github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #3823] Unable to start hexchat with firejail #2411

New issue
Closed
opened 2026-05-05 09:05:15 -06:00 by gitea-mirror · 21 comments
gitea-mirror commented 2026-05-05 09:05:15 -06:00
Owner
Copy link

Originally created by @ibahnasy on GitHub (Dec 15, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3823

Distro: Arch Linux
Firejail: 0.9.64
Hexchat: 2.14.3

I can run hexchat with firejail using "--noprofile" only now, however it was working fine before.
Here is the log

$ firejail hexchat
Reading profile /etc/firejail/hexchat.profile
Reading profile /etc/firejail/allow-python2.inc
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/allow-perl.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 31270, child pid 31271
65 programs installed in 58.35 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/1000/gvfs
Warning: cleaning all supplementary groups
Blacklist violations are logged to syslog
Child process initialized in 187.76 ms

Originally created by @ibahnasy on GitHub (Dec 15, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3823 Distro: Arch Linux Firejail: 0.9.64 Hexchat: 2.14.3 I can run hexchat with firejail using "--noprofile" only now, however it was working fine before. Here is the log > $ firejail hexchat Reading profile /etc/firejail/hexchat.profile Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/allow-perl.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-shell.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 31270, child pid 31271 65 programs installed in 58.35 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: not remounting /run/user/1000/gvfs Warning: cleaning all supplementary groups Blacklist violations are logged to syslog Child process initialized in 187.76 ms
gitea-mirror commented 2026-05-05 09:05:18 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 15, 2020):

Work for me: Fedora 32, hexchat 2.14.3.

Are there any error in the terminal or in the syslog?

<!-- gh-comment-id:745316122 --> @rusty-snake commented on GitHub (Dec 15, 2020): Work for me: Fedora 32, hexchat 2.14.3. Are there any error in the terminal or in the syslog?
gitea-mirror commented 2026-05-05 09:05:19 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (Dec 15, 2020):

I'm not seeing any errors but when I try to launch it, the CPU fan spins so high and no more output logged in the terminal until I kill it.

<!-- gh-comment-id:745459276 --> @ibahnasy commented on GitHub (Dec 15, 2020): I'm not seeing any errors but when I try to launch it, the CPU fan spins so high and no more output logged in the terminal until I kill it.
gitea-mirror commented 2026-05-05 09:05:20 -06:00
Author
Owner
Copy link

@reinerh commented on GitHub (Dec 15, 2020):

Works here as well (HexChat 2.14.3, Firejail 0.9.64, Debian).

<!-- gh-comment-id:745625109 --> @reinerh commented on GitHub (Dec 15, 2020): Works here as well (HexChat 2.14.3, Firejail 0.9.64, Debian).
gitea-mirror commented 2026-05-05 09:05:21 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 16, 2020):

Anyway, if it works with --noprofile, one (or more) command in the profile (or it's includes) causes this. Can you comment the profile and then uncomment it line for line.

<!-- gh-comment-id:746735771 --> @rusty-snake commented on GitHub (Dec 16, 2020): Anyway, if it works with `--noprofile`, one (or more) command in the profile (or it's includes) causes this. Can you comment the profile and then uncomment it line for line.
gitea-mirror commented 2026-05-05 09:05:22 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (Dec 17, 2020):

Commenting "include disable-shell.inc" AND "private-bin hexchat,python" in /etc/firejail/hexchat.profile make it works!

<!-- gh-comment-id:747429265 --> @ibahnasy commented on GitHub (Dec 17, 2020): Commenting "include disable-shell.inc" AND "private-bin hexchat,python" in /etc/firejail/hexchat.profile make it works!
gitea-mirror commented 2026-05-05 09:05:22 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 17, 2020):

Depending on what shell is used, a hexchat.local like this should works.

noblacklist ${PATH}/sh
private-bin sh

Is /usr/bin/hexchat a shellscript?

<!-- gh-comment-id:747438910 --> @rusty-snake commented on GitHub (Dec 17, 2020): Depending on what shell is used, a hexchat.local like this should works. ``` noblacklist ${PATH}/sh private-bin sh ``` Is /usr/bin/hexchat a shellscript?
gitea-mirror commented 2026-05-05 09:05:23 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (Dec 17, 2020):

/usr/bin/hexchat: ELF 64-bit LSB pie executable

<!-- gh-comment-id:747450647 --> @ibahnasy commented on GitHub (Dec 17, 2020): /usr/bin/hexchat: ELF 64-bit LSB pie executable
gitea-mirror commented 2026-05-05 09:05:23 -06:00
Author
Owner
Copy link

@reinerh commented on GitHub (Dec 17, 2020):

Is this also the one that is executed? Does which hexchat show the same path?

<!-- gh-comment-id:747467705 --> @reinerh commented on GitHub (Dec 17, 2020): Is this also the one that is executed? Does `which hexchat` show the same path?
gitea-mirror commented 2026-05-05 09:05:23 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 17, 2020):

Better: which -a hexchat or where hexchat, as which hexchat will only show /usr/local/bin/hexchat (firecfg).

