github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #3759] thunderbird: cannot open links in Firefox: "Your Firefox profile cannot be loaded" #2373

New issue
Closed
opened 2026-05-05 09:03:14 -06:00 by gitea-mirror · 12 comments
gitea-mirror commented 2026-05-05 09:03:14 -06:00
Owner
Copy link

Originally created by @rsramkis on GitHub (Nov 18, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3759

Bug

When opening a web link in an e-mail in Thunderbird, Firefox attempts to launch but then reports the error "Your Firefox profile cannot be loaded. It may be missing or inaccessible."

Steps:

  1. Open Thunderbird.
  2. Open E-mail.
  3. Click on weblink in e-mail.
  4. Firefox error message shows "Your Firefox profile cannot be loaded. It may be missing or inaccessible.".

Expected Behavior
The previous behavior with firejail enabled (sudo firecfg) a web link in a Thunderbird e-mail would open a new instances of Firefox with a new user profile (none of my bookmarks showing'.

Environment
Kernel: 5.4.74-1-MANJARO x86_64 Up: 1h 07m Mem: 1696.7/11862.6 MiB (14.3%)
Storage: 465.76 GiB (11.4% used) Procs: 197 Shell: Zsh inxi: 3.1.08

Firefox 82.0.3
Thunderbird 68.12.0

Bugs I am trying to find a solution in:

https://github.com/netblue30/firejail/issues/3579
https://github.com/netblue30/firejail/issues/2336
https://github.com/netblue30/firejail/issues/3471#issuecomment-646582480

Originally created by @rsramkis on GitHub (Nov 18, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3759 **Bug** When opening a web link in an e-mail in Thunderbird, Firefox attempts to launch but then reports the error "Your Firefox profile cannot be loaded. It may be missing or inaccessible." Steps: 1. Open Thunderbird. 2. Open E-mail. 3. Click on weblink in e-mail. 4. Firefox error message shows "Your Firefox profile cannot be loaded. It may be missing or inaccessible.". **Expected Behavior** The previous behavior with firejail enabled (sudo firecfg) a web link in a Thunderbird e-mail would open a new instances of Firefox with a new user profile (none of my bookmarks showing'. **Environment** Kernel: 5.4.74-1-MANJARO x86_64 Up: 1h 07m Mem: 1696.7/11862.6 MiB (14.3%) Storage: 465.76 GiB (11.4% used) Procs: 197 Shell: Zsh inxi: 3.1.08 Firefox 82.0.3 Thunderbird 68.12.0 **Bugs I am trying to find a solution in:** https://github.com/netblue30/firejail/issues/3579 https://github.com/netblue30/firejail/issues/2336 https://github.com/netblue30/firejail/issues/3471#issuecomment-646582480
gitea-mirror 2026-05-05 09:03:14 -06:00
gitea-mirror commented 2026-05-05 09:03:17 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 18, 2020):

Firefox must be already running for all of these to work. If firefox is open, it should work out-of-the-box with firejail 0.9.64 and thunderbird.

<!-- gh-comment-id:729613455 --> @rusty-snake commented on GitHub (Nov 18, 2020): Firefox **must** be already running for all of these to work. If firefox is open, it should work out-of-the-box with firejail 0.9.64 and thunderbird.
gitea-mirror commented 2026-05-05 09:03:18 -06:00
Author
Owner
Copy link

@rsramkis commented on GitHub (Nov 18, 2020):

Previously Firefox did not already need to be open. It would spawn its own instance on demand. This was ideal not only for web links in an e-mail but also clicking on links in ebooks.

I already verified that if I open Firefox before hand, then click on link in e-mail in Thunderbird that the link opens correctly.

Do we have documentation which mentions this is the expected behavior? Thanks.

<!-- gh-comment-id:729960282 --> @rsramkis commented on GitHub (Nov 18, 2020): Previously Firefox did not already need to be open. It would spawn its own instance on demand. This was ideal not only for web links in an e-mail but also clicking on links in ebooks. I already verified that if I open Firefox before hand, then click on link in e-mail in Thunderbird that the link opens correctly. Do we have documentation which mentions this is the expected behavior? Thanks.
gitea-mirror commented 2026-05-05 09:03:19 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 19, 2020):

The issue is that firefox then runs inside the other sandbox (e.g. thunderbirds). That something we simply don't support. Since thunderbird and firefox have very similar profiles, it's maybe enough to add whitelist ${HOME}/.mozilla. However some thing will still break in firefox (e.g. web-cam, local documentation, ...) and it's less secure as firefox has full D-Bus access and can read and write in ~/.gnupg.

