github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3635] [mpv] "Running subprocess failed: init" when trying to execute script in ~/bin #2287

New issue

Closed

opened 2026-05-05 08:58:39 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 08:58:39 -06:00

Owner

Originally created by @rieje on GitHub (Sep 19, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3635

Bug and expected behavior

Fail to execute simple sh script at ~/bin/mpv-testme bound to a key in mpv--error "Running subprocess failed: init" from mpv on each attempted invocation.

What did you expect to happen?

Execute script that simply does a notify-send "testme".

No profile or disabling firejail

What changed calling firejail --noprofile PROGRAM in a shell?

Script gets executed as expected--I get a notify-send notification.

Reproduce
Steps to reproduce the behavior:

Create script in ~/bin/mpv-testme with content and make it executable:

#!/usr/bin/sh
notify-send "testme"
In ~/.config/mpv/input.conf, bind the script to the delete key: DEL run "/home/rieje/bin/mpv-testme"
Launch mpv via the terminal, hit the delete guy. Error message prints in the terminal.

Environment

Latest version of Arch Linux, firejail version 0.9.62.4

Additional context

My mpv.profile is the default mpv.profile with the following added:

noblacklist ${PATH}/sh
noblacklist ${PATH}/bash
noblacklist /home/rieje/bin/mpv-testme
noblacklist /usr/bin/notify-send
ignore noexec ${HOME}
private-bin env,mpv,python*,youtube-dl,bash,sh,notify-send,mpv-testme

# instead of 'seccomp', fix for AMD gpu
seccomp !kcmp

Originally created by @rieje on GitHub (Sep 19, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3635 **Bug and expected behavior** Fail to execute simple sh script at `~/bin/mpv-testme` bound to a key in mpv--error "`Running subprocess failed: init`" from mpv on each attempted invocation. - What did you expect to happen? Execute script that simply does a `notify-send "testme".` **No profile or disabling firejail** - What changed calling `firejail --noprofile PROGRAM` in a shell? Script gets executed as expected--I get a notify-send notification. **Reproduce** Steps to reproduce the behavior: 1. Create script in ~/bin/mpv-testme with content and make it executable: #!/usr/bin/sh notify-send "testme" 2. In ~/.config/mpv/input.conf, bind the script to the delete key: `DEL run "/home/rieje/bin/mpv-testme"` 3. Launch mpv via the terminal, hit the delete guy. Error message prints in the terminal. **Environment** - Latest version of Arch Linux, firejail version 0.9.62.4 **Additional context** My mpv.profile is the default mpv.profile with the following added: noblacklist ${PATH}/sh noblacklist ${PATH}/bash noblacklist /home/rieje/bin/mpv-testme noblacklist /usr/bin/notify-send ignore noexec ${HOME} private-bin env,mpv,python*,youtube-dl,bash,sh,notify-send,mpv-testme # instead of 'seccomp', fix for AMD gpu seccomp !kcmp

gitea-mirror closed this issue

2026-05-05 08:58:40 -06:00

gitea-mirror commented

2026-05-05 08:58:43 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 21, 2020):

Ok, got it. Use this mpv.local (+ seccomp !kcmp)

# Allow /bin/bash
noblacklist ${PATH}/bash
private-bin bash
# Allow /home/rieje/bin/mpv-testme
whitelist /home/rieje/bin/mpv-testme
# Allow exec in $HOME
ignore noexec ${HOME}
# Allow notify-send
private-bin notify-send
dbus-user filter
dbus-user.talk org.freedesktop.Notifications
ignore dbus-user none

If you use firejail 0.9.62.x, replace the last three lines with ignore nodbus.

@rusty-snake commented on GitHub (Sep 21, 2020): Ok, got it. Use this mpv.local (+ `seccomp !kcmp`) ``` # Allow /bin/bash noblacklist ${PATH}/bash private-bin bash # Allow /home/rieje/bin/mpv-testme whitelist /home/rieje/bin/mpv-testme # Allow exec in $HOME ignore noexec ${HOME} # Allow notify-send private-bin notify-send dbus-user filter dbus-user.talk org.freedesktop.Notifications ignore dbus-user none ``` If you use firejail 0.9.62.x, replace the last three lines with `ignore nodbus`.

gitea-mirror commented

2026-05-05 08:58:44 -06:00

Author

Owner

@rieje commented on GitHub (Sep 21, 2020):

With the changes (seccomp !kcmp + copy/pasting that snippet into my the default mpv.profile that I've copied to ~/.config/firejail and replacing the last 3 lines with ignore nodbus, somehow mpv cannot open a file with the error:

[file] Cannot open file '/home/rieje/videos/file.flv': No such file or directory
Failed to open /home/rieje/videos/file.flv.

