mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3858] Unable to start Firefox v84.0.1 on Debian 10 (Buster) #2430
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2430
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @x10an14 on GitHub (Dec 31, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3858
Bug and expected behavior
What did you expect to happen?
Firefox to start
No profile and disabling firejail
What changed calling
firejail --noprofile /path/to/programin a terminal?firefoxcould start:What changed calling the program by path (check
which <program>orfirejail --listwhile the sandbox is running)?Reproduce
Steps to reproduce the behavior:
firejail firefoxorfirejail /opt/firefox/firefoxEnvironment
Linux distribution and version (ie output of
lsb_release -a,screenfetchorcat /etc/os-release)Firejail version (output of
firejail --version) exclusive or used git commit (git rev-parse HEAD)Additional context
Other context about the problem like related errors to understand the problem.
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.debug output
@rusty-snake commented on GitHub (Dec 31, 2020):
Does
firejail --ignore=disable-mnt firefoxwork?@x10an14 commented on GitHub (Dec 31, 2020):
Nope... =( But changed the error message though.
It is correct that
/optresides on a different mountpoint than/{,home/}, though.@rusty-snake commented on GitHub (Dec 31, 2020):
The problem isn't that is has an other partition/mount, the problem is that is seems to be mounted at
/mntwhich is blacklisted bydisable-mnt. If your setup allows you to mount it somewhere else, you can keep ´disable-mnt`.Maybe AA makes it
noexec. Tryfirejail --ignore=disable-mnt --ignore=apparmor firefox.@Micha-Btz commented on GitHub (Jan 6, 2021):
I have this too and I think the problem is, that it is only a link
in ~ ✦ ❯ ls -lha /usr/bin/firefox
lrwxrwxrwx 1 root root 22 18. Dez 02:09 /usr/bin/firefox -> ../lib/firefox/firefox
firejail --profile=/etc/firejail/firefox.profile /usr/lib/firefox/firefox
works
@thiswillbeyourgithub commented on GitHub (Jan 6, 2021):
I don't know if my issue is related to this here but I had similar issues that got solved by finding all the firefox executable and figuring out which one was not owned by root.
I think I had one in /usr/bin/firefox and one in /usr/local/bin/firefox
I have no idea how that happenned but suddenly in the last week I had issues with firejail because of this. I have no idea what happenned so I installed the latest firejail version then checked out all the executables of firefox by hand.
Useful commands are
type -a firefoxandlocate firefox | grep bin@Micha-Btz commented on GitHub (Jan 6, 2021):
/usr/local/bin/firefox is a link to the firejail binary created by the install. So that firefox should always run in firejail.
@x10an14 commented on GitHub (Jan 7, 2021):
@rusty-snake was on-point, the
--ignore=apparmorlets my Firefox start.Is there some way of getting better error reports from firejail (as opposed to have to manually test/remove/add flags) to figure out exactly what stops the app from running?
But since it's apparmor (which is not activated for some reason when running without firejail) I guess that means we can close this issue =)
(Any hints/tips to properly debug apparmor would be much appreciated)!
@rusty-snake commented on GitHub (Jan 7, 2021):
@Vincent43 knows what to add to firejail-local in order to allow exec from /mnt.
PS: You can also create a firefox.local with
ignore disable-mntandignore apparmor.@x10an14 commented on GitHub (Jan 7, 2021):
Is this firejail or apparmor specific?
@rusty-snake commented on GitHub (Jan 7, 2021):
firejail
Example:
mkdir ~/.config/firejail && echo "ignore apparmor" >> ~/.config/firejail/firefox.local && echo "ignore disable-mnt" >> ~/.config/firejail/firefox.local@Vincent43 commented on GitHub (Jan 7, 2021):
You can add
/mnt/** ix,line to/etc/apparmor.d/local/firejail-defaultthen restart apparmor or reboot system.For debugging apparmor stuff (not only for firejail) you may inspect
journalctl, i.e.journalctl --grep=DENIED@Micha-Btz commented on GitHub (Jan 12, 2021):
@rusty-snake please reopen.
the solution above doesn't work for me. Since programs like keepass try to load firefox and get stuck with no executable found.
debug output
firefox or no other binary will be startet. firefox works with noprifile.
I have firejail version 0.9.64 from debian unstable. I try to resolv this on my own:
I think I need some advice.
EDIT by @rusty-snake: code-block and details tags for debug output.
@rusty-snake commented on GitHub (Jan 12, 2021):
What's in it? Has you uncommented
private-etcorprivate-bin? If it still fails, add the following at the very top of firefox.profile and try again.If it works now remove one and try again to find which it is.
@Micha-Btz commented on GitHub (Jan 12, 2021):
Ahrg. it's my fault. I have added private-bin keepassxc-proxy to my firefox.local, which breaks the setup.
I definitely need to create a roadmap for such test for me. Can be closed.
Thanks a lot.