other programs interact with the affected program for the functionality?

  • Are these listed in the profile?

Additional context
Other context about the problem like related errors to understand the problem.

Checklist

  • The upstream profile (and redirect profile if exists) have no changes fixing it.
  • The upstream profile exists (find / -name 'firejail' 2>/dev/null/fd firejail to locate profiles ie in /usr/local/etc/firejail/PROGRAM.profile)
  • Programs needed for interaction are listed.
  • Error was checked in search engine and on issue list without success.
debug output 
OUTPUT OF `firejail --debug discord`

Autoselecting /bin/bash as shell
Building quoted command line: 'discord' 
Command name #discord#
Found discord.profile profile in /etc/firejail directory
Reading profile /etc/firejail/discord.profile
Found discord-common.profile profile in /etc/firejail directory
Reading profile /etc/firejail/discord-common.profile
Found disable-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-common.inc
Found disable-devel.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-devel.inc
Found disable-passwdmgr.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-passwdmgr.inc
Found disable-programs.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-programs.inc
Warning: networking feature is disabled in Firejail configuration file
DISPLAY=:0 parsed as 0
Using the local network stack
Parent pid 28083, child pid 28085
Initializing child process
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Build protocol filter: unix,inet,inet6,netlink
sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6,netlink /run/firejail/mnt/seccomp/seccomp.protocol (null) 
Dropping all capabilities
Drop privileges: pid 2, uid 1000, gid 1000, nogroups 1
No supplementary groups
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
Mounting noexec /etc
Mounting read-only /var
Mounting noexec /var
Mounting read-only /bin
Mounting read-only /sbin
Mounting read-only /lib
Mounting read-only /lib64
Mounting read-only /lib32
Mounting read-only /libx32
Mounting read-only /usr
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/dhcp
Mounting tmpfs on /var/lib/nginx
Mounting tmpfs on /var/lib/snmp
Mounting tmpfs on /var/lib/sudo
Mounting tmpfs on /var/cache/lighttpd
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
Mounting tmpfs on /dev
mounting /run/firejail/mnt/dev/snd directory
mounting /run/firejail/mnt/dev/dri directory
Process /dev/shm directory
Copying files in the new /etc directory:
copying /etc/fonts to private /etc
Creating empty /run/firejail/mnt/etc/fonts directory
sbox run: /run/firejail/lib/fcopy /etc/fonts /run/firejail/mnt/etc/fonts (null) 
copying /etc/machine-id to private /etc
sbox run: /run/firejail/lib/fcopy /etc/machine-id /run/firejail/mnt/etc (null) 
copying /etc/localtime to private /etc
sbox run: /run/firejail/lib/fcopy /etc/localtime /run/firejail/mnt/etc (null) 
copying /etc/ld.so.cache to private /etc
sbox run: /run/firejail/lib/fcopy /etc/ld.so.cache /run/firejail/mnt/etc (null) 
copying /etc/ca-certificates to private /etc
Creating empty /run/firejail/mnt/etc/ca-certificates directory
sbox run: /run/firejail/lib/fcopy /etc/ca-certificates /run/firejail/mnt/etc/ca-certificates (null) 
copying /etc/ssl to private /etc
Creating empty /run/firejail/mnt/etc/ssl directory
sbox run: /run/firejail/lib/fcopy /etc/ssl /run/firejail/mnt/etc/ssl (null) 
Warning: file /etc/pki not found.
Warning: skipping pki for private /etc
Warning: file /etc/crypto-policies not found.
Warning: skipping crypto-policies for private /etc
copying /etc/resolv.conf to private /etc
sbox run: /run/firejail/lib/fcopy /etc/resolv.conf /run/firejail/mnt/etc (null) 
Mount-bind /run/firejail/mnt/etc on top of /etc
Private /etc installed in 803.31 ms
Copying files in the new /opt directory:
Warning: file /opt/discord not found.
Warning: skipping discord for private /opt
Mount-bind /run/firejail/mnt/opt on top of /opt
Private /opt installed in 8.63 ms
Copying files in the new bin directory
Checking /usr/local/bin/discord
firejail exec symlink detected
Checking /usr/bin/discord
file /usr/share/discord/Discord not found
sbox run: /run/firejail/lib/fcopy /usr/bin/discord /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/sh
Checking /usr/bin/sh
Checking /bin/sh
sbox run: /run/firejail/lib/fcopy /bin/dash /run/firejail/mnt/bin (null) 
sbox run: /run/firejail/lib/fcopy /bin/sh /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/xdg-mime
Checking /usr/bin/xdg-mime
sbox run: /run/firejail/lib/fcopy /usr/bin/xdg-mime /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/tr
Checking /usr/bin/tr
sbox run: /run/firejail/lib/fcopy /usr/bin/tr /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/sed
Checking /usr/bin/sed
Checking /bin/sed
sbox run: /run/firejail/lib/fcopy /bin/sed /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/echo
Checking /usr/bin/echo
Checking /bin/echo
sbox run: /run/firejail/lib/fcopy /bin/echo /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/head
Checking /usr/bin/head
sbox run: /run/firejail/lib/fcopy /usr/bin/head /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/cut
Checking /usr/bin/cut
sbox run: /run/firejail/lib/fcopy /usr/bin/cut /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/xdg-open
Checking /usr/bin/xdg-open
sbox run: /run/firejail/lib/fcopy /usr/bin/xdg-open /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/grep
Checking /usr/bin/grep
Checking /bin/grep
sbox run: /run/firejail/lib/fcopy /bin/grep /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/egrep
Checking /usr/bin/egrep
Checking /bin/egrep
sbox run: /run/firejail/lib/fcopy /bin/egrep /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/bash
Checking /usr/bin/bash
Checking /bin/bash
sbox run: /run/firejail/lib/fcopy /bin/bash /run/firejail/mnt/bin (null) 
Checking /usr/local/bin/zsh
Checking /usr/bin/zsh
sbox run: /run/firejail/lib/fcopy /bin/zsh /run/firejail/mnt/bin (null) 
sbox run: /run/firejail/lib/fcopy /usr/bin/zsh /run/firejail/mnt/bin (null) 
Mount-bind /run/firejail/mnt/bin on top of /usr/local/bin
Mount-bind /run/firejail/mnt/bin on top of /usr/bin
Mount-bind /run/firejail/mnt/bin on top of /bin
Mount-bind /run/firejail/mnt/bin on top of /usr/games
Mount-bind /run/firejail/mnt/bin on top of /usr/local/games
Mount-bind /run/firejail/mnt/bin on top of /usr/local/sbin
Mount-bind /run/firejail/mnt/bin on top of /usr/sbin
Mount-bind /run/firejail/mnt/bin on top of /sbin
15 programs installed in 574.38 ms
Generate private-tmp whitelist commands
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/sched_debug
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /lib/modules
Disable /usr/lib/debug
Disable /boot