<!-- gh-comment-id:747473543 --> @rusty-snake commented on GitHub (Dec 17, 2020): Better: `which -a hexchat` or `where hexchat`, as `which hexchat` will only show `/usr/local/bin/hexchat` (firecfg).
gitea-mirror commented 2026-05-05 09:05:24 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (Dec 17, 2020):

$ which -a hexchat
/usr/bin/hexchat

<!-- gh-comment-id:747594209 --> @ibahnasy commented on GitHub (Dec 17, 2020): $ which -a hexchat /usr/bin/hexchat
gitea-mirror commented 2026-05-05 09:05:24 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (Dec 18, 2020):

I want to add that there is a feature in hexhcat that is "Open link in browser" which didn't work before when using the hexchat firejaij's profile but after disabling the above to options, this feature works fine.

<!-- gh-comment-id:748226181 --> @ibahnasy commented on GitHub (Dec 18, 2020): I want to add that there is a feature in hexhcat that is "Open link in browser" which didn't work before when using the hexchat firejaij's profile but after disabling the above to options, this feature works fine.
gitea-mirror commented 2026-05-05 09:05:25 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 4, 2021):

Because the sandbox can now start /usr/bin/firefox. Before with the private hexchat,python*, there was no /usr/bin/firefox in the sandbox.

Does my suggestion from above (noblacklist + private-bin) work? note: you maybe need to add other shells like bash.

<!-- gh-comment-id:753930121 --> @rusty-snake commented on GitHub (Jan 4, 2021): Because the sandbox can now start /usr/bin/firefox. Before with the `private hexchat,python*`, there was no /usr/bin/firefox in the sandbox. Does my suggestion from above (noblacklist + private-bin) work? note: you maybe need to add other shells like bash.
gitea-mirror commented 2026-05-05 09:05:25 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (Jan 4, 2021):

With your suggestion hexchat doesn't start at all giving this error: "Error: no suitable hexchat executable found"

<!-- gh-comment-id:753990727 --> @ibahnasy commented on GitHub (Jan 4, 2021): With your suggestion hexchat doesn't start at all giving this error: "Error: no suitable hexchat executable found"
gitea-mirror commented 2026-05-05 09:05:26 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Jan 4, 2021):

You need to undo your comments in hexchat.profile.

<!-- gh-comment-id:753991652 --> @rusty-snake commented on GitHub (Jan 4, 2021): You need to undo your comments in hexchat.profile.
gitea-mirror commented 2026-05-05 09:05:26 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (Jan 4, 2021):

Yes I did that but still throw that error.

<!-- gh-comment-id:753992226 --> @ibahnasy commented on GitHub (Jan 4, 2021): Yes I did that but still throw that error.
gitea-mirror commented 2026-05-05 09:05:27 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Apr 6, 2021):

Any progress here?

<!-- gh-comment-id:814169107 --> @rusty-snake commented on GitHub (Apr 6, 2021): Any progress here?
gitea-mirror commented 2026-05-05 09:05:27 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (May 12, 2021):

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

<!-- gh-comment-id:839995038 --> @rusty-snake commented on GitHub (May 12, 2021): I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
gitea-mirror commented 2026-05-05 09:05:27 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (May 16, 2021):

I'm still having the same issue btw.

<!-- gh-comment-id:841882664 --> @ibahnasy commented on GitHub (May 16, 2021): I'm still having the same issue btw.
gitea-mirror commented 2026-05-05 09:05:28 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (May 16, 2021):

Can you try

include allow-bin-sh.inc
private-bin sh
# or maybe 'private-bin bash,sh'?

if this does not help, what is the private-bin line generated by firejail --build hexchat?

<!-- gh-comment-id:841883091 --> @rusty-snake commented on GitHub (May 16, 2021): Can you try ``` include allow-bin-sh.inc private-bin sh # or maybe 'private-bin bash,sh'? ``` if this does not help, what is the private-bin line generated by `firejail --build hexchat`?
gitea-mirror commented 2026-05-05 09:05:28 -06:00
Author
Owner
Copy link

@ibahnasy commented on GitHub (May 16, 2021):

Your suggestion made it work.
BTW, firejail --build hexcha produce empty private-bin line.

<!-- gh-comment-id:841883794 --> @ibahnasy commented on GitHub (May 16, 2021): Your suggestion made it work. BTW, `firejail --build hexcha` produce empty private-bin line.
gitea-mirror commented 2026-05-05 09:05:28 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (May 16, 2021):

This is the same as https://github.com/netblue30/firejail/issues/3823#issuecomment-747438910, but there I forgot that we blacklist sh and bash. If we now only noblacklist sh but bash is still blacklisted and sh is a symlink to bash, it can not work.

Since hexchat needs /bin/sh under Arch (for any reasons), we should allow it. Allowing sh does weaken the profile lesser then dropping private-bin.

<!-- gh-comment-id:841885090 --> @rusty-snake commented on GitHub (May 16, 2021): This is the same as https://github.com/netblue30/firejail/issues/3823#issuecomment-747438910, but there I forgot that we `blacklist` `sh` and `bash`. If we now only `noblacklist` `sh` but `bash` is still `blacklist`ed and `sh` is a symlink to `bash`, it can not work. Since hexchat needs `/bin/sh` under Arch (for any reasons), we should allow it. Allowing `sh` does weaken the profile lesser then dropping `private-bin`.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2411
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?