github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3883] Getting "Permission denied" when running Electron apps with --no-sandbox #2442

New issue

Closed

opened 2026-05-05 09:07:36 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:07:36 -06:00

Owner

Originally created by @mYnDstrEAm on GitHub (Jan 12, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3883

How can one run Electron apps that use a new version of Electron with Firejail?

This works: /home/username/Downloads/dir/appName --no-sandbox
This doesn't: firejail --profile=/etc/firejail/electron.profile /home/username/Downloads/dir/appName --no-sandbox

The output is:

Warning: networking feature is disabled in Firejail configuration file
Parent pid id, child pid id
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Child process initialized in wx.yz ms
/bin/bash: /home/username/Downloads/dir/appName: Permission denied

(Moved it to ~/Downloads/dir to prevent No such file or directory errors.)

sudo less /var/log/syslog | grep appName shows:

audit: type=1400 audit(id:id): apparmor="DENIED" operation="exec" profile="firejail-default" name="/home/username/Downloads/dir/appName" pid=id comm="bash" requested_mask="x" denied_mask="x" fsuid=1000 ouid=1000

I also tried it with --ignore=disable-mnt --ignore=nodbus

System: Debian 10/KDE
Firejail version: 0.9.64 (with /etc/firejail/electron.profile of that version)

Some electron apps work even without setting --no-sandbox so it's probably already solved/solvable somehow.
Possibly related issues (will remove the links if not found to be related later): #3586 #3871 #2690 #2946

Originally created by @mYnDstrEAm on GitHub (Jan 12, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/3883 How can one run Electron apps that use a new version of Electron with Firejail? This works: `/home/username/Downloads/dir/appName --no-sandbox` This doesn't: `firejail --profile=/etc/firejail/electron.profile /home/username/Downloads/dir/appName --no-sandbox` The output is: ``` Warning: networking feature is disabled in Firejail configuration file Parent pid id, child pid id Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Child process initialized in wx.yz ms /bin/bash: /home/username/Downloads/dir/appName: Permission denied ``` (Moved it to ~/Downloads/dir to prevent `No such file or directory` errors.) `sudo less /var/log/syslog | grep appName` shows: ``` audit: type=1400 audit(id:id): apparmor="DENIED" operation="exec" profile="firejail-default" name="/home/username/Downloads/dir/appName" pid=id comm="bash" requested_mask="x" denied_mask="x" fsuid=1000 ouid=1000 ``` I also tried it with `--ignore=disable-mnt --ignore=nodbus` System: Debian 10/KDE Firejail version: 0.9.64 (with /etc/firejail/electron.profile of that version) Some electron apps work even without setting --no-sandbox so it's probably already solved/solvable somehow. Possibly related issues (will remove the links if not found to be related later): #3586 #3871 #2690 #2946

gitea-mirror closed this issue

2026-05-05 09:07:37 -06:00

gitea-mirror commented

2026-05-05 09:07:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 12, 2021):

apparmor makes your ${HOME} noexec.
Compare firejail --noprofile /home/username/Downloads/dir/appName --no-sandbox (which I expect to work) and firejail --noprofile --apparmor /home/username/Downloads/dir/appName --no-sandbox

It should work if you add --ignore=apparmor '--ignore=noexec ${HOME}' (the last one is required for firejail >=0.9.65 and has no effect on firejail 0.9.64).

@rusty-snake commented on GitHub (Jan 12, 2021): `apparmor` makes your `${HOME}` `noexec`. Compare `firejail --noprofile /home/username/Downloads/dir/appName --no-sandbox` (which I expect to work) and `firejail --noprofile --apparmor /home/username/Downloads/dir/appName --no-sandbox` It should work if you add ` --ignore=apparmor '--ignore=noexec ${HOME}'` (the last one is required for firejail >=0.9.65 and has no effect on firejail 0.9.64).

gitea-mirror commented

2026-05-05 09:07:40 -06:00

Author

Owner

@mYnDstrEAm commented on GitHub (Jan 12, 2021):

Thank you! So the solution until firejail v >=0.9.65 hits the Debian backports repos seems to be: running cp /etc/firejail/electron.profile ~/.config/firejail/electron-apps.profile && kate ~/.config/firejail/electron-apps.profile, commenting out apparmor there and then running firejail --profile=~/.config/firejail/electron-apps.profile /home/username/Downloads/dir/appName --no-sandbox.

If you know of a (similar but) better / hardened solution (like keeping apparmor in that profile and only removing that noexec part) until that occurs please leave comment, closing this.