Disable /run/user/1000/gnupg
Disable /run/user/1000/systemd
Disable /proc/kmsg
Debug 423: new_name #/home/user/.config/discord#, whitelist
Debug 531: fname #/home/user/.config/discord#, cfg.homedir #/home/user#
Replaced whitelist path: whitelist /home/user/.config/discord
Directory ${DOWNLOADS} resolved as Downloads
Debug 423: new_name #/home/user/Downloads#, whitelist
Debug 531: fname #/home/user/Downloads#, cfg.homedir #/home/user#
Replaced whitelist path: whitelist /home/user/Downloads
Debug 423: new_name #/tmp/.X11-unix#, whitelist
Debug 423: new_name #/tmp/pulse-PKdhtXMmr18n#, whitelist
Mounting tmpfs on /tmp directory
Drop privileges: pid 25, uid 1000, gid 1000, nogroups 0
Warning: cleaning all supplementary groups
Mounting a new /home directory
Mounting a new /root directory
Create a new user directory
Drop privileges: pid 26, uid 1000, gid 1000, nogroups 0
Warning: cleaning all supplementary groups
Whitelisting /home/user/.config/discord
711 709 253:1 /home/user/.config/discord /home/user/.config/discord rw,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix
mountid=711 fsname=/home/user/.config/discord dir=/home/user/.config/discord fstype=f2fs
Whitelisting /home/user/Downloads
712 709 253:1 /home/user/Downloads /home/user/Downloads rw,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix
mountid=712 fsname=/home/user/Downloads dir=/home/user/Downloads fstype=f2fs
Whitelisting /tmp/.X11-unix
713 707 0:43 /.X11-unix /tmp/.X11-unix rw,nosuid,noatime master:31 - tmpfs tmpfs rw
mountid=713 fsname=/.X11-unix dir=/tmp/.X11-unix fstype=tmpfs
Whitelisting /tmp/pulse-PKdhtXMmr18n
714 707 0:43 /pulse-PKdhtXMmr18n /tmp/pulse-PKdhtXMmr18n rw,nosuid,noatime master:31 - tmpfs tmpfs rw
mountid=714 fsname=/pulse-PKdhtXMmr18n dir=/tmp/pulse-PKdhtXMmr18n fstype=tmpfs
Mounting read-only /home/user/.Xauthority
717 709 0:113 /user/.Xauthority /home/user/.Xauthority ro,nosuid,nodev,noexec - tmpfs tmpfs rw,mode=755
mountid=717 fsname=/user/.Xauthority dir=/home/user/.Xauthority fstype=tmpfs
Disable /var/lib/systemd
Disable /usr/share/applications/veracrypt.desktop
Disable /usr/share/pixmaps/veracrypt.xpm
Disable /var/cache/apt
Disable /var/lib/apt
Disable /var/lib/clamav
Disable /var/lib/dkms
Disable /var/lib/upower
Disable /var/mail
Disable /var/opt
Disable /run/rpcbind.sock (requested /var/run/rpcbind.sock)
Disable /var/spool/anacron
Disable /var/spool/cron
Disable /var/mail (requested /var/spool/mail)
Disable /sbin
Disable /usr/local/sbin
Disable /usr/sbin
Disable /usr/lib/virtualbox
Disable /usr/share/flatpak
Disable /var/lib/flatpak
Disable /usr/include
Disable /usr/share/java
Disable /usr/lib/valgrind
Not blacklist /home/user/.config/discord
Mounting noexec /home/user/.config/discord
741 711 253:1 /home/user/.config/discord /home/user/.config/discord rw,nosuid,nodev,noexec,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix
mountid=741 fsname=/home/user/.config/discord dir=/home/user/.config/discord fstype=f2fs
Mounting noexec /home/user/Downloads
742 712 253:1 /home/user/Downloads /home/user/Downloads rw,nosuid,nodev,noexec,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix
mountid=742 fsname=/home/user/Downloads dir=/home/user/Downloads fstype=f2fs
Mounting noexec /tmp
745 743 0:43 /pulse-PKdhtXMmr18n /tmp/pulse-PKdhtXMmr18n rw,nosuid,noatime master:31 - tmpfs tmpfs rw
mountid=745 fsname=/pulse-PKdhtXMmr18n dir=/tmp/pulse-PKdhtXMmr18n fstype=tmpfs
Mounting noexec /tmp/.X11-unix
746 744 0:43 /.X11-unix /tmp/.X11-unix rw,nosuid,nodev,noexec,noatime master:31 - tmpfs tmpfs rw
mountid=746 fsname=/.X11-unix dir=/tmp/.X11-unix fstype=tmpfs
Mounting noexec /tmp/pulse-PKdhtXMmr18n
747 745 0:43 /pulse-PKdhtXMmr18n /tmp/pulse-PKdhtXMmr18n rw,nosuid,nodev,noexec,noatime master:31 - tmpfs tmpfs rw
mountid=747 fsname=/pulse-PKdhtXMmr18n dir=/tmp/pulse-PKdhtXMmr18n fstype=tmpfs
Mounting read-only /tmp/.X11-unix
748 746 0:43 /.X11-unix /tmp/.X11-unix ro,nosuid,nodev,noexec,noatime master:31 - tmpfs tmpfs rw
mountid=748 fsname=/.X11-unix dir=/tmp/.X11-unix fstype=tmpfs
Disable /sys/fs
Disable /sys/module
/etc/pulse/client.conf not found
Current directory: /home/user
DISPLAY=:0 parsed as 0
Install protocol filter: unix,inet,inet6,netlink
configuring 16 seccomp entries in /run/firejail/mnt/seccomp/seccomp.protocol
sbox run: /usr/lib/x86_64-linux-gnu/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp.protocol (null) 
Dropping all capabilities
Drop privileges: pid 27, uid 1000, gid 1000, nogroups 1
No supplementary groups
 line  OP JT JF    K
=================================
 0000: 20 00 00 00000004   ld  data.architecture
 0001: 15 01 00 c000003e   jeq ARCH_64 0003 (false 0002)
 0002: 06 00 00 7fff0000   ret ALLOW
 0003: 20 00 00 00000000   ld  data.syscall-number
 0004: 15 01 00 00000029   jeq socket 0006 (false 0005)
 0005: 06 00 00 7fff0000   ret ALLOW
 0006: 20 00 00 00000010   ld  data.args[0]
 0007: 15 00 01 00000001   jeq 1 0008 (false 0009)
 0008: 06 00 00 7fff0000   ret ALLOW
 0009: 15 00 01 00000002   jeq 2 000a (false 000b)
 000a: 06 00 00 7fff0000   ret ALLOW
 000b: 15 00 01 0000000a   jeq a 000c (false 000d)
 000c: 06 00 00 7fff0000   ret ALLOW
 000d: 15 00 01 00000010   jeq 10 000e (false 000f)
 000e: 06 00 00 7fff0000   ret ALLOW
 000f: 06 00 00 0005005f   ret ERRNO(95)
configuring 54 seccomp entries in /run/firejail/mnt/seccomp/seccomp.32
sbox run: /usr/lib/x86_64-linux-gnu/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp.32 (null) 
Dropping all capabilities
Drop privileges: pid 28, uid 1000, gid 1000, nogroups 1
No supplementary groups
 line  OP JT JF    K
=================================
 0000: 20 00 00 00000004   ld  data.architecture
 0001: 15 01 00 40000003   jeq ARCH_32 0003 (false 0002)
 0002: 06 00 00 7fff0000   ret ALLOW
 0003: 20 00 00 00000000   ld  data.syscall-number
 0004: 15 30 00 00000015   jeq 15 0035 (false 0005)
 0005: 15 2f 00 00000034   jeq 34 0035 (false 0006)
 0006: 15 2e 00 0000001a   jeq 1a 0035 (false 0007)
 0007: 15 2d 00 0000011b   jeq 11b 0035 (false 0008)
 0008: 15 2c 00 00000155   jeq 155 0035 (false 0009)
 0009: 15 2b 00 00000156   jeq 156 0035 (false 000a)
 000a: 15 2a 00 0000007f   jeq 7f 0035 (false 000b)
 000b: 15 29 00 00000080   jeq 80 0035 (false 000c)
 000c: 15 28 00 0000015e   jeq 15e 0035 (false 000d)
 000d: 15 27 00 00000081   jeq 81 0035 (false 000e)
 000e: 15 26 00 0000006e   jeq 6e 0035 (false 000f)
 000f: 15 25 00 00000065   jeq 65 0035 (false 0010)
 0010: 15 24 00 00000121   jeq 121 0035 (false 0011)
 0011: 15 23 00 00000057   jeq 57 0035 (false 0012)
 0012: 15 22 00 00000073   jeq 73 0035 (false 0013)
 0013: 15 21 00 00000067   jeq 67 0035 (false 0014)
 0014: 15 20 00 0000015b   jeq 15b 0035 (false 0015)
 0015: 15 1f 00 0000015c   jeq 15c 0035 (false 0016)