<!-- gh-comment-id:730297955 --> @rusty-snake commented on GitHub (Nov 19, 2020): The issue is that firefox then runs inside the other sandbox (e.g. thunderbirds). That something we simply don't support. Since thunderbird and firefox have very similar profiles, it's maybe enough to add `whitelist ${HOME}/.mozilla`. However some thing will still break in firefox (e.g. web-cam, local documentation, ...) and it's less secure as firefox has full D-Bus access and can read and write in ~/.gnupg.
gitea-mirror commented 2026-05-05 09:03:20 -06:00
Author
Owner
Copy link

@rsramkis commented on GitHub (Nov 19, 2020):

Thanks for providing your feedback.

Based on your observations, if my default web browser in Gnome was not Firefox but Vivaldi (which does not have a firefox\thunderbird profile), then should my expectation then be that Vivaldi will automatically launch when I click on a link in Thunderbird?

<!-- gh-comment-id:730497472 --> @rsramkis commented on GitHub (Nov 19, 2020): Thanks for providing your feedback. Based on your observations, if my default web browser in Gnome was not Firefox but Vivaldi (which does not have a firefox\thunderbird profile), then should my expectation then be that Vivaldi will automatically launch when I click on a link in Thunderbird?
gitea-mirror commented 2026-05-05 09:03:21 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 19, 2020):

If your default browser is vivaldi/chromium/opera/... this would not work unless you drastically weaken your thunderbird.profile. IDK if/how it works with a running vivaldi/… since I (and the most other firejai users) use firefox.

<!-- gh-comment-id:730508866 --> @rusty-snake commented on GitHub (Nov 19, 2020): If your default browser is vivaldi/chromium/opera/... this would not work unless you drastically weaken your thunderbird.profile. IDK if/how it works with a running vivaldi/… since I (and the most other firejai users) use firefox.
gitea-mirror commented 2026-05-05 09:03:21 -06:00
Author
Owner
Copy link

@rsramkis commented on GitHub (Nov 19, 2020):

Thanks for the information. It does not bother me to manually launch a web browser.

But from a usability stand point I would have bugged this. The competition (Mac OS) does not behave this way and it has some sophisticated Apparmor setup on its own for security. An end user seeing a "no profile" error is misleading. Espcially since it never behaved this way a couple months ago.

Closing this issue.

<!-- gh-comment-id:730514761 --> @rsramkis commented on GitHub (Nov 19, 2020): Thanks for the information. It does not bother me to manually launch a web browser. But from a usability stand point I would have bugged this. The competition (Mac OS) does not behave this way and it has some sophisticated Apparmor setup on its own for security. An end user seeing a "no profile" error is misleading. Espcially since it never behaved this way a couple months ago. Closing this issue.
gitea-mirror commented 2026-05-05 09:03:22 -06:00
Author
Owner
Copy link

@rsramkis commented on GitHub (Nov 19, 2020):

Just noticed something. I ran the following command from terminal to change my default web browser in Gnome to vivaldi:

"xdg-settings set default-web-browser vivaldi-stable.desktop"

Then I rebooted, launched Thunderbird, and clicked on an e-mail which had a web link. Vivaldi launched with no errors in sandbox mode (because it did not show any of my bookmarks). This is exactly how Firefox used to behave.

<!-- gh-comment-id:730531409 --> @rsramkis commented on GitHub (Nov 19, 2020): Just noticed something. I ran the following command from terminal to change my default web browser in Gnome to vivaldi: "xdg-settings set default-web-browser vivaldi-stable.desktop" Then I rebooted, launched Thunderbird, and clicked on an e-mail which had a web link. Vivaldi launched with no errors in sandbox mode (because it did not show any of my bookmarks). This is exactly how Firefox used to behave.
gitea-mirror commented 2026-05-05 09:03:22 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 19, 2020):

open a new instances of Firefox with a new user profile (none of my bookmarks showing'.