@mYnDstrEAm commented on GitHub (Jan 12, 2021): Thank you! So the solution until firejail v >=0.9.65 hits the Debian backports repos seems to be: running `cp /etc/firejail/electron.profile ~/.config/firejail/electron-apps.profile && kate ~/.config/firejail/electron-apps.profile`, commenting out `apparmor` there and then running `firejail --profile=~/.config/firejail/electron-apps.profile /home/username/Downloads/dir/appName --no-sandbox`. If you know of a (similar but) better / hardened solution (like keeping apparmor in that profile and only removing that noexec part) until that occurs please leave comment, closing this.

gitea-mirror commented

2026-05-05 09:07:42 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 12, 2021):

https://github.com/netblue30/firejail/issues/3629#issuecomment-702791887
https://github.com/netblue30/firejail/issues/2987#issuecomment-538667565
https://github.com/netblue30/firejail/issues/2938#issuecomment-526827774

@rusty-snake commented on GitHub (Jan 12, 2021): https://github.com/netblue30/firejail/issues/3629#issuecomment-702791887 https://github.com/netblue30/firejail/issues/2987#issuecomment-538667565 https://github.com/netblue30/firejail/issues/2938#issuecomment-526827774

gitea-mirror commented

2026-05-05 09:07:42 -06:00

Author

Owner

@mYnDstrEAm commented on GitHub (Jan 12, 2021):

In Debian (in other OS it might be firejail-local) this should work and seems to be the better solution:

echo "owner /home/username/dir-to-place-electron-build-dir-in/** ix," | sudo tee -a /etc/apparmor.d/local/firejail-default && sudo apparmor_parser -r /etc/apparmor.d/local/firejail-default

The problem with that is that I get: AppArmor parser error for /etc/apparmor.d/local/firejail-default in /etc/apparmor.d/local/firejail-default at line 1: syntax error, unexpected TOK_OWNER, expecting $end and did not find the error-message self-explanatory or explained anywhere online. The firejail-default file was (and is) otherwise empty and there is no firejail-local (nor a dedicated apparmor profile for the specific electron app).

@mYnDstrEAm commented on GitHub (Jan 12, 2021): In Debian (in other OS it might be firejail-local) this should work and seems to be the better solution: `echo "owner /home/username/dir-to-place-electron-build-dir-in/** ix," | sudo tee -a /etc/apparmor.d/local/firejail-default && sudo apparmor_parser -r /etc/apparmor.d/local/firejail-default` The problem with that is that I get: `AppArmor parser error for /etc/apparmor.d/local/firejail-default in /etc/apparmor.d/local/firejail-default at line 1: syntax error, unexpected TOK_OWNER, expecting $end` and did not find the error-message self-explanatory or explained anywhere online. The firejail-default file was (and is) otherwise empty and there is no firejail-local (nor a dedicated apparmor profile for the specific electron app).

gitea-mirror commented

2026-05-05 09:07:43 -06:00

Author

Owner

@kmk3 commented on GitHub (Jan 14, 2021):

So the solution until firejail v >=0.9.65 hits the Debian backports repos
seems to be: running cp /etc/firejail/electron.profile ~/.config/firejail/electron-apps.profile && kate ~/.config/firejail/electron-apps.profile, commenting out apparmor there

If you want to ignore apparmor on all profiles that include electron.profile,
you can just do this instead:

echo 'ignore apparmor' >>~/.config/firejail/electron.local

and then running
firejail --profile=~/.config/firejail/electron-apps.profile /home/username/Downloads/dir/appName --no-sandbox.

Then you could just run it like this:

firejail --profile=/etc/firejail/electron.profile /home/username/Downloads/dir/appName --no-sandbox

Or, if you want to use a separate profile for the programs in
/home/username/Downloads:

cat >~/.config/firejail/electron-apps.profile <<EOF
ignore apparmor

# Redirect
include electron.profile
EOF

Run it with:

firejail --profile=~/.config/firejail/electron-apps.profile /home/username/Downloads/dir/appName --no-sandbox

@kmk3 commented on GitHub (Jan 14, 2021): > So the solution until firejail v >=0.9.65 hits the Debian backports repos > seems to be: running `cp /etc/firejail/electron.profile > ~/.config/firejail/electron-apps.profile && kate > ~/.config/firejail/electron-apps.profile`, commenting out `apparmor` there If you want to ignore apparmor on all profiles that include electron.profile, you can just do this instead: `echo 'ignore apparmor' >>~/.config/firejail/electron.local` > and then running > `firejail --profile=~/.config/firejail/electron-apps.profile /home/username/Downloads/dir/appName --no-sandbox`. Then you could just run it like this: `firejail --profile=/etc/firejail/electron.profile /home/username/Downloads/dir/appName --no-sandbox` Or, if you want to use a separate profile for the programs in /home/username/Downloads: ``` cat >~/.config/firejail/electron-apps.profile <<EOF ignore apparmor # Redirect include electron.profile EOF ``` Run it with: `firejail --profile=~/.config/firejail/electron-apps.profile /home/username/Downloads/dir/appName --no-sandbox`

gitea-mirror referenced this issue

2026-05-05 10:17:45 -06:00

[PR #2442] [MERGED] Add machine-id note to man firejail #4312

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2442

No description provided.

Rows
Columns