 0016: 15 1e 00 00000087   jeq 87 0035 (false 0017)
 0017: 15 1d 00 00000095   jeq 95 0035 (false 0018)
 0018: 15 1c 00 0000007c   jeq 7c 0035 (false 0019)
 0019: 15 1b 00 00000157   jeq 157 0035 (false 001a)
 001a: 15 1a 00 000000fd   jeq fd 0035 (false 001b)
 001b: 15 19 00 00000150   jeq 150 0035 (false 001c)
 001c: 15 18 00 00000152   jeq 152 0035 (false 001d)
 001d: 15 17 00 0000015d   jeq 15d 0035 (false 001e)
 001e: 15 16 00 0000011e   jeq 11e 0035 (false 001f)
 001f: 15 15 00 0000011f   jeq 11f 0035 (false 0020)
 0020: 15 14 00 00000120   jeq 120 0035 (false 0021)
 0021: 15 13 00 00000056   jeq 56 0035 (false 0022)
 0022: 15 12 00 00000033   jeq 33 0035 (false 0023)
 0023: 15 11 00 0000007b   jeq 7b 0035 (false 0024)
 0024: 15 10 00 000000d9   jeq d9 0035 (false 0025)
 0025: 15 0f 00 000000f5   jeq f5 0035 (false 0026)
 0026: 15 0e 00 000000f6   jeq f6 0035 (false 0027)
 0027: 15 0d 00 000000f7   jeq f7 0035 (false 0028)
 0028: 15 0c 00 000000f8   jeq f8 0035 (false 0029)
 0029: 15 0b 00 000000f9   jeq f9 0035 (false 002a)
 002a: 15 0a 00 00000101   jeq 101 0035 (false 002b)
 002b: 15 09 00 00000112   jeq 112 0035 (false 002c)
 002c: 15 08 00 00000114   jeq 114 0035 (false 002d)
 002d: 15 07 00 00000126   jeq 126 0035 (false 002e)
 002e: 15 06 00 0000013d   jeq 13d 0035 (false 002f)
 002f: 15 05 00 0000013c   jeq 13c 0035 (false 0030)
 0030: 15 04 00 0000003d   jeq 3d 0035 (false 0031)
 0031: 15 03 00 00000058   jeq 58 0035 (false 0032)
 0032: 15 02 00 000000a9   jeq a9 0035 (false 0033)
 0033: 15 01 00 00000082   jeq 82 0035 (false 0034)
 0034: 06 00 00 7fff0000   ret ALLOW
 0035: 06 00 00 00000000   ret KILL
Dual 32/64 bit seccomp filter configured
configuring 72 seccomp entries in /run/firejail/mnt/seccomp/seccomp
sbox run: /usr/lib/x86_64-linux-gnu/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp (null) 
Dropping all capabilities
Drop privileges: pid 29, uid 1000, gid 1000, nogroups 1
No supplementary groups
 line  OP JT JF    K
=================================
 0000: 20 00 00 00000004   ld  data.architecture
 0001: 15 01 00 c000003e   jeq ARCH_64 0003 (false 0002)
 0002: 06 00 00 7fff0000   ret ALLOW
 0003: 20 00 00 00000000   ld  data.syscall-number
 0004: 35 01 00 40000000   jge X32_ABI 0006 (false 0005)
 0005: 35 01 00 00000000   jge read 0007 (false 0006)
 0006: 06 00 00 00050001   ret ERRNO(1)
 0007: 15 3f 00 0000009f   jeq adjtimex 0047 (false 0008)
 0008: 15 3e 00 00000131   jeq clock_adjtime 0047 (false 0009)
 0009: 15 3d 00 000000e3   jeq clock_settime 0047 (false 000a)
 000a: 15 3c 00 000000a4   jeq settimeofday 0047 (false 000b)
 000b: 15 3b 00 0000009a   jeq modify_ldt 0047 (false 000c)
 000c: 15 3a 00 000000d4   jeq lookup_dcookie 0047 (false 000d)
 000d: 15 39 00 0000012a   jeq perf_event_open 0047 (false 000e)
 000e: 15 38 00 00000137   jeq process_vm_writev 0047 (false 000f)
 000f: 15 37 00 000000b0   jeq delete_module 0047 (false 0010)
 0010: 15 36 00 00000139   jeq finit_module 0047 (false 0011)
 0011: 15 35 00 000000af   jeq init_module 0047 (false 0012)
 0012: 15 34 00 0000009c   jeq _sysctl 0047 (false 0013)
 0013: 15 33 00 000000b7   jeq afs_syscall 0047 (false 0014)
 0014: 15 32 00 000000ae   jeq create_module 0047 (false 0015)
 0015: 15 31 00 000000b1   jeq get_kernel_syms 0047 (false 0016)
 0016: 15 30 00 000000b5   jeq getpmsg 0047 (false 0017)
 0017: 15 2f 00 000000b6   jeq putpmsg 0047 (false 0018)
 0018: 15 2e 00 000000b2   jeq query_module 0047 (false 0019)
 0019: 15 2d 00 000000b9   jeq security 0047 (false 001a)
 001a: 15 2c 00 0000008b   jeq sysfs 0047 (false 001b)
 001b: 15 2b 00 000000b8   jeq tuxcall 0047 (false 001c)
 001c: 15 2a 00 00000086   jeq uselib 0047 (false 001d)
 001d: 15 29 00 00000088   jeq ustat 0047 (false 001e)
 001e: 15 28 00 000000ec   jeq vserver 0047 (false 001f)
 001f: 15 27 00 000000ad   jeq ioperm 0047 (false 0020)
 0020: 15 26 00 000000ac   jeq iopl 0047 (false 0021)
 0021: 15 25 00 000000f6   jeq kexec_load 0047 (false 0022)
 0022: 15 24 00 00000140   jeq kexec_file_load 0047 (false 0023)
 0023: 15 23 00 000000a9   jeq reboot 0047 (false 0024)
 0024: 15 22 00 000000a7   jeq swapon 0047 (false 0025)
 0025: 15 21 00 000000a8   jeq swapoff 0047 (false 0026)
 0026: 15 20 00 00000130   jeq open_by_handle_at 0047 (false 0027)
 0027: 15 1f 00 0000012f   jeq name_to_handle_at 0047 (false 0028)
 0028: 15 1e 00 000000fb   jeq ioprio_set 0047 (false 0029)
 0029: 15 1d 00 00000067   jeq syslog 0047 (false 002a)
 002a: 15 1c 00 0000012c   jeq fanotify_init 0047 (false 002b)
 002b: 15 1b 00 00000138   jeq kcmp 0047 (false 002c)
 002c: 15 1a 00 000000f8   jeq add_key 0047 (false 002d)
 002d: 15 19 00 000000f9   jeq request_key 0047 (false 002e)
 002e: 15 18 00 000000ed   jeq mbind 0047 (false 002f)
 002f: 15 17 00 00000100   jeq migrate_pages 0047 (false 0030)
 0030: 15 16 00 00000117   jeq move_pages 0047 (false 0031)
 0031: 15 15 00 000000fa   jeq keyctl 0047 (false 0032)
 0032: 15 14 00 000000ce   jeq io_setup 0047 (false 0033)
 0033: 15 13 00 000000cf   jeq io_destroy 0047 (false 0034)
 0034: 15 12 00 000000d0   jeq io_getevents 0047 (false 0035)
 0035: 15 11 00 000000d1   jeq io_submit 0047 (false 0036)
 0036: 15 10 00 000000d2   jeq io_cancel 0047 (false 0037)
 0037: 15 0f 00 000000d8   jeq remap_file_pages 0047 (false 0038)
 0038: 15 0e 00 00000143   jeq userfaultfd 0047 (false 0039)
 0039: 15 0d 00 000000a3   jeq acct 0047 (false 003a)
 003a: 15 0c 00 00000141   jeq bpf 0047 (false 003b)
 003b: 15 0b 00 000000a1   jeq chroot 0047 (false 003c)
 003c: 15 0a 00 000000a5   jeq mount 0047 (false 003d)
 003d: 15 09 00 000000b4   jeq nfsservctl 0047 (false 003e)
 003e: 15 08 00 0000009b   jeq pivot_root 0047 (false 003f)
 003f: 15 07 00 000000ab   jeq setdomainname 0047 (false 0040)
 0040: 15 06 00 000000aa   jeq sethostname 0047 (false 0041)
 0041: 15 05 00 000000a6   jeq umount2 0047 (false 0042)
 0042: 15 04 00 00000099   jeq vhangup 0047 (false 0043)
 0043: 15 03 00 00000065   jeq ptrace 0047 (false 0044)
 0044: 15 02 00 00000087   jeq personality 0047 (false 0045)
 0045: 15 01 00 00000136   jeq process_vm_readv 0047 (false 0046)
 0046: 06 00 00 7fff0000   ret ALLOW
 0047: 06 00 01 00000000   ret KILL
seccomp filter configured
Mounting read-only /run/firejail/mnt/seccomp
Dropping all capabilities
noroot user namespace installed
Dropping all capabilities
NO_NEW_PRIVS set
Drop privileges: pid 1, uid 1000, gid 1000, nogroups 1
No supplementary groups
starting application
LD_PRELOAD=(null)
Running 'discord'  command through /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: 'discord' 
Child process initialized in 283.51 ms
Installing /run/firejail/mnt/seccomp/seccomp seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter
monitoring pid 30