Uhh, somehow over read this. nowhitelist ${HOME}/.mozilla/firefox/profiles.ini should work I think. However, keep in mind that this can still make trouble.

<!-- gh-comment-id:730585362 --> @rusty-snake commented on GitHub (Nov 19, 2020): > open a new instances of Firefox with a new user profile (none of my bookmarks showing'. Uhh, somehow over read this. `nowhitelist ${HOME}/.mozilla/firefox/profiles.ini` should work I think. However, keep in mind that this can still make trouble.
gitea-mirror commented 2026-05-05 09:03:23 -06:00
Author
Owner
Copy link

@rsramkis commented on GitHub (Nov 20, 2020):

Hi Rusty,

I'm not sure what I should do with the string "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini". I assume it needs to go into a configuration file?

Note I did read bug:
https://github.com/netblue30/firejail/issues/3482

<!-- gh-comment-id:730713180 --> @rsramkis commented on GitHub (Nov 20, 2020): Hi Rusty, I'm not sure what I should do with the string "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini". I assume it needs to go into a configuration file? Note I did read bug: https://github.com/netblue30/firejail/issues/3482
gitea-mirror commented 2026-05-05 09:03:23 -06:00
Author
Owner
Copy link

@rsramkis commented on GitHub (Nov 20, 2020):

I was able to find the a file /etc/firejail/thunderbird.profile. It contained these lines:

`# These lines are needed to allow Firefox to load your profile when clicking a link in an email
noblacklist ${HOME}/.mozilla
whitelist ${HOME}/.mozilla/firefox/profiles.ini
read-only ${HOME}/.mozilla/firefox/profiles.ini

noblacklist ${HOME}/.cache/thunderbird
noblacklist ${HOME}/.gnupg
`

It looks like it is already setup to allow for web links to be open based on the comment line.

Source:
https://github.com/netblue30/firejail/issues/3291

<!-- gh-comment-id:730715945 --> @rsramkis commented on GitHub (Nov 20, 2020): I was able to find the a file /etc/firejail/thunderbird.profile. It contained these lines: `# These lines are needed to allow Firefox to load your profile when clicking a link in an email noblacklist ${HOME}/.mozilla whitelist ${HOME}/.mozilla/firefox/profiles.ini read-only ${HOME}/.mozilla/firefox/profiles.ini noblacklist ${HOME}/.cache/thunderbird noblacklist ${HOME}/.gnupg ` It looks like it is already setup to allow for web links to be open based on the comment line. **Source:** https://github.com/netblue30/firejail/issues/3291
gitea-mirror commented 2026-05-05 09:03:24 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 20, 2020):

I'm not sure what I should do with the string "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini". I assume it needs to go into a configuration file?

Short: add the nowhitelist to your thunderbird.local

mkdir ~/.config/firejail
echo "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini" >> ~/.config/firejail/thunderbird.local

It looks like it is already setup to allow for web links to be open based on the comment line.

Long: out of #3291 support to open firefox from thunderbird was added by default. But firefox must be running. Your old never supported behaviour was broken by this because ~/.mozilla now appear in the sandbox.

<!-- gh-comment-id:731232985 --> @rusty-snake commented on GitHub (Nov 20, 2020): > I'm not sure what I should do with the string "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini". I assume it needs to go into a configuration file? Short: add the `nowhitelist` to your thunderbird.local ``` mkdir ~/.config/firejail echo "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini" >> ~/.config/firejail/thunderbird.local ``` > It looks like it is already setup to allow for web links to be open based on the comment line. Long: out of #3291 support to open firefox from thunderbird was added by default. But firefox **must** be running. Your old never supported behaviour was broken by this because ~/.mozilla now appear in the sandbox.
gitea-mirror commented 2026-05-05 09:03:24 -06:00
Author
Owner
Copy link

@rsramkis commented on GitHub (Nov 25, 2020):

Thanks for your feed back. I will go with the recommended configuration.

<!-- gh-comment-id:733828925 --> @rsramkis commented on GitHub (Nov 25, 2020): Thanks for your feed back. I will go with the recommended configuration.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2373
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?