github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #3799] Viber appimage pausing firejail execution asking to replace mimeapps.list 'overriding mode 0664' #2400

New issue
Closed
opened 2026-05-05 09:04:39 -06:00 by gitea-mirror · 5 comments
gitea-mirror commented 2026-05-05 09:04:39 -06:00
Owner
Copy link

Originally created by @svc88 on GitHub (Dec 8, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3799

Bug and expected behavior
In $HOME, when running:
firejail --appimage --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage
it executes and pauses on the following question:

Reading profile /usr/local/etc/firejail/Viber.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-exec.inc
Reading profile /usr/local/etc/firejail/disable-interpreters.inc
Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/whitelist-common.inc
Mounting appimage type 2
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 25942, child pid 25945

**     Warning: dropping all Linux capabilities     **

Warning fcopy: skipping /etc/alternatives/orbd, cannot find inode
Warning fcopy: skipping /etc/alternatives/servertool.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/servertool, cannot find inode
Warning fcopy: skipping /etc/alternatives/tnameserv.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/tnameserv, cannot find inode
Warning fcopy: skipping /etc/alternatives/orbd.1.gz, cannot find inode
Warning: skipping asound.conf for private /etc
Warning: skipping crypto-policies for private /etc
Warning: skipping pki for private /etc
Warning: skipping proxychains.conf for private /etc
Private /etc installed in 17.96 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: not remounting /run/user/1000/gvfs
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 143.46 ms
Qt: Session management error: Authentication Rejected, reason : None of the authentication protocols specified are supported and host-based authentication failed
mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?

After which i press enter and then it continues with this:

[20:48:1209/010618.546329:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95)
[20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor.

Then it opens up normally, without any issues it seems.
But my question is, what is this and why does it ask it?
mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?

Please note, that the other errors that continue after this
[20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor.
are only Viber related errors, so ignore those if you try to reproduce this.

Please reproduce with Viber appimage from https://download.cdn.viber.com/desktop/Linux/viber.AppImage

No profile and disabling firejail

  • What changed calling firejail --noprofile /path/to/program in a terminal? It runs without the question
  • What changed calling the program by path (check which <program> or firejail --list while the sandbox is running)? Nothing

Reproduce
Steps to reproduce the behavior:

  1. Run in bash firejail --appimage --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage
  2. See error mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?
  3. Press enter, it will continue and open up the program.
  4. See rest of errors in the terminal

Environment

  • Linux distribution and version: Xubuntu 18.04
  • firejail version 0.9.64
debug output 
Reading profile /usr/local/etc/firejail/Viber.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-exec.inc
Reading profile /usr/local/etc/firejail/disable-interpreters.inc
Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/whitelist-common.inc
Mounting appimage type 2
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 27664, child pid 27667