Sandbox monitor: waitpid 30 retval 30 status 5
Sandbox monitor: monitoring 33
monitoring pid 33

Sandbox monitor: waitpid 33 retval 33 status 31

Parent is shutting down, bye...
Originally created by @r1bnc on GitHub (Sep 18, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3634 Write clear, concise and in textual form. **Bug and expected behavior** - Describe the bug. Discord 0.0.12 installed via deb package from the official Discord website won't run with firejail, it does work when the noprofile flag is set and without firejail. - What did you expect to happen? Start normally **No profile or disabling firejail** - What changed calling `firejail --noprofile PROGRAM` in a shell? it runs fine. - What changed calling the program *by path*=without firejail (check `whereis PROGRAM`, `firejail --list`, `stat $programpath`)? **Reproduce** Steps to reproduce the behavior: 1. Run in bash `firejail PROGRAM` 2. See error `ERROR` 3. Click on '....' 4. Scroll down to '....' **Environment** - Linux distribution and version (ie output of `lsb_release -a`) Distributor ID: Debian Description: Debian GNU/Linux 10 (buster) Release: 10 Codename: buster - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`) firejail version 0.9.62.4 firejail from buster-backports repo: Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled - What other programs interact with the affected program for the functionality? - Are these listed in the profile? **Additional context** Other context about the problem like related errors to understand the problem. **Checklist** - [ ] The upstream profile (and redirect profile if exists) have no changes fixing it. - [ ] The upstream profile exists (`find / -name 'firejail' 2>/dev/null`/`fd firejail` to locate profiles ie in `/usr/local/etc/firejail/PROGRAM.profile`) - [ ] Programs needed for interaction are listed. - [ ] Error was checked in search engine and on issue list without success. <details><summary> debug output </summary> ``` OUTPUT OF `firejail --debug discord` Autoselecting /bin/bash as shell Building quoted command line: 'discord' Command name #discord# Found discord.profile profile in /etc/firejail directory Reading profile /etc/firejail/discord.profile Found discord-common.profile profile in /etc/firejail directory Reading profile /etc/firejail/discord-common.profile Found disable-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-common.inc Found disable-devel.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-devel.inc Found disable-passwdmgr.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-passwdmgr.inc Found disable-programs.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-programs.inc Warning: networking feature is disabled in Firejail configuration file DISPLAY=:0 parsed as 0 Using the local network stack Parent pid 28083, child pid 28085 Initializing child process Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp directory Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file Build protocol filter: unix,inet,inet6,netlink sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6,netlink /run/firejail/mnt/seccomp/seccomp.protocol (null) Dropping all capabilities Drop privileges: pid 2, uid 1000, gid 1000, nogroups 1 No supplementary groups Mounting /proc filesystem representing the PID namespace Basic read-only filesystem: Mounting read-only /etc Mounting noexec /etc Mounting read-only /var Mounting noexec /var Mounting read-only /bin Mounting read-only /sbin Mounting read-only /lib Mounting read-only /lib64 Mounting read-only /lib32 Mounting read-only /libx32 Mounting read-only /usr Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Mounting tmpfs on /var/lib/dhcp Mounting tmpfs on /var/lib/nginx Mounting tmpfs on /var/lib/snmp Mounting tmpfs on /var/lib/sudo Mounting tmpfs on /var/cache/lighttpd Create the new utmp file Mount the new utmp file Cleaning /home directory Cleaning /run/user directory Sanitizing /etc/passwd, UID_MIN 1000 Sanitizing /etc/group, GID_MIN 1000 Disable /run/firejail/network Disable /run/firejail/bandwidth Disable /run/firejail/name Disable /run/firejail/profile Disable /run/firejail/x11 Mounting tmpfs on /dev mounting /run/firejail/mnt/dev/snd directory mounting /run/firejail/mnt/dev/dri directory Process /dev/shm directory Copying files in the new /etc directory: copying /etc/fonts to private /etc Creating empty /run/firejail/mnt/etc/fonts directory sbox run: /run/firejail/lib/fcopy /etc/fonts /run/firejail/mnt/etc/fonts (null) copying /etc/machine-id to private /etc sbox run: /run/firejail/lib/fcopy /etc/machine-id /run/firejail/mnt/etc (null) copying /etc/localtime to private /etc sbox run: /run/firejail/lib/fcopy /etc/localtime /run/firejail/mnt/etc (null) copying /etc/ld.so.cache to private /etc sbox run: /run/firejail/lib/fcopy /etc/ld.so.cache /run/firejail/mnt/etc (null) copying /etc/ca-certificates to private /etc Creating empty /run/firejail/mnt/etc/ca-certificates directory sbox run: /run/firejail/lib/fcopy /etc/ca-certificates /run/firejail/mnt/etc/ca-certificates (null) copying /etc/ssl to private /etc Creating empty /run/firejail/mnt/etc/ssl directory sbox run: /run/firejail/lib/fcopy /etc/ssl /run/firejail/mnt/etc/ssl (null) Warning: file /etc/pki not found. Warning: skipping pki for private /etc Warning: file /etc/crypto-policies not found. Warning: skipping crypto-policies for private /etc copying /etc/resolv.conf to private /etc sbox run: /run/firejail/lib/fcopy /etc/resolv.conf /run/firejail/mnt/etc (null) Mount-bind /run/firejail/mnt/etc on top of /etc Private /etc installed in 803.31 ms Copying files in the new /opt directory: Warning: file /opt/discord not found. Warning: skipping discord for private /opt Mount-bind /run/firejail/mnt/opt on top of /opt Private /opt installed in 8.63 ms Copying files in the new bin directory Checking /usr/local/bin/discord firejail exec symlink detected Checking /usr/bin/discord file /usr/share/discord/Discord not found sbox run: /run/firejail/lib/fcopy /usr/bin/discord /run/firejail/mnt/bin (null) Checking /usr/local/bin/sh Checking /usr/bin/sh Checking /bin/sh sbox run: /run/firejail/lib/fcopy /bin/dash /run/firejail/mnt/bin (null) sbox run: /run/firejail/lib/fcopy /bin/sh /run/firejail/mnt/bin (null) Checking /usr/local/bin/xdg-mime Checking /usr/bin/xdg-mime sbox run: /run/firejail/lib/fcopy /usr/bin/xdg-mime /run/firejail/mnt/bin (null) Checking /usr/local/bin/tr Checking /usr/bin/tr sbox run: /run/firejail/lib/fcopy /usr/bin/tr /run/firejail/mnt/bin (null) Checking /usr/local/bin/sed Checking /usr/bin/sed Checking /bin/sed sbox run: /run/firejail/lib/fcopy /bin/sed /run/firejail/mnt/bin (null) Checking /usr/local/bin/echo Checking /usr/bin/echo Checking /bin/echo sbox run: /run/firejail/lib/fcopy /bin/echo /run/firejail/mnt/bin (null) Checking /usr/local/bin/head Checking /usr/bin/head sbox run: /run/firejail/lib/fcopy /usr/bin/head /run/firejail/mnt/bin (null) Checking /usr/local/bin/cut Checking /usr/bin/cut sbox run: /run/firejail/lib/fcopy /usr/bin/cut /run/firejail/mnt/bin (null) Checking /usr/local/bin/xdg-open Checking /usr/bin/xdg-open sbox run: /run/firejail/lib/fcopy /usr/bin/xdg-open /run/firejail/mnt/bin (null) Checking /usr/local/bin/grep Checking /usr/bin/grep Checking /bin/grep sbox run: /run/firejail/lib/fcopy /bin/grep /run/firejail/mnt/bin (null) Checking /usr/local/bin/egrep Checking /usr/bin/egrep Checking /bin/egrep sbox run: /run/firejail/lib/fcopy /bin/egrep /run/firejail/mnt/bin (null) Checking /usr/local/bin/bash Checking /usr/bin/bash Checking /bin/bash sbox run: /run/firejail/lib/fcopy /bin/bash /run/firejail/mnt/bin (null) Checking /usr/local/bin/zsh Checking /usr/bin/zsh sbox run: /run/firejail/lib/fcopy /bin/zsh /run/firejail/mnt/bin (null) sbox run: /run/firejail/lib/fcopy /usr/bin/zsh /run/firejail/mnt/bin (null) Mount-bind /run/firejail/mnt/bin on top of /usr/local/bin Mount-bind /run/firejail/mnt/bin on top of /usr/bin Mount-bind /run/firejail/mnt/bin on top of /bin Mount-bind /run/firejail/mnt/bin on top of /usr/games Mount-bind /run/firejail/mnt/bin on top of /usr/local/games Mount-bind /run/firejail/mnt/bin on top of /usr/local/sbin Mount-bind /run/firejail/mnt/bin on top of /usr/sbin Mount-bind /run/firejail/mnt/bin on top of /sbin 15 programs installed in 574.38 ms Generate private-tmp whitelist commands Mounting read-only /proc/sys Remounting /sys directory Disable /sys/firmware Disable /sys/hypervisor Disable /sys/power Disable /sys/kernel/debug Disable /sys/kernel/vmcoreinfo Disable /proc/sys/fs/binfmt_misc Disable /proc/sys/kernel/core_pattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/vm/panic_on_oom Disable /proc/irq Disable /proc/bus Disable /proc/sched_debug Disable /proc/timer_list Disable /proc/kcore Disable /proc/kallsyms Disable /lib/modules Disable /usr/lib/debug Disable /boot Disable /run/user/1000/gnupg Disable /run/user/1000/systemd Disable /proc/kmsg Debug 423: new_name #/home/user/.config/discord#, whitelist Debug 531: fname #/home/user/.config/discord#, cfg.homedir #/home/user# Replaced whitelist path: whitelist /home/user/.config/discord Directory ${DOWNLOADS} resolved as Downloads Debug 423: new_name #/home/user/Downloads#, whitelist Debug 531: fname #/home/user/Downloads#, cfg.homedir #/home/user# Replaced whitelist path: whitelist /home/user/Downloads Debug 423: new_name #/tmp/.X11-unix#, whitelist Debug 423: new_name #/tmp/pulse-PKdhtXMmr18n#, whitelist Mounting tmpfs on /tmp directory Drop privileges: pid 25, uid 1000, gid 1000, nogroups 0 Warning: cleaning all supplementary groups Mounting a new /home directory Mounting a new /root directory Create a new user directory Drop privileges: pid 26, uid 1000, gid 1000, nogroups 0 Warning: cleaning all supplementary groups Whitelisting /home/user/.config/discord 711 709 253:1 /home/user/.config/discord /home/user/.config/discord rw,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix mountid=711 fsname=/home/user/.config/discord dir=/home/user/.config/discord fstype=f2fs Whitelisting /home/user/Downloads 712 709 253:1 /home/user/Downloads /home/user/Downloads rw,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix mountid=712 fsname=/home/user/Downloads dir=/home/user/Downloads fstype=f2fs Whitelisting /tmp/.X11-unix 713 707 0:43 /.X11-unix /tmp/.X11-unix rw,nosuid,noatime master:31 - tmpfs tmpfs rw mountid=713 fsname=/.X11-unix dir=/tmp/.X11-unix fstype=tmpfs Whitelisting /tmp/pulse-PKdhtXMmr18n 714 707 0:43 /pulse-PKdhtXMmr18n /tmp/pulse-PKdhtXMmr18n rw,nosuid,noatime master:31 - tmpfs tmpfs rw mountid=714 fsname=/pulse-PKdhtXMmr18n dir=/tmp/pulse-PKdhtXMmr18n fstype=tmpfs Mounting read-only /home/user/.Xauthority 717 709 0:113 /user/.Xauthority /home/user/.Xauthority ro,nosuid,nodev,noexec - tmpfs tmpfs rw,mode=755 mountid=717 fsname=/user/.Xauthority dir=/home/user/.Xauthority fstype=tmpfs Disable /var/lib/systemd Disable /usr/share/applications/veracrypt.desktop Disable /usr/share/pixmaps/veracrypt.xpm Disable /var/cache/apt Disable /var/lib/apt Disable /var/lib/clamav Disable /var/lib/dkms Disable /var/lib/upower Disable /var/mail Disable /var/opt Disable /run/rpcbind.sock (requested /var/run/rpcbind.sock) Disable /var/spool/anacron Disable /var/spool/cron Disable /var/mail (requested /var/spool/mail) Disable /sbin Disable /usr/local/sbin Disable /usr/sbin Disable /usr/lib/virtualbox Disable /usr/share/flatpak Disable /var/lib/flatpak Disable /usr/include Disable /usr/share/java Disable /usr/lib/valgrind Not blacklist /home/user/.config/discord Mounting noexec /home/user/.config/discord 741 711 253:1 /home/user/.config/discord /home/user/.config/discord rw,nosuid,nodev,noexec,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix mountid=741 fsname=/home/user/.config/discord dir=/home/user/.config/discord fstype=f2fs Mounting noexec /home/user/Downloads 742 712 253:1 /home/user/Downloads /home/user/Downloads rw,nosuid,nodev,noexec,noatime master:1 - f2fs /dev/mapper/ssd-rootfs rw,lazytime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,alloc_mode=default,fsync_mode=posix mountid=742 fsname=/home/user/Downloads dir=/home/user/Downloads fstype=f2fs Mounting noexec /tmp 745 743 0:43 /pulse-PKdhtXMmr18n /tmp/pulse-PKdhtXMmr18n rw,nosuid,noatime master:31 - tmpfs tmpfs rw mountid=745 fsname=/pulse-PKdhtXMmr18n dir=/tmp/pulse-PKdhtXMmr18n fstype=tmpfs Mounting noexec /tmp/.X11-unix 746 744 0:43 /.X11-unix /tmp/.X11-unix rw,nosuid,nodev,noexec,noatime master:31 - tmpfs tmpfs rw mountid=746 fsname=/.X11-unix dir=/tmp/.X11-unix fstype=tmpfs Mounting noexec /tmp/pulse-PKdhtXMmr18n 747 745 0:43 /pulse-PKdhtXMmr18n /tmp/pulse-PKdhtXMmr18n rw,nosuid,nodev,noexec,noatime master:31 - tmpfs tmpfs rw mountid=747 fsname=/pulse-PKdhtXMmr18n dir=/tmp/pulse-PKdhtXMmr18n fstype=tmpfs Mounting read-only /tmp/.X11-unix 748 746 0:43 /.X11-unix /tmp/.X11-unix ro,nosuid,nodev,noexec,noatime master:31 - tmpfs tmpfs rw mountid=748 fsname=/.X11-unix dir=/tmp/.X11-unix fstype=tmpfs Disable /sys/fs Disable /sys/module /etc/pulse/client.conf not found Current directory: /home/user DISPLAY=:0 parsed as 0 Install protocol filter: unix,inet,inet6,netlink configuring 16 seccomp entries in /run/firejail/mnt/seccomp/seccomp.protocol sbox run: /usr/lib/x86_64-linux-gnu/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp.protocol (null) Dropping all capabilities Drop privileges: pid 27, uid 1000, gid 1000, nogroups 1 No supplementary groups line OP JT JF K ================================= 0000: 20 00 00 00000004 ld data.architecture 0001: 15 01 00 c000003e jeq ARCH_64 0003 (false 0002) 0002: 06 00 00 7fff0000 ret ALLOW 0003: 20 00 00 00000000 ld data.syscall-number 0004: 15 01 00 00000029 jeq socket 0006 (false 0005) 0005: 06 00 00 7fff0000 ret ALLOW 0006: 20 00 00 00000010 ld data.args[0] 0007: 15 00 01 00000001 jeq 1 0008 (false 0009) 0008: 06 00 00 7fff0000 ret ALLOW 0009: 15 00 01 00000002 jeq 2 000a (false 000b) 000a: 06 00 00 7fff0000 ret ALLOW 000b: 15 00 01 0000000a jeq a 000c (false 000d) 000c: 06 00 00 7fff0000 ret ALLOW 000d: 15 00 01 00000010 jeq 10 000e (false 000f) 000e: 06 00 00 7fff0000 ret ALLOW 000f: 06 00 00 0005005f ret ERRNO(95) configuring 54 seccomp entries in /run/firejail/mnt/seccomp/seccomp.32 sbox run: /usr/lib/x86_64-linux-gnu/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp.32 (null) Dropping all capabilities Drop privileges: pid 28, uid 1000, gid 1000, nogroups 1 No supplementary groups line OP JT JF K ================================= 0000: 20 00 00 00000004 ld data.architecture 0001: 15 01 00 40000003 jeq ARCH_32 0003 (false 0002) 0002: 06 00 00 7fff0000 ret ALLOW 0003: 20 00 00 00000000 ld data.syscall-number 0004: 15 30 00 00000015 jeq 15 0035 (false 0005) 0005: 15 2f 00 00000034 jeq 34 0035 (false 0006) 0006: 15 2e 00 0000001a jeq 1a 0035 (false 0007) 0007: 15 2d 00 0000011b jeq 11b 0035 (false 0008) 0008: 