mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4115] nheko: program does not work properly #2540
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2540
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @qazip on GitHub (Mar 19, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4115
Hello,
Running nheko with firejail is not working properly. There is more discussion on nheko's repo, namely: https://github.com/Nheko-Reborn/nheko/issues/249?_pjax=%23js-repo-pjax-container
I found that, for some reason, nheko is not writing to
~/.cache/nheko/nhekowhen firejailed. The profile used is:Any idea what's happening?
@CodeArtisan00 commented on GitHub (Mar 19, 2021):
comment out
private-cacherun with
firejail --debug --profile=yourprofile /path/nhekoyou may also run
firejail --build /path/nhekoto get a rough idea. for hardening you have to manually curate the profile@ghost commented on GitHub (Mar 19, 2021):
I saw the thread you mentioned (https://github.com/Nheko-Reborn/nheko/issues/249) and someone stated that disabling private-cache didn't help. Looking at the profile I see this:
Is ${HOME}/.cache/nheko/nheko a
fileinstead of adir? In that case you'd needmkfileinstead ofmkdir. Have you tried that yet?@qazip commented on GitHub (Mar 19, 2021):
@Neo00001, I already commented private-cache and it didn't help.
Runnihg with --debug:
@qazip commented on GitHub (Mar 19, 2021):
@glitsj16, it is a folder, not a file, so it is fine.
@ghost commented on GitHub (Mar 19, 2021):
disable-programs.inc --> blacklist ${HOME}/.cache/nheko
nheko.profile
This doesn't feel right to me, we should whitelist ${HOME}/.cache/nheko/nheko no?
@qazip commented on GitHub (Mar 19, 2021):
I commented out "include disable-programs.inc". Still having the error.
I changed whitelist ${HOME}/.cache/nheko to
${HOME}/.cache/nheko/nheko. Still having the same error.EDIT: I am starting to wonder if it is me who is doing something wrong. I am editing /etc/firejail/nheko.profile directly (with sudo). It is that file that is ran when I call "firejail nheko", right?
@ghost commented on GitHub (Mar 19, 2021):
Looks like a complex issue indeed. Alas, for the moment I'm unable to test nheko properly and cannot add anything actually useful here.
That is correct. The only downside of doing it in /etc/firejail/nheko.profile is your changes will be overwritten by a future firejail upgrade. Firejail supports .local overrides too. You can use ${HOME}/.config/firejail for per-user overrides. Anything in there will get picked-up before parsing /etc/profile.
@rusty-snake commented on GitHub (Mar 19, 2021):
@qazip what happens if you
whitelist ${HOME}/.cache?@rusty-snake commented on GitHub (Mar 19, 2021):
Does this still happen if your profile only contains
@qazip commented on GitHub (Mar 19, 2021):
Added that line. Still same error.
@qazip commented on GitHub (Mar 19, 2021):
Same error still.
@rusty-snake commented on GitHub (Mar 19, 2021):
Ok, it is the whitelist, if you run with
mkdir -p nhekohome && firejail --noprofile --private=~/nhekohome nheko. Which directories are created?@qazip commented on GitHub (Mar 19, 2021):
Inside nhekohome, it creates the following: .cache .config .local .Xauthority .zshrc
@rusty-snake commented on GitHub (Mar 19, 2021):
And in .cache .config .local/share (ignore .config/pulse)?
@qazip commented on GitHub (Mar 19, 2021):
@CodeArtisan00 commented on GitHub (Mar 19, 2021):
@qazip I tried with your profile with
private-cachedisabled on Arch.& with firejail there is~/.cache/nheko/nheko/nheko.logbut without firejail~/.cache/nheko/nhekohasqmlcachealong with that.logfile. btw do you have anything in yourglobals.local?@rusty-snake commented on GitHub (Mar 19, 2021):
There are databases but no whitelist for them, so they are dropped when you close nheko => server state and client state differ.
@rusty-snake commented on GitHub (Mar 19, 2021):
fix:
@qazip commented on GitHub (Mar 19, 2021):
I added those lines (other than the one that says to blacklist something that you noblacklisted above? I suppose that was a typo) and it works! Thank you very much!
@rusty-snake commented on GitHub (Mar 19, 2021):
That are the lines we need to add, in the order they are read. Of course will this blacklist go to dp.
@qazip commented on GitHub (Mar 19, 2021):
If I add all the 4 lines, it doesn't fix the error. However, if I only add the following 3, it does fix the error:
However, I added all those 3 (4 before) to the mid of the nheko.profile. Not sure if I should add it elsewhere.