mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4147] Thunderbird in non-default location won't start #2552
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2552
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nolanl on GitHub (Mar 30, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4147
Firejail 0.9.64.4 on Debian Bullseye x86_64
I have thunderbird installed into ${HOME}/bin/upstream/thunderbird with a symlink ${HOME}/bin/thunderbird
When I try to run it under filejail, I get:
Running with --noprofile works normally.
I found #2812 and created a ${HOME}/.config/firejail/thunderbird.local containing:
but that didn't work, and didn't change the output.
Thinking that perhaps the symlink was confusing it (and was a difference in my setup compared to #2812), I tried skipping the symlink and running the executable directly:
So the error has changed to permission denied, which is progress of sorts.
@rusty-snake commented on GitHub (Mar 30, 2021):
This is already moving in the right direction. But if you want to start
${HOME}/bin/thunderbird, you need to whitelist this instead (the symlink is followed IIRC; but it's impossible to follow it backward).And there's a second barrier ...
If this file is owned by you and not a something crazy like FUSE, this sounds like blacklisting. Does
firejail --debug ${HOME}/bin/upstream/thunderbird/thunderbird | grep binshows anything related? Doesfirejail --profile=thunderbird ls -l ~/bin/upstream/thunderbird/thunderbirdlook normal?@nolanl commented on GitHub (Mar 30, 2021):
Adding the symlink to the whitelist and running
$ firejail ${HOME}/thunderbirdstill results in "Error: no suitable /home/nolan/thunderbird executable found".No FUSE, the fs is btrfs, not sure if that qualifies as crazy or not.
Nothing jumps out at me in the debug log:
And the ls -l looks perfectly reasonable.
@rusty-snake commented on GitHub (Mar 30, 2021):
The
Exec failed with error: Permission deniedcomes from https://searchfox.org/comm-central/source/mail/app/no-pie/NoPie.c. Thewhitelistmaybe tampers with/proc/self/exe. Does it work withfirejail --profile=thunderbird ${HOME}/bin/upstream/thunderbird/thunderbird-bin?@nolanl commented on GitHub (Mar 30, 2021):
firejail --profile=thunderbird ${HOME}/bin/upstream/thunderbird/thunderbird-binworks.
I tried adding "whitelist ${HOME}/bin/upstream/thunderbird-bin" to the list, but still got the permission denied error when running their wrapper.
@rusty-snake commented on GitHub (Mar 30, 2021):
Here's an quick-and-dirty readlink for
/proc/self/exe, if you compile it (gcc -o readlinkselfexe readlinkselfexe.c), place it in${HOME}/bin/upstream/thunderbirdand run it withfirejail --profile=thunderbird ${HOME}/bin/upstream/thunderbird/readlinkselfexe. What does it show? And if you symlink it from ~/bin?@nolanl commented on GitHub (Mar 30, 2021):
and
@nolanl commented on GitHub (Mar 30, 2021):
Ah hah! From dmesg:
@nolanl commented on GitHub (Mar 30, 2021):
Doesn't explain why the symlink isn't working, of course.
@nolanl commented on GitHub (Mar 30, 2021):
From Debian's /etc/apparmor.d/firejail-default
I added
and now I get
Error: no suitable /home/nolan/bin/thunderbird executable foundwhen running both the symlink and the wrapper.@rusty-snake commented on GitHub (Mar 30, 2021):
I know not that much about AA but shoudn't it be
home/nolan/bin/**?@nolanl commented on GitHub (Mar 30, 2021):
The mnt/oroot stuff appears to be a firejail thing, but the line I added should match both /run/firejail/mnt/oroot/home/bin/** and /home/bin/**.
@ghost commented on GitHub (Mar 30, 2021):
@nolanl It does, but that won't do much good. It would be surprising to hear
home/bin/thunderbirdactually exists on your system - which is different from ${HOME}/bin/thunderbird.On a side-note, the recommended way to enable this is not to uncomment it in /etc/apparmor.d/firejail-default, which is overwritten by a future firejail upgrade. We could improve the comment to stress doing so in
/etc/apparmor.d/local/firejail-default.@nolanl commented on GitHub (Mar 30, 2021):
Oh, hah, you're right, I totally misread that, and then misunderstood @rusty-snake's comment.
Fixing my apparmor (and the .config/firejail/thunderbird.local fix) makes both the bin/thunderbird symlink and the bin/upstream/thunderbird/thunderbird wrapper work fine.
Yeah, that is where I ended up putting it.
@nolanl commented on GitHub (Mar 30, 2021):
Thank you @rusty-snake and @glitsj16 for your help tracking this down!
And to hopefully draw in any folks searching because they have the same problem with firefox: firefox firefox firefox