15 2c 00 00000155 jeq 155 0035 (false 0009) 0009: 15 2b 00 00000156 jeq 156 0035 (false 000a) 000a: 15 2a 00 0000007f jeq 7f 0035 (false 000b) 000b: 15 29 00 00000080 jeq 80 0035 (false 000c) 000c: 15 28 00 0000015e jeq 15e 0035 (false 000d) 000d: 15 27 00 00000081 jeq 81 0035 (false 000e) 000e: 15 26 00 0000006e jeq 6e 0035 (false 000f) 000f: 15 25 00 00000065 jeq 65 0035 (false 0010) 0010: 15 24 00 00000121 jeq 121 0035 (false 0011) 0011: 15 23 00 00000057 jeq 57 0035 (false 0012) 0012: 15 22 00 00000073 jeq 73 0035 (false 0013) 0013: 15 21 00 00000067 jeq 67 0035 (false 0014) 0014: 15 20 00 0000015b jeq 15b 0035 (false 0015) 0015: 15 1f 00 0000015c jeq 15c 0035 (false 0016) 0016: 15 1e 00 00000087 jeq 87 0035 (false 0017) 0017: 15 1d 00 00000095 jeq 95 0035 (false 0018) 0018: 15 1c 00 0000007c jeq 7c 0035 (false 0019) 0019: 15 1b 00 00000157 jeq 157 0035 (false 001a) 001a: 15 1a 00 000000fd jeq fd 0035 (false 001b) 001b: 15 19 00 00000150 jeq 150 0035 (false 001c) 001c: 15 18 00 00000152 jeq 152 0035 (false 001d) 001d: 15 17 00 0000015d jeq 15d 0035 (false 001e) 001e: 15 16 00 0000011e jeq 11e 0035 (false 001f) 001f: 15 15 00 0000011f jeq 11f 0035 (false 0020) 0020: 15 14 00 00000120 jeq 120 0035 (false 0021) 0021: 15 13 00 00000056 jeq 56 0035 (false 0022) 0022: 15 12 00 00000033 jeq 33 0035 (false 0023) 0023: 15 11 00 0000007b jeq 7b 0035 (false 0024) 0024: 15 10 00 000000d9 jeq d9 0035 (false 0025) 0025: 15 0f 00 000000f5 jeq f5 0035 (false 0026) 0026: 15 0e 00 000000f6 jeq f6 0035 (false 0027) 0027: 15 0d 00 000000f7 jeq f7 0035 (false 0028) 0028: 15 0c 00 000000f8 jeq f8 0035 (false 0029) 0029: 15 0b 00 000000f9 jeq f9 0035 (false 002a) 002a: 15 0a 00 00000101 jeq 101 0035 (false 002b) 002b: 15 09 00 00000112 jeq 112 0035 (false 002c) 002c: 15 08 00 00000114 jeq 114 0035 (false 002d) 002d: 15 07 00 00000126 jeq 126 0035 (false 002e) 002e: 15 06 00 0000013d jeq 13d 0035 (false 002f) 002f: 15 05 00 0000013c jeq 13c 0035 (false 0030) 0030: 15 04 00 0000003d jeq 3d 0035 (false 0031) 0031: 15 03 00 00000058 jeq 58 0035 (false 0032) 0032: 15 02 00 000000a9 jeq a9 0035 (false 0033) 0033: 15 01 00 00000082 jeq 82 0035 (false 0034) 0034: 06 00 00 7fff0000 ret ALLOW 0035: 06 00 00 00000000 ret KILL Dual 32/64 bit seccomp filter configured configuring 72 seccomp entries in /run/firejail/mnt/seccomp/seccomp sbox run: /usr/lib/x86_64-linux-gnu/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp (null) Dropping all capabilities Drop privileges: pid 29, uid 1000, gid 1000, nogroups 1 No supplementary groups line OP JT JF K ================================= 0000: 20 00 00 00000004 ld data.architecture 0001: 15 01 00 c000003e jeq ARCH_64 0003 (false 0002) 0002: 06 00 00 7fff0000 ret ALLOW 0003: 20 00 00 00000000 ld data.syscall-number 0004: 35 01 00 40000000 jge X32_ABI 0006 (false 0005) 0005: 35 01 00 00000000 jge read 0007 (false 0006) 0006: 06 00 00 00050001 ret ERRNO(1) 0007: 15 3f 00 0000009f jeq adjtimex 0047 (false 0008) 0008: 15 3e 00 00000131 jeq clock_adjtime 0047 (false 0009) 0009: 15 3d 00 000000e3 jeq clock_settime 0047 (false 000a) 000a: 15 3c 00 000000a4 jeq settimeofday 0047 (false 000b) 000b: 15 3b 00 0000009a jeq modify_ldt 0047 (false 000c) 000c: 15 3a 00 000000d4 jeq lookup_dcookie 0047 (false 000d) 000d: 15 39 00 0000012a jeq perf_event_open 0047 (false 000e) 000e: 15 38 00 00000137 jeq process_vm_writev 0047 (false 000f) 000f: 15 37 00 000000b0 jeq delete_module 0047 (false 0010) 0010: 15 36 00 00000139 jeq finit_module 0047 (false 0011) 0011: 15 35 00 000000af jeq init_module 0047 (false 0012) 0012: 15 34 00 0000009c jeq _sysctl 0047 (false 0013) 0013: 15 33 00 000000b7 jeq afs_syscall 0047 (false 0014) 0014: 15 32 00 000000ae jeq create_module 0047 (false 0015) 0015: 15 31 00 000000b1 jeq get_kernel_syms 0047 (false 0016) 0016: 15 30 00 000000b5 jeq getpmsg 0047 (false 0017) 0017: 15 2f 00 000000b6 jeq putpmsg 0047 (false 0018) 0018: 15 2e 00 000000b2 jeq query_module 0047 (false 0019) 0019: 15 2d 00 000000b9 jeq security 0047 (false 001a) 001a: 15 2c 00 0000008b jeq sysfs 0047 (false 001b) 001b: 15 2b 00 000000b8 jeq tuxcall 0047 (false 001c) 001c: 15 2a 00 00000086 jeq uselib 0047 (false 001d) 001d: 15 29 00 00000088 jeq ustat 0047 (false 001e) 001e: 15 28 00 000000ec jeq vserver 0047 (false 001f) 001f: 15 27 00 000000ad jeq ioperm 0047 (false 0020) 0020: 15 26 00 000000ac jeq iopl 0047 (false 0021) 0021: 15 25 00 000000f6 jeq kexec_load 0047 (false 0022) 0022: 15 24 00 00000140 jeq kexec_file_load 0047 (false 0023) 0023: 15 23 00 000000a9 jeq reboot 0047 (false 0024) 0024: 15 22 00 000000a7 jeq swapon 0047 (false 0025) 0025: 15 21 00 000000a8 jeq swapoff 0047 (false 0026) 0026: 15 20 00 00000130 jeq open_by_handle_at 0047 (false 0027) 0027: 15 1f 00 0000012f jeq name_to_handle_at 0047 (false 0028) 0028: 15 1e 00 000000fb jeq ioprio_set 0047 (false 0029) 0029: 15 1d 00 00000067 jeq syslog 0047 (false 002a) 002a: 15 1c 00 0000012c jeq fanotify_init 0047 (false 002b) 002b: 15 1b 00 00000138 jeq kcmp 0047 (false 002c) 002c: 15 1a 00 000000f8 jeq add_key 0047 (false 002d) 002d: 15 19 00 000000f9 jeq request_key 0047 (false 002e) 002e: 15 18 00 000000ed jeq mbind 0047 (false 002f) 002f: 15 17 00 00000100 jeq migrate_pages 0047 (false 0030) 0030: 15 16 00 00000117 jeq move_pages 0047 (false 0031) 0031: 15 15 00 000000fa jeq keyctl 0047 (false 0032) 0032: 15 14 00 000000ce jeq io_setup 0047 (false 0033) 0033: 15 13 00 000000cf jeq io_destroy 0047 (false 0034) 0034: 15 12 00 000000d0 jeq io_getevents 0047 (false 0035) 0035: 15 11 00 000000d1 jeq io_submit 0047 (false 0036) 0036: 15 10 00 000000d2 jeq io_cancel 0047 (false 0037) 0037: 15 0f 00 000000d8 jeq remap_file_pages 0047 (false 0038) 0038: 15 0e 00 00000143 jeq userfaultfd 0047 (false 0039) 0039: 15 0d 00 000000a3 jeq acct 0047 (false 003a) 003a: 15 0c 00 00000141 jeq bpf 0047 (false 003b) 003b: 15 0b 00 000000a1 jeq chroot 0047 (false 003c) 003c: 15 0a 00 000000a5 jeq mount 0047 (false 003d) 003d: 15 09 00 000000b4 jeq nfsservctl 0047 (false 003e) 003e: 15 08 00 0000009b jeq pivot_root 0047 (false 003f) 003f: 15 07 00 000000ab jeq setdomainname 0047 (false 0040) 0040: 15 06 00 000000aa jeq sethostname 0047 (false 0041) 0041: 15 05 00 000000a6 jeq umount2 0047 (false 0042) 0042: 15 04 00 00000099 jeq vhangup 0047 (false 0043) 0043: 15 03 00 00000065 jeq ptrace 0047 (false 0044) 0044: 15 02 00 00000087 jeq personality 0047 (false 0045) 0045: 15 01 00 00000136 jeq process_vm_readv 0047 (false 0046) 0046: 06 00 00 7fff0000 ret ALLOW 0047: 06 00 01 00000000 ret KILL seccomp filter configured Mounting read-only /run/firejail/mnt/seccomp Dropping all capabilities noroot user namespace installed Dropping all capabilities NO_NEW_PRIVS set Drop privileges: pid 1, uid 1000, gid 1000, nogroups 1 No supplementary groups starting application LD_PRELOAD=(null) Running 'discord' command through /bin/bash execvp argument 0: /bin/bash execvp argument 1: -c execvp argument 2: 'discord' Child process initialized in 283.51 ms Installing /run/firejail/mnt/seccomp/seccomp seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter monitoring pid 30 Sandbox monitor: waitpid 30 retval 30 status 5 Sandbox monitor: monitoring 33 monitoring pid 33 Sandbox monitor: waitpid 33 retval 33 status 31 Parent is shutting down, bye... ``` </details>
gitea-mirror commented 2026-05-05 08:58:32 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Sep 18, 2020):

