[GH-ISSUE #3981] Wayland Only: ibus failed to work in some programs even with --noprofile

gitea-mirror commented

2026-05-05 09:10:31 -06:00

Owner

Originally created by @ixuu153 on GitHub (Feb 12, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3981

IBus input method framework does not response for some applications like signal-desktop and tor-browser, even with --noprofile option. The problem only happens on Wayland. It works fine under X11.

Environment

openSUSE Tumbleweed (latest snapshot)
Firejail version 0.9.64.2, installed from official repository

Steps to reproduce (tor-browser as example)

Download and unpack tor-browser bundle from official website
Execute the application with command:

$ firejail --noprofile /opt/tor-browser_en/Browser/start-tor-browser --verbose

After tor browser started, switch ibus between different input methods, e.g. English(US) and Chinese.

Result

Keyboard does not work for BOTH input methods.
See debug output bellow for error message.

Checklist

The profile (and redirect profile if exists) hasn't already been fixed upstream.
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
I have performed a short search for similar issues (to avoid opening a duplicate).
If it is a AppImage, --profile=PROFILENAME is used to set the right profile.
Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.

debug output

1. When launching tor browser:

$ firejail --debug --noprofile /opt/tor-browser_en/Browser/start-tor-browser --verbose
...
(firefox:13): IBUS-WARNING **: 21:02:53.506: Unable to connect to ibus: Could not connect: Connection refused
...

When trying to input characters in English(US):

...
(firefox:13): IBUS-WARNING **: 21:03:15.290: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 21:03:15.342: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 21:03:15.374: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 21:03:15.410: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 21:03:16.300: Events queue growing too big, will start to drop
...

Originally created by @ixuu153 on GitHub (Feb 12, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/3981 IBus input method framework does not response for some applications like signal-desktop and tor-browser, even with `--noprofile` option. The problem only happens on Wayland. It works fine under X11. #### Environment - openSUSE Tumbleweed (latest snapshot) - Firejail version 0.9.64.2, installed from official repository #### Steps to reproduce (tor-browser as example) 1. Download and unpack tor-browser bundle from [official website](https://www.torproject.org/download) 2. Execute the application with command: ``` $ firejail --noprofile /opt/tor-browser_en/Browser/start-tor-browser --verbose ``` 3. After tor browser started, switch ibus between different input methods, e.g. English(US) and Chinese. #### Result Keyboard does not work for **BOTH** input methods. See **debug output** bellow for error message. #### Checklist - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. - [x] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. <details><summary> debug output </summary> 1. When launching tor browser: ``` $ firejail --debug --noprofile /opt/tor-browser_en/Browser/start-tor-browser --verbose ... (firefox:13): IBUS-WARNING **: 21:02:53.506: Unable to connect to ibus: Could not connect: Connection refused ... ``` 2. When trying to input characters in English(US): ``` ... (firefox:13): IBUS-WARNING **: 21:03:15.290: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 21:03:15.342: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 21:03:15.374: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 21:03:15.410: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 21:03:16.300: Events queue growing too big, will start to drop ... ``` </details>

gitea-mirror

2026-05-05 09:10:31 -06:00

closed this issue
added the
duplicate
label

gitea-mirror commented

2026-05-05 09:10:33 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 12, 2021):

Duplicate of #3379

@rusty-snake commented on GitHub (Feb 12, 2021): Duplicate of #3379

gitea-mirror commented

2026-05-05 09:10:34 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 12, 2021):

tor-browser has no Wayland support yet. Does this only affect XWayland Apps or any App in Wayland sessions.

Do the workaround (https://github.com/netblue30/firejail/issues/3379#issuecomment-632778490) work for you?

Firejail version 0.9.64.2,

You should update, this version is vulnerable for CVE-2021-26910.

debug output
...

The idea behind this is to see what firejail does, if you strip everything printed by firejail this outpur can not be used for debugging. (here is it unproblematic but in general it should be kept).

@rusty-snake commented on GitHub (Feb 12, 2021): tor-browser has no Wayland support yet. Does this only affect XWayland Apps or any App in Wayland sessions. Do the workaround (https://github.com/netblue30/firejail/issues/3379#issuecomment-632778490) work for you? > Firejail version 0.9.64.2, You should update, this version is vulnerable for CVE-2021-26910. > debug output > ... The idea behind this is to see what firejail does, if you strip everything printed by firejail this outpur can not be used for debugging. (here is it unproblematic but in general it should be kept).

gitea-mirror commented

2026-05-05 09:10:36 -06:00

Author

Owner

@ixuu153 commented on GitHub (Feb 18, 2021):

tor-browser has no Wayland support yet. Does this only affect XWayland Apps or any App in Wayland sessions.

So far I only tested XWayland programs.

Do the workaround (#3379 (comment)) work for you?

According to this workaround, I added --dbus-user=none option in command line, then at lease ibus can work under English input method. By adding this option, "Events queue growing too big" warning does not appear anymore, but it still has "Unable to connect to ibus" warning message.

