mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4367] gimp 2.10.22-3: gegl:introspect broken #2638
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2638
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @themahnamahna on GitHub (Jun 21, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4367
when starting gimp via firejail (default profile, no modifications, filedate in /etc/firejail all feb 8th) I get the error from gimp:
"GEGL operation missing!
GIMP requires the GEGL operation "gegl:introspect".
This operation cannot be found. Check your
GEGL install and ensure it has been compiled
with any dependencies required for GIMP."
gimp to start up properly
No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?/usr/bin/vlc)?works flawlessly, both versions
Environment
lsb_release -a,screenfetchorcat /etc/os-release)No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.04
Release: 21.04
Codename: hirsute
(with 20.10 everything worked, so something in ubuntu 21.04 changed with the update yesterday)
firejail --version) exclusive or used git commit (git rev-parse HEAD)firejail version 0.9.64.4
Additional context
Other context about the problem like related errors to understand the problem.
Checklist
https://github.com/netblue30/firejail/issues/1139)LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.debug output
could I email this? it's 2200 lines!
I grepped for "gegl";
Removed whitelist/nowhitelist path: whitelist /usr/share/gegl-0.4
expanded: /usr/share/gegl-0.4
Not blacklist /home/elcondor/.cache/gegl-0.4
Debug 456: new_name #/usr/share/gegl-0.4#, whitelist
Removed whitelist/nowhitelist path: whitelist /usr/share/gegl-0.4
expanded: /usr/share/gegl-0.4
Not blacklist /home/elcondor/.cache/gegl-0.4
strange thing: there is no "/usr/share/gegl-0.4" anymore. I tried to whitelist /usr/lib/x86_64-linux-gnu/gegl-0.4 (which contains lots of .so files) but get
Error: invalid whitelist path /usr/lib/x86_64-linux-gnu/gegl-0.4
sorry not to be more specific, let me know what else you need or what I should try.
thanks in advance (and overall for the great software!)
@rusty-snake commented on GitHub (Jun 22, 2021):
Is anything in the syslog (watch
journalctl --boot --pager-end --followwhile starting gimp)? (Do you have an AMD-GPU?)That's why there are the details-summary tags.
@rusty-snake commented on GitHub (Aug 4, 2021):
I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
@themahnamahna commented on GitHub (Sep 7, 2021):
sorry, I didn't get the notification that you replied.
@themahnamahna commented on GitHub (Sep 7, 2021):
I just found out, that I hadn't updated - was on 0.9.64, updated to 0.9.66 (vie PPA)
now nothing works anymore (calling gimp just as an example):
I updated all configs to the one that came from the repo. had to remove all links in /usr/local/bin/ to be able to start anything covered by firejail :(
Seems I broke it something completely ..
@rusty-snake commented on GitHub (Sep 7, 2021):
ls -l /usr/bin/firejail?@themahnamahna commented on GitHub (Sep 7, 2021):
-rwxr-xr-x 1 root root 462528 Jul 11 12:00 /usr/bin/firejailfound the following in journalctl:
@rusty-snake commented on GitHub (Sep 7, 2021):
firejail must be SUID.
sudo chmod u+s /usr/bin/firejailto fix this.@themahnamahna commented on GitHub (Sep 7, 2021):
works! thanks!
(had to fix some other configs due to new default restrictions, but everything else (I need) seems to run fine)
.. except for gimp, so back to square 1 there (sorry for the detour)
starting works with
firejail --noprofile gimpbut fails with the originally mention "GEGL operation missing!" error.--debug log is at https://pastebin.com/raw/5HsfAKA1
@rusty-snake commented on GitHub (Sep 7, 2021):
What's in it.
So you get this error even with noprofile?
Markdown:
Rendered:
debug output
@themahnamahna commented on GitHub (Sep 7, 2021):
debug output
EDIT by @rusty-snake: add code-block
@rusty-snake commented on GitHub (Sep 7, 2021):
Put it in a code-block (
```) to prevent markdown interpretation.@themahnamahna commented on GitHub (Sep 7, 2021):
yes, but it's completely empty :) (0 byte, leftover from failing with experimenting)
@rusty-snake commented on GitHub (Sep 7, 2021):
I'm out of idea for now. Try to see what
--buildgives you and if that does not point out things, comment the profile and uncomment it line for line.@themahnamahna commented on GitHub (Sep 7, 2021):
with
--buildit starts without problems, when exiting gimp (windows is gone) the process is still in background:I will go through the gimp.profile now
@themahnamahna commented on GitHub (Sep 7, 2021):
fixing it can be done by commenting line 426 and 428 in disable-common.inc:
then startup of gimp works. ( /sbin is just a symlink to /usr/sbin)
there are ~400 binaries (excluding symlinks) in /usr/sbin, in the debug log ~100 of those listed, so I tried to
disable-common.incas it was with both sbins blacklistedand
gimp.localwith eithernoblacklistorwhitelistfor those 100 binaries from debug log (likewhitelist /usr/sbin/ld, both /sbin and /usr/sbin)but doesn't change anything, still get the error.
Can this be traced better? or how else can I remove blacklisting for single files?
@rusty-snake commented on GitHub (Sep 7, 2021):
So
fixes it, right?
@themahnamahna commented on GitHub (Sep 7, 2021):
yes, just wanted to find out WHICH binary it requires, not allow whole sbin - but that's more interest than requirement.
thank you for the support! (und lass mich wissen, wie ich dir ein bier zukommen lassen kann ;) )
@rusty-snake commented on GitHub (Sep 7, 2021):
try
--traceor strace@themahnamahna commented on GitHub (Sep 7, 2021):
I found the culprit:
gimp seems to require
/usr/bin/dotwhich is a symlink to/usr/sbin/libgvc6-config-updatebut adding
noblacklist /usr/sbin/libgvc6-config-updateto gimp.local does not work.
but it's definitely that file that causes the problem, after removing the symlink and
sudo cp /usr/sbin/libgvc6-config-update /usr/bin/dotgimp starts with no need to change any firejail config.