mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3697] Need help for spectacle's profile #2329
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2329
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @CodeArtisan00 on GitHub (Oct 25, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3697
here's my spectacle profile (with some problems)
it's taking screenshot as it should but having some benign problems.
Couldn't start kglobalaccel from org.kde.kglobalaccel.service: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown")- this could be resolved bydbus-user.talk org.kde.kglobalaccelbut if autosave is on then it also shows
Couldn't start kuiserver from org.kde.kuiserver.service: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown")- which I still haven't been able to resolve.inside of firejail, spectacle can't save any changed config & it shows
kf.config.core: Couldn't write "/home/arx/.config/spectaclerc" . Disk full?- don't know how to resolve this one also.In pic1 clicking on 'open containing folder' shows pic2 instead of the folder.
apart from config issue rest of these issues can be resolved by not using
dbus-user filter. So using justdbus-system nonecan resolve this annoying issues.@rusty-snake commented on GitHub (Oct 26, 2020):
The D-Bus issues can be solved by adding
dbus-user.talkrules.The config issue is likely #1793.
@CodeArtisan00 commented on GitHub (Oct 26, 2020):
so regarding config issue,there's no hope.
& regarding
dbus-user.talkrules, which portals should I allow?@CodeArtisan00 commented on GitHub (Oct 26, 2020):
regarding config issue,just ran a
firejail --tracefor spectacle & noticed spectacle creates some sorta tmp files in~/.config. here's the name of those filesspectaclerc.lock,spectaclerc.csEzzf,spectaclerc.SQLdit-this is inside firejail's sandbox.when I ran
firejail --noprofile, there was just onlyspectaclerc.lock.But problem is that file is not there when the sandbox is starting.So I don't think regular blacklist/whitelist will have any effect on it.
is there anyway to allow
firejailto add that file at the beginning then after whitelisting & blacklisting all the paths, remove that particular file?@rusty-snake commented on GitHub (Oct 26, 2020):
I've no experience with the D-Bus service from KDE, so I can't help you here.
regarding the config file: The issue is that whitelisted files can not be renamed (#2874). That's a technical limitation from bind mounting. However you can rename files inside a whielisted directory. So I just had the idea for a workaround using
XDG_CONFIG_HOME.What happens if you add
(IDK if $HOME works inside XDG_CONFIG_HOME)
@CodeArtisan00 commented on GitHub (Oct 26, 2020):
yes. change in config persists. . so you have changed base directory, I mean you have changed
{HOME}/.configto{HOME}/.config/spectaclefor spectacle only. How other files & folders will be whitelisted which are in{HOME}/.config? will symlink work?@rusty-snake commented on GitHub (Oct 26, 2020):
ln -s ../foo .config/spectacle/fooandwhitelist ${HOME}/.config/fooshould work.@CodeArtisan00 commented on GitHub (Oct 26, 2020):
yea, symlink works.
apart from
spectaclerc, every other needed files'/folders' symlink workeddidn't get the renaming part? I was talking about adding
spectaclerc.lockat the beginning of starting the sandbox & then after creating whitelisting & blacklisting, remove thatspectaclerc.lock. No need for other files or renaming. If after allowingspectaclerc.lock, spectacle still needs to create thosespectaclerc.randomletterthen obviously that method won't work.@rusty-snake commented on GitHub (Oct 26, 2020):
specracle (or kde and some others in general) try to write such files safe againt crashes.
@CodeArtisan00 commented on GitHub (Oct 28, 2020):
this is resolved by
dbus-user.talk org.kde.JobViewServerthis can be resolved by
dbus-user.talk org.freedesktop.FileManager1. One problem though this only works if one instance of dolphin is already on.@CodeArtisan00 commented on GitHub (Oct 29, 2020):
well. it works. I just had
blacklist /run/dbusinglobals.local.my current spectacle profile is
does it look good or should I change something?
@rusty-snake commented on GitHub (Oct 29, 2020):
I made a draft to bring it upstream. Assuming it does not need internet access and all the dbus-user.talk rules are required.
netfilter->net noneprotocol unixprivate-etcremoveca-certificates,crypto-policies,pki,resolv.conf,sslipc-namespaceapparmor,machine-idwhitelist ${PICTURES}@CodeArtisan00 commented on GitHub (Oct 30, 2020):
a bit busy lately, sorry for the delay.
for normal functioning it doesn't need internet but it has a sharing feature.& for that it needs internet & kipi plugins & probably some other
dbus-user.talkrules. At this moment I don't have kipi plugins installed on my system.required rules are
what is the implication of having it & not having it? just curious to know. I thought security wise it would be better having it.
@rusty-snake commented on GitHub (Oct 31, 2020):
so the other ones are for what?
It breaks some X11-extensions which can make graphic issues (shadows, ...) or performance lost. So upstram policy is to not add it no GUI profiles. However it works fine under Wayland and sometime under Xorg (Arch Linux + Xorg works always AFAIK). I have it in my globals.local and have no issues apart from black-borders around pop-ups in Tor-Browser.
@CodeArtisan00 commented on GitHub (Nov 1, 2020):
I added those at that time as spectacle was showing errors regarding those but after seeing your profile I was looking for some documentation of those
dbus-user.talkrules.org.kde.kglobalaccel
KGlobalAccel - in case of
kdeconnectit controls volume. It looks like kglobalaccel makes use of some sorta special shortcuts. but in the context of spectacle,I don't know what exactly it does.org.kde.JobViewServer & org.kde.kuiserver
it seems these two are intertwined in some manner.
JobViewServeris needed to see the progress of jobs in the notification are. In case ofkuiserverI'm a bit confused. Need to go through some relevant documentation. By looking at some random post,it seemskuiserveralso tracks job progression. But whether it does that through its own api or viaJobViewServerapi is not clear to me. In case of, plasma-integration for firefox I had to allow both of these otherwise it was not showing anything in the notification area. So,my guess is that both of these are needed for proper functioning of that feature.But, spectacle doesn't seem to need that in my usecase.Moreover I don't see breakage if I don't allow any of these but there are these error messages
Couldn't start kglobalaccel from org.kde.kglobalaccel.service: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown")Couldn't start kuiserver from org.kde.kuiserver.service: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown")- this one I get if I enable autosave.If someone in future reports any breakage, then we can start from these two.
@rusty-snake commented on GitHub (Nov 1, 2020):
If it works w/o them, I would say we add them commented. Would you like to create a PR.
what's left:
@CodeArtisan00 commented on GitHub (Nov 1, 2020):
ok...doing that.