Likely a duplicate, can you check other issues.

#2946, #3589, #3528, #3328, #3247, #3260, #2878, #3448, #2547, #2518

<!-- gh-comment-id:694925749 --> @rusty-snake commented on GitHub (Sep 18, 2020): Likely a duplicate, can you check other issues. #2946, #3589, #3528, #3328, #3247, #3260, #2878, #3448, #2547, #2518
gitea-mirror commented 2026-05-05 08:58:34 -06:00
Author
Owner
Copy link

@ScoreUnder commented on GitHub (Oct 13, 2020):

For a workaround, you can copy /etc/firejail/discord-common.profile to ~/.config/firejail/ and comment out the seccomp line, and discord should be able to start up again.

While you're at it, you may or may not also want to comment out the "novideo" line if you want to use your webcam in discord.

Bear in mind that, of course, both of these things will be less secure than the original profile. But it's still more secure than running discord unprotected, so I think it's an acceptable workaround if you're running it either way.

<!-- gh-comment-id:707844306 --> @ScoreUnder commented on GitHub (Oct 13, 2020): For a workaround, you can copy `/etc/firejail/discord-common.profile` to `~/.config/firejail/` and comment out the `seccomp` line, and discord should be able to start up again. While you're at it, you may or may not also want to comment out the "novideo" line if you want to use your webcam in discord. Bear in mind that, of course, both of these things will be less secure than the original profile. But it's still more secure than running discord unprotected, so I think it's an acceptable workaround if you're running it either way.
gitea-mirror commented 2026-05-05 08:58:35 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Oct 13, 2020):

For a workaround, you can copy /etc/firejail/discord-common.profile to ~/.config/firejail/ and comment out the seccomp line, and discord should be able to start up again.

two remarks

  1. Using locals is in general better/easier the coping profiles. Just create ~/.config/firejail/discord-common.local and add ignore seccomp and ignore novideo.
  2. Usually it is overkill to comment/ignore seccomp. In the most cases it is enough to whitelist one syscall. Here it is likely chroot (see upstream profile).

d08fb3b5db/etc/templates/syscalls.txt (L89-L106)

While you're at it, you may or may not also want to comment out the "novideo" line if you want to use your webcam in discord.

Would you suggest to remove it upstream?

<!-- gh-comment-id:707852213 --> @rusty-snake commented on GitHub (Oct 13, 2020): > For a workaround, you can copy /etc/firejail/discord-common.profile to ~/.config/firejail/ and comment out the seccomp line, and discord should be able to start up again. two remarks 1. Using locals is in general better/easier the coping profiles. Just create `~/.config/firejail/discord-common.local` and add `ignore seccomp` and `ignore novideo`. 2. Usually it is overkill to comment/ignore seccomp. In the most cases it is enough to whitelist one syscall. Here it is likely chroot (see upstream profile). https://github.com/netblue30/firejail/blob/d08fb3b5db4ece842a2702b6d55232046a23af1c/etc/templates/syscalls.txt#L89-L106 > While you're at it, you may or may not also want to comment out the "novideo" line if you want to use your webcam in discord. Would you suggest to remove it upstream?
gitea-mirror commented 2026-05-05 08:58:36 -06:00
Author
Owner
Copy link

@rydalt commented on GitHub (Oct 13, 2020):

It was chroot. seccomp !chroot fixes it, at least on Arch Linux. I'll try it on my OpenSUSE machine later today, if I don't comment then it works there too.

Oct 13 12:42:34 hostname kernel: audit: type=1326 audit(1602607354.844:329): auid=1000 uid=1000 gid=1000 ses=3 subj==unconfined pid=15674 comm="Discord" exe="/opt/discord/Discord" sig=31 arch=c000003e syscall=161 compat=0 ip=0x7fa97e9d8d5d code=0x0
Oct 13 12:42:34 hostname audit[15674]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3 subj==unconfined pid=15674 comm="Discord" exe="/opt/discord/Discord" sig=31 arch=c000003e syscall=161 compat=0 ip=0x7fa97e9d8d5d code=0x0
Oct 13 12:42:35 hostname systemd-coredump[15676]: [🡕] Process 15674 (Discord) of user 1000 dumped core.

    Stack trace of thread 2:
    #0  0x00007fa97e9d8d5d syscall (libc.so.6 + 0xfad5d)
    #1  0x00005588e3974280 n/a (Discord + 0x4aba280)
    #2  0x00007fa97e9de293 __clone (libc.so.6 + 0x100293)

    Stack trace of thread 1:
    #0  0x00007fa97e9de285 __clone (libc.so.6 + 0x100285)
    #1  0x00005588e396c9f6 n/a (Discord + 0x4ab29f6)
    #2  0x00005588e396c999 n/a (Discord + 0x4ab2999)
    #3  0x00005588e39e958e n/a (Discord + 0x4b2f58e)
    #4  0x00005588e1c3497e n/a (Discord + 0x2d7a97e)
    #5  0x00005588e1c35d94 n/a (Discord + 0x2d7bd94)
    #6  0x00005588e39edb4c n/a (Discord + 0x4b33b4c)
    #7  0x00005588e0f08811 n/a (Discord + 0x204e811)
    #8  0x00005588e04cf27b n/a (Discord + 0x161527b)
    #9  0x00007fa97e906152 __libc_start_main (libc.so.6 + 0x28152)
    #10 0x00005588e04cf02a _start (Discord + 0x161502a)

And on the topic of webcams, it depends on upsteam's policy about breaking functionality in software. Personally, I prefer that discord can't use my webcam by default if I make the effort to run it in firejail, but technically it's supposed to be able to and I'm equally capable of blocking it from using my webcam myself.