However, even with this workaround, all other input methods (Japanese, Chinese) still do not work properly. The character selection window does not appear, only plain letters are inputted. In X, this situation can be solve with --dbus-user=filter --dbus-user.own=org.freedesktop.IBus option, but in Wayland this solution does not work, and worse still, it return to the behavior with only --noprofile option (even English input method does not work). It seems we have to disable dbus completely to avoid ibus sending connection request to the main program.

You should update, this version is vulnerable for CVE-2021-26910.

Thanks, just updated.

The idea behind this is to see what firejail does, if you strip everything printed by firejail this outpur can not be used for debugging. (here is it unproblematic but in general it should be kept).

Here is a complete log:

debug output

Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank"
Feb 17 03:49:20.605 [notice] Tor 0.4.4.6 (git-2a8b789ea6f308d0) running on Linux with Libevent 2.1.11-stable, OpenSSL 1.1.1i, Zlib 1.2.11, Liblzma N/A, and Libzstd N/A.
Feb 17 03:49:20.603 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Feb 17 03:49:20.603 [notice] Read configuration file "/opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults".
Feb 17 03:49:20.603 [notice] Read configuration file "/opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc".
Feb 17 03:49:20.606 [notice] Opening Socks listener on 127.0.0.1:9150
Feb 17 03:49:20.606 [notice] Opened Socks listener on 127.0.0.1:9150
Feb 17 03:49:20.606 [notice] Opening Control listener on 127.0.0.1:9151
Feb 17 03:49:20.606 [notice] Opened Control listener on 127.0.0.1:9151
Feb 17 03:49:20.000 [notice] Parsing GEOIP IPv4 file /opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip.

(fire7ox313): IBUS-WARNING **: 03:49:20.628: Unable to connect to ibus: Could not connect: Connection refused
Feb 17 03:49:20.000 [notice] Parsing GEOIP IPv6 file /opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip6.
Feb 17 03:49:20.000 [notice] Bootstrapped 0% (starting): Starting
Feb 17 03:49:21.000 [notice] Starting with guard context "default"
Feb 17 03:49:21.000 [notice] New control connection opened from 127.0.0.1.
Feb 17 03:49:21.000 [notice] Bootstrapped 5% (conn): Connecting to a relay
Feb 17 03:49:21.000 [notice] New control connection opened from 127.0.0.1.
Feb 17 03:49:21.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay
Feb 17 03:49:22.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay
Feb 17 03:49:22.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done
Feb 17 03:49:22.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits
Feb 17 03:49:22.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits
Feb 17 03:49:22.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit
Feb 17 03:49:23.000 [notice] Bootstrapped 100% (done): Done
Feb 17 03:49:24.000 [notice] New control connection opened from 127.0.0.1.
Feb 17 03:49:24.000 [notice] New control connection opened from 127.0.0.1.
Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank"
Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank"
Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank"

(firefox:13): IBUS-WARNING **: 03:49:28.500: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 03:49:28.614: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 03:49:28.730: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 03:49:28.856: Events queue growing too big, will start to drop.

(firefox:13): IBUS-WARNING **: 03:49:31.145: Events queue growing too big, will start to drop.

Feb 17 03:49:33.000 [notice] Owning controller connection has closed -- exiting now.
Feb 17 03:49:33.000 [notice] Catching signal TERM, exiting cleanly.