Exiting... (Errors when loading file)

If I uncomment whitelist /home/rieje/bin/mpv-testme, I can open the file but continue to receive the error Running subprocess failed: init every time I hit the hotkey bound to the script.

@rieje commented on GitHub (Sep 21, 2020): With the changes (`seccomp !kcmp` + copy/pasting that snippet into my the default mpv.profile that I've copied to `~/.config/firejail` and replacing the last 3 lines with `ignore nodbus`, somehow mpv cannot open a file with the error: [file] Cannot open file '/home/rieje/videos/file.flv': No such file or directory Failed to open /home/rieje/videos/file.flv. Exiting... (Errors when loading file) If I uncomment `whitelist /home/rieje/bin/mpv-testme`, I can open the file but continue to receive the error `Running subprocess failed: init` every time I hit the hotkey bound to the script.

gitea-mirror commented

2026-05-05 08:58:45 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 22, 2020):

You're right, in 0.9.62.x is mpv a blacklisting profile. Can you try to use echo "Hi" instead of notify-send to test and start mpv from a terminal. Also what she-bang has your script?

@rusty-snake commented on GitHub (Sep 22, 2020): You're right, in 0.9.62.x is mpv a blacklisting profile. Can you try to use `echo "Hi"` instead of notify-send to test and start mpv from a terminal. Also what she-bang has your script?

gitea-mirror commented

2026-05-05 08:58:45 -06:00

Author

Owner

@rieje commented on GitHub (Sep 22, 2020):

~/bin/mpv-testme:

#!/usr/bin/bash

echo "hi"
#notify-send "testme"

still results in the same error Running subprocess failed: init. Without firejail, (/usr/bin/mpv ~/videos/video.mp4), uncommenting both commands has echo printing "hi" in terminal and notify-send sending message "testme" as expected.

@rieje commented on GitHub (Sep 22, 2020): `~/bin/mpv-testme`: #!/usr/bin/bash echo "hi" #notify-send "testme" still results in the same error `Running subprocess failed: init`. Without firejail, (`/usr/bin/mpv ~/videos/video.mp4`), uncommenting both commands has echo printing "hi" in terminal and notify-send sending message "testme" as expected.

gitea-mirror commented

2026-05-05 08:58:46 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 6, 2020):

Looks like you need to comment the hole profile and uncomment it line for line to find the problematic line.

@rusty-snake commented on GitHub (Oct 6, 2020): Looks like you need to comment the hole profile and uncomment it line for line to find the problematic line.

gitea-mirror commented

2026-05-05 08:58:46 -06:00

Author

Owner

@rieje commented on GitHub (Oct 7, 2020):

Ok, I finally have some time and did some trial and error. This is what I've found works and all that is necessary:

diff ~/.config/firejail/mpv.profile /etc/firejail/mpv.profile:

24c24
< #include disable-exec.inc
---
> include disable-exec.inc
37c37
< #nodbus
---
> nodbus
44,45c44
< # for AMD gpu--'seccomp' by itself causes mpv not to play video--see https://github.com/netblue30/firejail/issues/3219
< seccomp !kcmp
---
> seccomp
53,55d51
<
< private-bin bash
< private-bin notify-send

< # disable-exec.inc but without 'nexec ${HOME}'
< noexec ${RUNUSER}
< noexec /dev/shm
< noexec /tmp
< noexec /var

\ No newline at end of file

Appreciate your attempt.

@rieje commented on GitHub (Oct 7, 2020): Ok, I finally have some time and did some trial and error. This is what I've found works and all that is necessary: `diff ~/.config/firejail/mpv.profile /etc/firejail/mpv.profile`: ``` 24c24 < #include disable-exec.inc --- > include disable-exec.inc 37c37 < #nodbus --- > nodbus 44,45c44 < # for AMD gpu--'seccomp' by itself causes mpv not to play video--see https://github.com/netblue30/firejail/issues/3219 < seccomp !kcmp --- > seccomp 53,55d51 < < private-bin bash < private-bin notify-send < # disable-exec.inc but without 'nexec ${HOME}' < noexec ${RUNUSER} < noexec /dev/shm < noexec /tmp < noexec /var \ No newline at end of file ``` Appreciate your attempt.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2287

No description provided.

Rows
Columns