mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4422] nuclear: does not work with --no-sandbox #2663
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2663
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mYnDstrEAm on GitHub (Jul 26, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4422
#3883 and #3806 could be related
When running
firejail --profile=/etc/firejail/nuclear.profile nuclearI getThe SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /opt/nuclear/chrome-sandbox is owned by root and has mode 4755.When appending
--no-sandboxto the command it shows these errors:Is there another way one is supposed to solve this electron problem or is the nuclear.profile broken?
Bug and expected behavior
It should run the Nuclear music player or display an error message that tells the user exactly what to do / run to make it work.
No profile and disabling firejail
Reproduce
Steps to reproduce the behavior:
Environment
Debian10 stable
Firejail version 0.9.64.4
Additional context
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.@rusty-snake commented on GitHub (Jul 26, 2021):
Did you set
force-nonewprivs yes?Do you have a globals.local or nuclear.local or electron.local?
What do you get with
firejail --ignore=no3d nuclear --no-sandbox?@mYnDstrEAm commented on GitHub (Jul 26, 2021):
No, I didn't.
No, I didn't have a nuclear.local.
I get this:
@rusty-snake commented on GitHub (Jul 26, 2021):
The "The SUID sandbox helper binary was found, but is not configured correctly." Issue should be gone since
f4f6767458. What doesfirejail --profile=nuclear cat /proc/self/status | grep NoNewPrivsshow? (It should be and must beNoNewPrivs: 0).Does it work with
--noprofile? Does--ignore=apparmorhelp?nuclear.profile has
noblacklist ${HOME}/.config/nuclear. From where does this come (check--debug)?@mYnDstrEAm commented on GitHub (Jul 26, 2021):
NoNewPrivs: 1Should I set that in nuclear.local?
I'm using Firejail version 0.9.64.4 from Debian10 backports.
--debugdoesn't have more info as far as I could see and shows just the same error messag at the end (it also has things likeInstalling /run/firejail/mnt/seccomp/seccomp.protocol seccomp filterbefore).@rusty-snake commented on GitHub (Jul 26, 2021):
Why does it install a seccomp filter? It should not do this. It must not do this.
@rusty-snake commented on GitHub (Jul 26, 2021):
There is no
protocolinFrom where does it come?
@mYnDstrEAm commented on GitHub (Jul 26, 2021):
The two profiles match those in the repo and there is no electron.local or nuclear.local (well I just created that file but it doesn't contain anything; I copy-pasted their contents to make sure they are the same). How to find out from where it comes?
I edited the issue description to show the complete error which takes a while to load. The nuclear I installed via .deb file is v0.6.6 (sha256sum
e18b2b00f136b0f5b0642cd34a08938771d90bcd47012b77a5d34202173e02a1).@mYnDstrEAm commented on GitHub (Jul 26, 2021):
firejail --ignore=apparmor --ignore=no3d --profile=/etc/firejail/nuclear.profile nuclear --no-sandboxdoesn't work either. Are those error messages of any use in finding the cause of this? Why does the SQLite package fail?@rusty-snake commented on GitHub (Jul 26, 2021):
Because it talks about js files and npm you maybe need to allow this stuff (
ignore include disable-interpreters.incandignore include disable-programs.incfor now). Anyway I'm still thinking why NNP is set/from where the protocol seccomp filters come. Can you post the--debugoutput.@mYnDstrEAm commented on GitHub (Jul 26, 2021):
Output of the above command:
@rusty-snake commented on GitHub (Jul 26, 2021):
It must not do this.
Can you post the first lines, e.g which files it reads.
@mYnDstrEAm commented on GitHub (Jul 26, 2021):
Sure, would have posted them already if there was something strange in there (electron.profile and nuclear.profile have their default content)
@rusty-snake commented on GitHub (Jul 26, 2021):
This is empty as I got you
and this must only contain
whitelist /var/foobarbazcommands.@mYnDstrEAm commented on GitHub (Jul 26, 2021):
Yes, it's empty...I even moved out #commented out lines.
I don't think I created a whitelist-var-common.inc file so it must have been created by default and I didn't change it. It only includes whitelists of /var/ directories and includes whitelist-var-common.local (which doesn't exist).
@rusty-snake commented on GitHub (Jul 30, 2021):
Neither firejail nor your package manager write to $HOME/.config/firejail resp. $HOME. Anyway "It only includes whitelists of /var/ directories".
@mYnDstrEAm commented on GitHub (Aug 3, 2021):
I'm sure that I haven't created that file or only created it because it was part of some guide to get something to work with the file's contents to be pasted in or the file to be copied but forgot about it. This is the file's contents, I don't think it's why it doesn't run:
/home/username/.config/firejail/whitelist-var-common.local doesn't exist. Any ideas how to get Nuclear to work? Also attaching
--disable-setuid-sandboxisn't needed right?/etc/firejail/whitelist-var-common.inc has the following contents:
@rusty-snake commented on GitHub (Aug 3, 2021):
What does the disable-common.local contain?
@mYnDstrEAm commented on GitHub (Aug 3, 2021):
Only
blacklist ${HOME}/...entriesNone of those directories is used by Nuclear. I didn't even block blacklist ${HOME}/Music for example. (caps.drop all and apparmor are #commented out).
@rusty-snake commented on GitHub (Aug 3, 2021):
In disable-common.local? Since when?
@mYnDstrEAm commented on GitHub (Aug 3, 2021):
I think since before I recently tried to get Nuclear running again. It was just a note that's most likely irrelevant as these are commented out anyway but it's what I'd try to (re)include if everything works fine otherwise.
@rusty-snake commented on GitHub (Aug 3, 2021):
So it was already commented when you got "Dropping all capabilities".
Btw does it work without firejail or with --noprofile?
@mYnDstrEAm commented on GitHub (Aug 3, 2021):
I commented it out at this point. The output of
firejail --debug --ignore=apparmor --ignore=no3d --profile=/etc/firejail/nuclear.profile nuclear --no-sandboxis slightly different:Haven't tried running it without a firejail profile and it doesn't seem like there's an easy way to generate a VM of the current system.
@mYnDstrEAm commented on GitHub (Sep 20, 2021):
Now it does start but it still shows these errors (and takes a bit too long to launch).
Furthermore the nuclear.local profile file in /home/username/.config/firejail directory wasn't just commented out lines anymore but had the following contents I didn't write`(they are different from the contents here):
So I think this file was generated / overwritten somehow (however its metadata has modified & created in June 2020).
Maybe it's working now because of the upgrade from Debian 10 to 11. Looks like the issue can be closed.
The output of
firejail nuclearnow is:(After
at Object.emit (events.js:315:20)it's taking too long to load, and I don't know what those errors are about.)