**     Warning: dropping all Linux capabilities     **

Warning fcopy: skipping /etc/alternatives/orbd, cannot find inode
Warning fcopy: skipping /etc/alternatives/servertool.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/servertool, cannot find inode
Warning fcopy: skipping /etc/alternatives/tnameserv.1.gz, cannot find inode
Warning fcopy: skipping /etc/alternatives/tnameserv, cannot find inode
Warning fcopy: skipping /etc/alternatives/orbd.1.gz, cannot find inode
Warning: skipping asound.conf for private /etc
Warning: skipping crypto-policies for private /etc
Warning: skipping pki for private /etc
Warning: skipping proxychains.conf for private /etc
Private /etc installed in 18.68 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: not remounting /run/user/1000/gvfs
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 132.57 ms
Qt: Session management error: Authentication Rejected, reason : None of the authentication protocols specified are supported and host-based authentication failed
mv: replace '/home/test/.config/mimeapps.list', overriding mode 0644 (rw-r--r--)? 
[20:51:1209/010932.512256:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95)
[20:54:1209/010932.535963:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor.
Originally created by @svc88 on GitHub (Dec 8, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3799 **Bug and expected behavior** In $HOME, when running: `firejail --appimage --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage` it executes and pauses on the following question: ``` Reading profile /usr/local/etc/firejail/Viber.profile Reading profile /usr/local/etc/firejail/disable-common.inc Reading profile /usr/local/etc/firejail/disable-devel.inc Reading profile /usr/local/etc/firejail/disable-exec.inc Reading profile /usr/local/etc/firejail/disable-interpreters.inc Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc Reading profile /usr/local/etc/firejail/disable-programs.inc Reading profile /usr/local/etc/firejail/whitelist-common.inc Mounting appimage type 2 Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 25942, child pid 25945 ** Warning: dropping all Linux capabilities ** Warning fcopy: skipping /etc/alternatives/orbd, cannot find inode Warning fcopy: skipping /etc/alternatives/servertool.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/servertool, cannot find inode Warning fcopy: skipping /etc/alternatives/tnameserv.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/tnameserv, cannot find inode Warning fcopy: skipping /etc/alternatives/orbd.1.gz, cannot find inode Warning: skipping asound.conf for private /etc Warning: skipping crypto-policies for private /etc Warning: skipping pki for private /etc Warning: skipping proxychains.conf for private /etc Private /etc installed in 17.96 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: not remounting /run/user/1000/gvfs Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Child process initialized in 143.46 ms Qt: Session management error: Authentication Rejected, reason : None of the authentication protocols specified are supported and host-based authentication failed mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)? ``` After which i press enter and then it continues with this: ``` [20:48:1209/010618.546329:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95) [20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor. ``` Then it opens up normally, without any issues it seems. But my question is, what is this and why does it ask it? `mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?` Please note, that the other errors that continue **after** this `[20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor.` are only Viber related errors, so ignore those if you try to reproduce this. Please reproduce with Viber appimage from https://download.cdn.viber.com/desktop/Linux/viber.AppImage **No profile and disabling firejail** - What changed calling `firejail --noprofile /path/to/program` in a terminal? It runs without the question - What changed calling the program by path (check `which <program>` or `firejail --list` while the sandbox is running)? Nothing **Reproduce** Steps to reproduce the behavior: 1. Run in bash `firejail --appimage --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage` 2. See error `mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?` 3. Press enter, it will continue and open up the program. 4. See rest of errors in the terminal **Environment** - Linux distribution and version: Xubuntu 18.04 - firejail version 0.9.64 <details><summary> debug output </summary> ``` Reading profile /usr/local/etc/firejail/Viber.profile Reading profile /usr/local/etc/firejail/disable-common.inc Reading profile /usr/local/etc/firejail/disable-devel.inc Reading profile /usr/local/etc/firejail/disable-exec.inc Reading profile /usr/local/etc/firejail/disable-interpreters.inc Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc Reading profile /usr/local/etc/firejail/disable-programs.inc Reading profile /usr/local/etc/firejail/whitelist-common.inc Mounting appimage type 2 Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 27664, child pid 27667 ** Warning: dropping all Linux capabilities ** Warning fcopy: skipping /etc/alternatives/orbd, cannot find inode Warning fcopy: skipping /etc/alternatives/servertool.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/servertool, cannot find inode Warning fcopy: skipping /etc/alternatives/tnameserv.1.gz, cannot find inode Warning fcopy: skipping /etc/alternatives/tnameserv, cannot find inode Warning fcopy: skipping /etc/alternatives/orbd.1.gz, cannot find inode Warning: skipping asound.conf for private /etc Warning: skipping crypto-policies for private /etc Warning: skipping pki for private /etc Warning: skipping proxychains.conf for private /etc Private /etc installed in 18.68 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: not remounting /run/user/1000/gvfs Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Child process initialized in 132.57 ms Qt: Session management error: Authentication Rejected, reason : None of the authentication protocols specified are supported and host-based authentication failed mv: replace '/home/test/.config/mimeapps.list', overriding mode 0644 (rw-r--r--)? [20:51:1209/010932.512256:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95) [20:54:1209/010932.535963:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor. ``` </details>
gitea-mirror commented 2026-05-05 09:04:42 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 9, 2020):

