github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3782] Man pages have #ifdefs in them #2383

New issue

Closed

opened 2026-05-05 09:03:50 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:03:50 -06:00

Owner

Originally created by @kmk3 on GitHub (Dec 1, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3782

Bug and expected behavior

Describe the bug.

So, I was browsing through the man pages when I noticed this:

$ man firejail | grep '#if'
              #ifdef HAVE_X11 $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
              [...]  #if HAVE_USERNS
              #ifdef HAVE_X11
$ pacman -Qlq firejail | grep /man/ | grep -v '/$' | xargs -I '{}' -n 1 sh -c 'printf "%s\n" "{}"; man "{}" | grep "#if"'
/usr/share/man/man1/firecfg.1.gz
/usr/share/man/man1/firejail.1.gz
              #ifdef HAVE_X11 $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
              [...]  #if HAVE_USERNS
              #ifdef HAVE_X11
/usr/share/man/man1/firemon.1.gz
/usr/share/man/man5/firejail-login.5.gz
/usr/share/man/man5/firejail-profile.5.gz
              Return a different error instead of EPERM to the process, kill it when an attempt is made to call a blocked system call, or allow but log the attempt.  #ifdef HAVE_X11
/usr/share/man/man5/firejail-users.5.gz
$ pacman -Qlq firejail | grep /man/ | grep -v '/$' | xargs -I '{}' -n 1 sh -c 'printf "%s\n" "{}"; zcat "{}" | grep "#if"'
/usr/share/man/man1/firecfg.1.gz
/usr/share/man/man1/firejail.1.gz
#ifdef HAVE_X11
#if HAVE_USERNS
#ifdef HAVE_X11
/usr/share/man/man1/firemon.1.gz
/usr/share/man/man5/firejail-login.5.gz
/usr/share/man/man5/firejail-profile.5.gz
#ifdef HAVE_X11
/usr/share/man/man5/firejail-users.5.gz

What did you expect to happen?

#ifdef'd blocks to be processed by cpp(1) or something else at build time.

Environment

Linux distribution and version (ie output of lsb_release -a, screenfetch or cat /etc/os-release)
Firejail version (output of firejail --version) exclusive or used git commit (git rev-parse HEAD)

$ lsb_release -a
LSB Version:    1.4
Distributor ID: Artix
Description:    Artix Linux
Release:        rolling
Codename:       n/a
$ firejail --version
firejail version 0.9.64

Compile time support:
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file and directory whitelisting support is enabled
        - file transfer support is enabled
        - firetunnel support is enabled
        - networking support is enabled
        - overlayfs support is enabled
        - private-home support is enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

The package comes straight from Arch though:

$ pacman -Si firejail
Repository      : community
Name            : firejail
Version         : 0.9.64-2
Description     : Linux namespaces sandbox program
Architecture    : x86_64
URL             : https://github.com/netblue30/firejail
Licenses        : GPL2
Groups          : None
Provides        : None
Depends On      : apparmor
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 545.83 KiB
Installed Size  : 1988.23 KiB
Packager        : Sergej Pupykin <pupykin.s+arch@gmail.com>
Build Date      : Tue 27 Oct 2020 08:35:54 PM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature
$ sha256sum /var/cache/pacman/pkg/firejail-0.9.64-2-x86_64.pkg.tar.zst
4750705b96a6991165b6834f0092ffccce313c0b27dfdf169f29cfa6a43f9fab  /var/cache/pacman/pkg/firejail-0.9.64-2-x86_64.pkg.tar.zst

Checklist

The upstream profile (and redirect profile if exists) have no changes fixing it.
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
Programs needed for interaction are listed in the profile.
A short search for duplicates was performed.
If it is a AppImage, --profile=PROFILENAME is used to set the right profile.
Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.