@ixuu153 commented on GitHub (Feb 18, 2021): > tor-browser has no Wayland support yet. Does this only affect XWayland Apps or any App in Wayland sessions. > So far I only tested XWayland programs. > Do the workaround ([#3379 (comment)](https://github.com/netblue30/firejail/issues/3379#issuecomment-632778490)) work for you? According to this workaround, I added ` --dbus-user=none` option in command line, then at lease ibus can work under English input method. By adding this option, "Events queue growing too big" warning does not appear anymore, but it still has "Unable to connect to ibus" warning message. However, even with this workaround, all other input methods (Japanese, Chinese) still do not work properly. The character selection window does not appear, only plain letters are inputted. In X, this situation can be solve with `--dbus-user=filter --dbus-user.own=org.freedesktop.IBus` option, but in Wayland this solution does not work, and worse still, it return to the behavior with only `--noprofile` option (even English input method does not work). It seems we have to disable dbus completely to avoid ibus sending connection request to the main program. > You should update, this version is vulnerable for CVE-2021-26910. Thanks, just updated. > The idea behind this is to see what firejail does, if you strip everything printed by firejail this outpur can not be used for debugging. (here is it unproblematic but in general it should be kept). Here is a complete log: <details><summary> debug output </summary> Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank" Feb 17 03:49:20.605 [notice] Tor 0.4.4.6 (git-2a8b789ea6f308d0) running on Linux with Libevent 2.1.11-stable, OpenSSL 1.1.1i, Zlib 1.2.11, Liblzma N/A, and Libzstd N/A. Feb 17 03:49:20.603 [notice] Tor can't help you if you use it wrong! Learn how to be safe at `https://www.torproject.org/download/download#warning` Feb 17 03:49:20.603 [notice] Read configuration file "/opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc-defaults". Feb 17 03:49:20.603 [notice] Read configuration file "/opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/torrc". Feb 17 03:49:20.606 [notice] Opening Socks listener on 127.0.0.1:9150 Feb 17 03:49:20.606 [notice] Opened Socks listener on 127.0.0.1:9150 Feb 17 03:49:20.606 [notice] Opening Control listener on 127.0.0.1:9151 Feb 17 03:49:20.606 [notice] Opened Control listener on 127.0.0.1:9151 Feb 17 03:49:20.000 [notice] Parsing GEOIP IPv4 file /opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip. (fire7ox313): IBUS-WARNING **: 03:49:20.628: Unable to connect to ibus: Could not connect: Connection refused Feb 17 03:49:20.000 [notice] Parsing GEOIP IPv6 file /opt/tor-browser_en-US/Browser/TorBrowser/Data/Tor/geoip6. Feb 17 03:49:20.000 [notice] Bootstrapped 0% (starting): Starting Feb 17 03:49:21.000 [notice] Starting with guard context "default" Feb 17 03:49:21.000 [notice] New control connection opened from 127.0.0.1. Feb 17 03:49:21.000 [notice] Bootstrapped 5% (conn): Connecting to a relay Feb 17 03:49:21.000 [notice] New control connection opened from 127.0.0.1. Feb 17 03:49:21.000 [notice] Bootstrapped 10% (conn_done): Connected to a relay Feb 17 03:49:22.000 [notice] Bootstrapped 14% (handshake): Handshaking with a relay Feb 17 03:49:22.000 [notice] Bootstrapped 15% (handshake_done): Handshake with a relay done Feb 17 03:49:22.000 [notice] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits Feb 17 03:49:22.000 [notice] Bootstrapped 90% (ap_handshake_done): Handshake finished with a relay to build circuits Feb 17 03:49:22.000 [notice] Bootstrapped 95% (circuit_create): Establishing a Tor circuit Feb 17 03:49:23.000 [notice] Bootstrapped 100% (done): Done Feb 17 03:49:24.000 [notice] New control connection opened from 127.0.0.1. Feb 17 03:49:24.000 [notice] New control connection opened from 127.0.0.1. Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank" Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank" Fontconfig warning: "/opt/tor-browser_en-US/Browser/TorBrowser/Data/fontconfig/fonts.conf", line 85: unknown element "blank" (firefox:13): IBUS-WARNING **: 03:49:28.500: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 03:49:28.614: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 03:49:28.730: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 03:49:28.856: Events queue growing too big, will start to drop. (firefox:13): IBUS-WARNING **: 03:49:31.145: Events queue growing too big, will start to drop. Feb 17 03:49:33.000 [notice] Owning controller connection has closed -- exiting now. Feb 17 03:49:33.000 [notice] Catching signal TERM, exiting cleanly. </details>

gitea-mirror commented

2026-05-05 09:10:36 -06:00

Author

Owner

@ixuu153 commented on GitHub (Feb 18, 2021):

Also tried strace and found following lines:

[pid   63] connect(37, {sa_family=AF_UNIX, sun_path=@"/home/tt/.cache/ibus/dbus-c9sren3v"}, 39 <unfinished ...>
[pid   61] <... getpid resumed>)       = 61
[pid   16] fstat(38,  <unfinished ...>
[pid   63] <... connect resumed>)      = -1 ECONNREFUSED (Connection refused)

All I know is that the IBus connection is refused. There is no further information.

@ixuu153 commented on GitHub (Feb 18, 2021): Also tried `strace` and found following lines: ``` [pid 63] connect(37, {sa_family=AF_UNIX, sun_path=@"/home/tt/.cache/ibus/dbus-c9sren3v"}, 39 <unfinished ...> [pid 61] <... getpid resumed>) = 61 [pid 16] fstat(38, <unfinished ...> [pid 63] <... connect resumed>) = -1 ECONNREFUSED (Connection refused) ``` All I know is that the IBus connection is refused. There is no further information.

gitea-mirror commented

2026-05-05 09:10:37 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 21, 2021):

I already guesed that this is because of the PID-namespace, see https://github.com/netblue30/firejail/issues/3379#issuecomment-632779468.

@rusty-snake commented on GitHub (Feb 21, 2021): I already guesed that this is because of the PID-namespace, see https://github.com/netblue30/firejail/issues/3379#issuecomment-632779468.

gitea-mirror commented

2026-05-05 09:10:38 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 12, 2021):

Closing here. #3379 keeps open to track this.

@rusty-snake commented on GitHub (May 12, 2021): Closing here. #3379 keeps open to track this.

gitea-mirror referenced this issue

2026-05-05 10:18:30 -06:00

[PR #2491] [MERGED] Add new profile for seahorse #4353