That's two unrelated issues I guess:

  1. "mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?"
    Viber tries to at it has handler for some mimetypes, but ~/.config/mimeapps.list is read-only for security reasons.
  2. "[20:48:1209/010618.546329:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95)
    [20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor."
    firejail --appimage --protocol=unix,inet,inet6,netlink --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage
<!-- gh-comment-id:741749607 --> @rusty-snake commented on GitHub (Dec 9, 2020): That's two unrelated issues I guess: 1. "mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?" Viber tries to at it has handler for some mimetypes, but `~/.config/mimeapps.list` is read-only for security reasons. 2. "[20:48:1209/010618.546329:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95) [20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor." `firejail --appimage --protocol=unix,inet,inet6,netlink --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage`
gitea-mirror commented 2026-05-05 09:04:42 -06:00
Author
Owner
Copy link

@svc88 commented on GitHub (Dec 9, 2020):

1. "mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?"
   Viber tries to at it has handler for some mimetypes, but `~/.config/mimeapps.list` is read-only for security reasons.

Tries to what? Is it trying to override the permissions of mimeapps? What does pressing enter to this cmd do?

2\. "[20:48:1209/010618.546329:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95)
    [20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor."
    `firejail --appimage --protocol=unix,inet,inet6,netlink --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage`

seems only netlink is missing from Viber.profile. Since i havent noticed any functionality issues when using Viber, is netlink really needed?

<!-- gh-comment-id:742019807 --> @svc88 commented on GitHub (Dec 9, 2020): > 1. "mv: replace '/home/test/.config/mimeapps.list', overriding mode 0664 (rw-rw-r--)?" > Viber tries to at it has handler for some mimetypes, but `~/.config/mimeapps.list` is read-only for security reasons. Tries to what? Is it trying to override the permissions of mimeapps? What does pressing enter to this cmd do? > 2\. "[20:48:1209/010618.546329:ERROR:address_tracker_linux.cc(152)] Could not create NETLINK socket: Operation not supported (95) > [20:53:1209/010618.570619:ERROR:udev_watcher.cc(48)] Failed to initialize a udev monitor." > `firejail --appimage --protocol=unix,inet,inet6,netlink --profile="/usr/local/etc/firejail/Viber.profile" viber.AppImage` seems only `netlink` is missing from Viber.profile. Since i havent noticed any functionality issues when using Viber, is `netlink` really needed?
gitea-mirror commented 2026-05-05 09:04:44 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 16, 2020):

What does pressing enter to this cmd do?

Likely nothing, as it is made ro by firejail and not by filesystem.

<!-- gh-comment-id:746785039 --> @rusty-snake commented on GitHub (Dec 16, 2020): > What does pressing enter to this cmd do? Likely nothing, as it is made ro by firejail and not by filesystem.
gitea-mirror commented 2026-05-05 09:04:45 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 4, 2021):

Tries to what? Is it trying to override the permissions of mimeapps?

No, it tries to replace it.

What does pressing enter to this cmd do?

Likely nothing, or at least nothing which affects files outside the sandbox.

is netlink really needed?

If the error says it … Anyway, if nothing is broken w/o it it must not be added (but how do you know nothing is broken?).

<!-- gh-comment-id:754072715 --> @rusty-snake commented on GitHub (Jan 4, 2021): > Tries to what? Is it trying to override the permissions of mimeapps? No, it tries to replace it. > What does pressing enter to this cmd do? Likely nothing, or at least nothing which affects files outside the sandbox. > is netlink really needed? If the error says it … Anyway, if nothing is broken w/o it it must not be added (but how do you know nothing is broken?).
gitea-mirror commented 2026-05-05 09:04:46 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Mar 8, 2021):

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

<!-- gh-comment-id:793004736 --> @rusty-snake commented on GitHub (Mar 8, 2021): I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2400
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?