Originally created by @kmk3 on GitHub (Dec 1, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3782 **Bug and expected behavior** - Describe the bug. So, I was browsing through the man pages when I noticed this: ```console $ man firejail | grep '#if' #ifdef HAVE_X11 $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage [...] #if HAVE_USERNS #ifdef HAVE_X11 $ pacman -Qlq firejail | grep /man/ | grep -v '/$' | xargs -I '{}' -n 1 sh -c 'printf "%s\n" "{}"; man "{}" | grep "#if"' /usr/share/man/man1/firecfg.1.gz /usr/share/man/man1/firejail.1.gz #ifdef HAVE_X11 $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage [...] #if HAVE_USERNS #ifdef HAVE_X11 /usr/share/man/man1/firemon.1.gz /usr/share/man/man5/firejail-login.5.gz /usr/share/man/man5/firejail-profile.5.gz Return a different error instead of EPERM to the process, kill it when an attempt is made to call a blocked system call, or allow but log the attempt. #ifdef HAVE_X11 /usr/share/man/man5/firejail-users.5.gz $ pacman -Qlq firejail | grep /man/ | grep -v '/$' | xargs -I '{}' -n 1 sh -c 'printf "%s\n" "{}"; zcat "{}" | grep "#if"' /usr/share/man/man1/firecfg.1.gz /usr/share/man/man1/firejail.1.gz #ifdef HAVE_X11 #if HAVE_USERNS #ifdef HAVE_X11 /usr/share/man/man1/firemon.1.gz /usr/share/man/man5/firejail-login.5.gz /usr/share/man/man5/firejail-profile.5.gz #ifdef HAVE_X11 /usr/share/man/man5/firejail-users.5.gz ``` - What did you expect to happen? `#ifdef`'d blocks to be processed by `cpp(1)` or something else at build time. **Environment** - Linux distribution and version (ie output of `lsb_release -a`, `screenfetch` or `cat /etc/os-release`) - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`) ```console $ lsb_release -a LSB Version: 1.4 Distributor ID: Artix Description: Artix Linux Release: rolling Codename: n/a $ firejail --version firejail version 0.9.64 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` The package comes straight from Arch though: ```console $ pacman -Si firejail Repository : community Name : firejail Version : 0.9.64-2 Description : Linux namespaces sandbox program Architecture : x86_64 URL : https://github.com/netblue30/firejail Licenses : GPL2 Groups : None Provides : None Depends On : apparmor Optional Deps : None Conflicts With : None Replaces : None Download Size : 545.83 KiB Installed Size : 1988.23 KiB Packager : Sergej Pupykin <pupykin.s+arch@gmail.com> Build Date : Tue 27 Oct 2020 08:35:54 PM -03 Validated By : MD5 Sum SHA-256 Sum Signature $ sha256sum /var/cache/pacman/pkg/firejail-0.9.64-2-x86_64.pkg.tar.zst 4750705b96a6991165b6834f0092ffccce313c0b27dfdf169f29cfa6a43f9fab /var/cache/pacman/pkg/firejail-0.9.64-2-x86_64.pkg.tar.zst ``` **Checklist** - [ ] The upstream profile (and redirect profile if exists) have no changes fixing it. - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] Programs needed for interaction are listed in the profile. - [x] A short search for duplicates was performed. - [ ] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. - [ ] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages.

gitea-mirror closed this issue

2026-05-05 09:03:51 -06:00

gitea-mirror commented

2026-05-05 09:03:53 -06:00

Author

Owner

@rusty-snake commented on GitHub (Dec 1, 2020):

Thanks for reporting, should be fixed. The issue was that (1) #if was used at one place but the awk script only works with #ifdef and (2) the regex had no matches for numbers as in HAVE_X11.

@rusty-snake commented on GitHub (Dec 1, 2020): Thanks for reporting, should be fixed. The issue was that (1) `#if` was used at one place but the awk script only works with `#ifdef` and (2) the regex had no matches for numbers as in `HAVE_X11`.

gitea-mirror referenced this issue

2026-05-05 10:17:11 -06:00

[PR #2386] [MERGED] Temporary fix for noexec ${HOME} breakage #4282

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2383

No description provided.

Rows
Columns