<!-- gh-comment-id:707875600 --> @rydalt commented on GitHub (Oct 13, 2020): It was chroot. `seccomp !chroot` fixes it, at least on Arch Linux. I'll try it on my OpenSUSE machine later today, if I don't comment then it works there too. ``` Oct 13 12:42:34 hostname kernel: audit: type=1326 audit(1602607354.844:329): auid=1000 uid=1000 gid=1000 ses=3 subj==unconfined pid=15674 comm="Discord" exe="/opt/discord/Discord" sig=31 arch=c000003e syscall=161 compat=0 ip=0x7fa97e9d8d5d code=0x0 Oct 13 12:42:34 hostname audit[15674]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3 subj==unconfined pid=15674 comm="Discord" exe="/opt/discord/Discord" sig=31 arch=c000003e syscall=161 compat=0 ip=0x7fa97e9d8d5d code=0x0 Oct 13 12:42:35 hostname systemd-coredump[15676]: [🡕] Process 15674 (Discord) of user 1000 dumped core. Stack trace of thread 2: #0 0x00007fa97e9d8d5d syscall (libc.so.6 + 0xfad5d) #1 0x00005588e3974280 n/a (Discord + 0x4aba280) #2 0x00007fa97e9de293 __clone (libc.so.6 + 0x100293) Stack trace of thread 1: #0 0x00007fa97e9de285 __clone (libc.so.6 + 0x100285) #1 0x00005588e396c9f6 n/a (Discord + 0x4ab29f6) #2 0x00005588e396c999 n/a (Discord + 0x4ab2999) #3 0x00005588e39e958e n/a (Discord + 0x4b2f58e) #4 0x00005588e1c3497e n/a (Discord + 0x2d7a97e) #5 0x00005588e1c35d94 n/a (Discord + 0x2d7bd94) #6 0x00005588e39edb4c n/a (Discord + 0x4b33b4c) #7 0x00005588e0f08811 n/a (Discord + 0x204e811) #8 0x00005588e04cf27b n/a (Discord + 0x161527b) #9 0x00007fa97e906152 __libc_start_main (libc.so.6 + 0x28152) #10 0x00005588e04cf02a _start (Discord + 0x161502a) ``` And on the topic of webcams, it depends on upsteam's policy about breaking functionality in software. Personally, I prefer that discord can't use my webcam by default if I make the effort to run it in firejail, but technically it's supposed to be able to and I'm equally capable of blocking it from using my webcam myself.
gitea-mirror commented 2026-05-05 08:58:37 -06:00
Author
Owner
Copy link

@ScoreUnder commented on GitHub (Oct 13, 2020):

@rusty-snake thanks for the info, I didn't know about either of those (in fact I was despairing because there seemed to be no antonym to novideo, and the .local files are included before the rest of the profile, which in most other programs means they have lower priority).

I used ptrace to figure out the syscalls it makes and used the journalctl method you mentioned to find out the missing ones (somehow ptrace doesn't get them all?), and ended up with this:

seccomp.keep futex,epoll_wait,wait4,poll,stat,read,recvmsg,restart_syscall,select,close,sendto,madvise,write,getpid,openat,ioctl,clock_nanosleep,getuid,geteuid,getgid,getegid,mmap,mprotect,munmap,fallocate,pselect6,mkdir,writev,fdatasync,fcntl,sched_yield,fstat,clone,pread64,memfd_create,access,fstatfs,sendmsg,execve,fadvise64,dup,getdents64,lstat,rt_sigprocmask,clock_gettime,ppoll,unlink,ftruncate,readlink,rename,statx,pwrite64,epoll_ctl,mincore,prctl,set_robust_list,setpriority,recvfrom,gettid,brk,socketpair,rt_sigaction,socket,rt_sigreturn,sigaltstack,vfork,connect,lseek,pipe,prlimit64,seccomp,getsockopt,getgroups,inotify_add_watch,getsockname,pipe2,uname,epoll_create,arch_prctl,setsockopt,getrandom,dup2,newfstatat,statfs,sysinfo,sched_setscheduler,set_tid_address,getppid,bind,getpriority,kill,waitid,eventfd2,getpgrp,sched_get_priority_min,sched_setattr,getresuid,creat,shutdown,inotify_init,sched_get_priority_max,rmdir,getpeername,epoll_create1,umask,shmat,sched_getscheduler,shmget,sched_getaffinity,getresgid,sched_getparam,shmdt,shmctl,sched_getattr,capset,fchmod,capget,listen,getcwd,chdir,symlink,chroot,unshare,dup3,exit_group,chmod,exit,inotify_init1,inotify_rm_watch

Probably overkill if you're just blacklisting but maybe it's worth something to someone. (edit: added inotify for file dialog)

<!-- gh-comment-id:707881922 --> @ScoreUnder commented on GitHub (Oct 13, 2020): @rusty-snake thanks for the info, I didn't know about either of those (in fact I was despairing because there seemed to be no antonym to `novideo`, and the `.local` files are included before the rest of the profile, which in most other programs means they have lower priority). I used ptrace to figure out the syscalls it makes and used the journalctl method you mentioned to find out the missing ones (somehow ptrace doesn't get them all?), and ended up with this: ``` seccomp.keep futex,epoll_wait,wait4,poll,stat,read,recvmsg,restart_syscall,select,close,sendto,madvise,write,getpid,openat,ioctl,clock_nanosleep,getuid,geteuid,getgid,getegid,mmap,mprotect,munmap,fallocate,pselect6,mkdir,writev,fdatasync,fcntl,sched_yield,fstat,clone,pread64,memfd_create,access,fstatfs,sendmsg,execve,fadvise64,dup,getdents64,lstat,rt_sigprocmask,clock_gettime,ppoll,unlink,ftruncate,readlink,rename,statx,pwrite64,epoll_ctl,mincore,prctl,set_robust_list,setpriority,recvfrom,gettid,brk,socketpair,rt_sigaction,socket,rt_sigreturn,sigaltstack,vfork,connect,lseek,pipe,prlimit64,seccomp,getsockopt,getgroups,inotify_add_watch,getsockname,pipe2,uname,epoll_create,arch_prctl,setsockopt,getrandom,dup2,newfstatat,statfs,sysinfo,sched_setscheduler,set_tid_address,getppid,bind,getpriority,kill,waitid,eventfd2,getpgrp,sched_get_priority_min,sched_setattr,getresuid,creat,shutdown,inotify_init,sched_get_priority_max,rmdir,getpeername,epoll_create1,umask,shmat,sched_getscheduler,shmget,sched_getaffinity,getresgid,sched_getparam,shmdt,shmctl,sched_getattr,capset,fchmod,capget,listen,getcwd,chdir,symlink,chroot,unshare,dup3,exit_group,chmod,exit,inotify_init1,inotify_rm_watch ``` Probably overkill if you're just blacklisting but maybe it's worth something to someone. (edit: added inotify for file dialog)
gitea-mirror commented 2026-05-05 08:58:37 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Oct 13, 2020):

And on the topic of webcams, it depends on upsteam's policy about breaking functionality in software. Personally, I prefer that discord can't use my webcam by default if I make the effort to run it in firejail, but technically it's supposed to be able to and I'm equally capable of blocking it from using my webcam myself.

Mostly a balance between security and usability.
Security:

  • how big is the security impact if we allow/block something
  • vulnerability (has it internet access, ...)
    Usability
  • is it a main feature or just a edge feature
  • are there alternatives (in the program)
  • how likely is it used

I would allow it as it is main-feature (as I understand) and camera should be blocked some higher (HW, BIOS, kernel) IMHO. Users can still block it.

because there seemed to be no antonym to novideo

yes, firejail does the most with ignore <line>

which in most other programs means they have lower priority

That's even trickier because some options have a last-will-win and some a firts-will-win.

Probably overkill if you're just blacklisting but maybe it's worth something to someone.

The issue with seccomp.keep is that it is likely to fail on new versions (binary and libraries) or different distros. However it works fine if added to locals. You can use syscalls.sh to easily generate it or most of your programs.

<!-- gh-comment-id:707911712 --> @rusty-snake commented on GitHub (Oct 13, 2020): > And on the topic of webcams, it depends on upsteam's policy about breaking functionality in software. Personally, I prefer that discord can't use my webcam by default if I make the effort to run it in firejail, but technically it's supposed to be able to and I'm equally capable of blocking it from using my webcam myself. Mostly a balance between security and usability. Security: - how big is the security impact if we allow/block something - vulnerability (has it internet access, ...) Usability - is it a main feature or just a edge feature - are there alternatives (in the program) - how likely is it used I would allow it as it is main-feature (as I understand) and camera should be blocked some higher (HW, BIOS, kernel) IMHO. Users can still block it. > because there seemed to be no antonym to novideo yes, firejail does the most with `ignore <line>` > which in most other programs means they have lower priority That's even trickier because some options have a last-will-win and some a firts-will-win. > Probably overkill if you're just blacklisting but maybe it's worth something to someone. The issue with `seccomp.keep` is that it is likely to fail on new versions (binary and libraries) or different distros. However it works fine if added to locals. You can use [syscalls.sh](https://github.com/netblue30/firejail/blob/master/contrib/syscalls.sh) to easily generate it or most of your programs.
gitea-mirror commented 2026-05-05 08:58:38 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 9, 2020):

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

<!-- gh-comment-id:724209648 --> @rusty-snake commented on GitHub (Nov 9, 2020): I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2286
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?