github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3996] celluloid: error while loading shared libraries: liblua5.2.so.5.2 #2497

New issue

Closed

opened 2026-05-05 09:10:51 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:10:51 -06:00

Owner

Originally created by @rsramkis on GitHub (Feb 17, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3996

When trying to run the Celluloid video player I am getting the same error reported in defect 3698:

"celluloid: error while loading shared libraries: liblua5.2.so.5.2: cannot open shared object file: Permission denied."

I reviewed the "/etc/firejail/celluloid.profile" and noticed that the fix of adding the configuration line "noblacklist /usr/lib/liblua*" was missing from the profile.

Adding the configuration "noblacklist /usr/lib/liblua*" manually fixed the error when launching Celluloid.

My current version of firejail is "0.9.64-2" (build date 10-27-2020) in Manjaro Linux.

Previous Defect - Update celluloid.profile #3698
https://github.com/netblue30/firejail/pull/3698/

Originally created by @rsramkis on GitHub (Feb 17, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/3996 When trying to run the Celluloid video player I am getting the same error reported in defect 3698: _"celluloid: error while loading shared libraries: liblua5.2.so.5.2: cannot open shared object file: Permission denied."_ I reviewed the "/etc/firejail/celluloid.profile" and noticed that the fix of adding the configuration line "noblacklist /usr/lib/liblua*" was missing from the profile. Adding the configuration "noblacklist /usr/lib/liblua*" manually fixed the error when launching Celluloid. My current version of firejail is "0.9.64-2" (build date 10-27-2020) in Manjaro Linux. **Previous Defect - Update celluloid.profile #3698** https://github.com/netblue30/firejail/pull/3698/

gitea-mirror

2026-05-05 09:10:51 -06:00

closed this issue
added the
notabug

old-version
labels

gitea-mirror commented

2026-05-05 09:10:55 -06:00

Author

Owner

@ghost commented on GitHub (Feb 17, 2021):

As you saw in #3698 this is already fixed so there's not much else you can do right now but add the below to your celluloid.local override until you can upgrade:

# Allow lua (blacklisted by disable-interpreters.inc)
include allow-lua.inc

I don't know if Manjaro Linux is aware of the recently disclosed security vulnerability in older firejail versions, but 0.9.64 is affected. Needless to say it is important that you upgrade as soon as possible. If you cannot install the Arch Linux firejail package (which carries fixes), at least edit /etc/firejail/firejail.config and set overlayfs no.

@ghost commented on GitHub (Feb 17, 2021): As you saw in #3698 this is already fixed so there's not much else you can do right now but add the below to your celluloid.local override until you can upgrade: ``` # Allow lua (blacklisted by disable-interpreters.inc) include allow-lua.inc ``` I don't know if Manjaro Linux is aware of the recently disclosed [security vulnerability](https://github.com/netblue30/firejail#security-vulnerabilities) in older firejail versions, but 0.9.64 is affected. Needless to say it is important that you upgrade as soon as possible. If you cannot install the Arch Linux [firejail](https://archlinux.org/packages/community/x86_64/firejail/) package (which carries fixes), at least edit /etc/firejail/firejail.config and set `overlayfs no`.

gitea-mirror commented

2026-05-05 09:10:56 -06:00

Author

Owner

@rsramkis commented on GitHub (Feb 18, 2021):

@glitsj16 Thanks for the feedback.

Question

(1) Is the "celluloid.local" the "/etc/firejail/celluloid.profile" file?

(2) After I update the " etc/firejail/firejail.config" and set "overlayfs no", do I need to do anything else to implement the change (e.g. run "sudo firecfg")

Looks like the issue is Manjaro's Community repository (and the miss that they needed to get the updated build which was mentioned in Jan 2021. I posted the found issue to their stable forum:

https://forum.manjaro.org/t/stable-update-2021-02-09-kernels-gnome-40-alpha-kde-apps-20-12-2-systemd-mesa-libreoffice/52659/212

Thanks.

@rsramkis commented on GitHub (Feb 18, 2021): @glitsj16 Thanks for the feedback. **Question** (1) Is the "celluloid.local" the "/etc/firejail/celluloid.profile" file? (2) After I update the " etc/firejail/firejail.config" and set "overlayfs no", do I need to do anything else to implement the change (e.g. run "sudo firecfg") Looks like the issue is Manjaro's Community repository (and the miss that they needed to get the updated build which was mentioned in Jan 2021. I posted the found issue to their stable forum: https://forum.manjaro.org/t/stable-update-2021-02-09-kernels-gnome-40-alpha-kde-apps-20-12-2-systemd-mesa-libreoffice/52659/212 Thanks.

gitea-mirror commented

2026-05-05 09:10:57 -06:00

Author

Owner

@ghost commented on GitHub (Feb 18, 2021):

(1) Is the "celluloid.local" the "/etc/firejail/celluloid.profile" file?

No those are different files serving a different goal. The *.profile files in /etc/firejail are specifically designed for each supported application. In general they cover most if not all functionality the app offers. But as we cannot know the particular workflow of each user there is a way to override a *.profile and that are the *.local files. They don't exist until you create one and put it in a dedicated location so firejail knows how to mix options of both files to a desirable sandbox. You can put local override files in either /etc/firejail (system-wide and used for all users on the machine) OR in ${HOME}/.config/firejail (per user options). The latter directory also needs to be created by the user. These .local files are never touched by installing/upgrading or removing firejail. Hopefully that's enough info to get you going with the celluloid issue you have. Just bare in mind that once you do upgrade to a firejail version that already has the fixed profile for celluloid, the local override can be removed. See the wiki for details.

(2) After I update the " etc/firejail/firejail.config" and set "overlayfs no", do I need to do anything else to implement the change (e.g. run "sudo firecfg")

No. The new configuration will be picked up by firejail automatically on each invocation. The best thing to do after making such a change is to either logout/login or restart your firejailed applications that are still running.

Thanks for posting to the Manjaro forum. Hopefully someone will cut a fresh PKGBUILD that makes it into their repositories soonish.

@ghost commented on GitHub (Feb 18, 2021): > (1) Is the "celluloid.local" the "/etc/firejail/celluloid.profile" file? No those are different files serving a different goal. The *.profile files in /etc/firejail are specifically designed for each supported application. In general they cover most if not all functionality the app offers. But as we cannot know the particular workflow of each user there is a way to override a *.profile and that are the *.local files. They don't exist until you create one and put it in a dedicated location so firejail knows how to mix options of both files to a desirable sandbox. You can put local override files in either /etc/firejail (system-wide and used for all users on the machine) OR in ${HOME}/.config/firejail (per user options). The latter directory also needs to be created by the user. These .local files are never touched by installing/upgrading or removing firejail. Hopefully that's enough info to get you going with the celluloid issue you have. Just bare in mind that once you do upgrade to a firejail version that already has the fixed profile for celluloid, the local override can be removed. See the [wiki](https://github.com/netblue30/firejail/wiki/Creating-overrides) for details. > (2) After I update the " etc/firejail/firejail.config" and set "overlayfs no", do I need to do anything else to implement the change (e.g. run "sudo firecfg") No. The new configuration will be picked up by firejail automatically on each invocation. The best thing to do after making such a change is to either logout/login or restart your firejailed applications that are still running. Thanks for posting to the Manjaro forum. Hopefully someone will cut a fresh PKGBUILD that makes it into their repositories soonish.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2497

No description provided.

Rows
Columns