#2683 - [GH-ISSUE #4494] skypeforlinux - systray icon not shown - github-starred/firejail

gitea-mirror commented

2026-05-05 09:20:39 -06:00

Owner

Originally created by @T200proX7 on GitHub (Aug 30, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4494

I found out that skypeforlinux has a /usr/bin/skypeforlinux (shellscript) that sets some envs and then starts /usr/share/skypeforlinux/skypeforlinux.

If you set directly in skype "starts on system startup" then skype sets a skypeforlinux.desktop file in the .config/autostart/ pointing directly to /usr/share/skypeforlinux/skypeforlinux -> circumvent firejail.

So i changed the path in the autostart file and prevent to be overwritten with chattr +i.

Now skype is starting obviously in the jail (at it looks like using ps aux | grep firejail, though there are several other processes without firejail upfront), but the problem is there are no icons in the systray.

I checked the filesystem for icons and it looks like that the icons itself are contained somehow in the skypeforlinux (electron binary) and it seems that the appindicator is not able to find these icons. (without firejail icons are shown perfectly)

Originally created by @T200proX7 on GitHub (Aug 30, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4494 I found out that skypeforlinux has a /usr/bin/skypeforlinux (shellscript) that sets some envs and then starts /usr/share/skypeforlinux/skypeforlinux. If you set directly in skype "starts on system startup" then skype sets a skypeforlinux.desktop file in the .config/autostart/ pointing directly to /usr/share/skypeforlinux/skypeforlinux -> circumvent firejail. So i changed the path in the autostart file and prevent to be overwritten with chattr +i. Now skype is starting obviously in the jail (at it looks like using ps aux | grep firejail, though there are several other processes without firejail upfront), but the problem is there are no icons in the systray. I checked the filesystem for icons and it looks like that the icons itself are contained somehow in the skypeforlinux (electron binary) and it seems that the appindicator is not able to find these icons. (without firejail icons are shown perfectly)

gitea-mirror

2026-05-05 09:20:39 -06:00

closed this issue
added the
duplicate
label

gitea-mirror commented

2026-05-05 09:20:42 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 31, 2021):

Duplicate of #1137?

@rusty-snake commented on GitHub (Aug 31, 2021): Duplicate of #1137?

gitea-mirror commented

2026-05-05 09:20:43 -06:00

Author

Owner

@yderi commented on GitHub (Oct 18, 2021):

Hello everyone

Are there any updates on how to fix it?

Currently, I'm using --nodbus as a workaround to show the Skype icon in the tray.
Don't know how much it worsens the security.

Currently in use:
firejail version 0.9.66
skypeforlinux version: 8.77
Ubuntu 21.10

@yderi commented on GitHub (Oct 18, 2021): Hello everyone Are there any updates on how to fix it? Currently, I'm using **--nodbus** as a workaround to show the Skype icon in the tray. Don't know how much it worsens the security. Currently in use: firejail version 0.9.66 skypeforlinux version: 8.77 Ubuntu 21.10

gitea-mirror commented

2026-05-05 09:20:45 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 18, 2021):

Currently, I'm using --nodbus as a workaround to show the Skype icon in the tray.
Don't know how much it worsens the security.

--nodbus increases security.

@rusty-snake commented on GitHub (Oct 18, 2021): > Currently, I'm using --nodbus as a workaround to show the Skype icon in the tray. Don't know how much it worsens the security. `--nodbus` increases security.

gitea-mirror commented

2026-05-05 09:20:46 -06:00

Author

Owner

@yderi commented on GitHub (Oct 18, 2021):

So, currently, if I start like:
firejail --nodbus /usr/bin/skypeforlinux %U
it works, but requires authentication every time you quit the Skype.

@yderi commented on GitHub (Oct 18, 2021): So, currently, if I start like: firejail --nodbus /usr/bin/skypeforlinux %U it works, but requires authentication every time you quit the Skype.

gitea-mirror commented

2026-05-05 09:20:47 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 18, 2021):

Ok, the skype flatpak uses

dbus-user filter
dbus-user.own com.skype.Client
dbus-user.talk ca.desrt.dconf
dbus-user.talk org.kde.StatusNotifierWatcher
dbus-user.talk org.gtk.Notifications
dbus-user.talk org.freedesktop.Notifications
dbus-user.talk com.canonical.AppMenu.Registrar
dbus-user.talk org.gnome.GConf
dbus-user.talk org.freedesktop.secrets
dbus-system filter
dbus-system.talk org.freedesktop.NetworkManager
dbus-system.talk org.freedesktop.login1
dbus-system.talk org.bluez

which is 1. over permissive and 2. contains permissions that are very likely not used.
So can you try this (put it in ~/.config/firejail/skypeforlinux.local and start without --nodbus)

dbus-user filter
dbus-user.talk org.kde.StatusNotifierWatcher
dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.secrets
dbus-system none

@rusty-snake commented on GitHub (Oct 18, 2021): Ok, the skype flatpak uses ``` dbus-user filter dbus-user.own com.skype.Client dbus-user.talk ca.desrt.dconf dbus-user.talk org.kde.StatusNotifierWatcher dbus-user.talk org.gtk.Notifications dbus-user.talk org.freedesktop.Notifications dbus-user.talk com.canonical.AppMenu.Registrar dbus-user.talk org.gnome.GConf dbus-user.talk org.freedesktop.secrets dbus-system filter dbus-system.talk org.freedesktop.NetworkManager dbus-system.talk org.freedesktop.login1 dbus-system.talk org.bluez ``` which is 1. over permissive and 2. contains permissions that are very likely not used. So can you try this (put it in `~/.config/firejail/skypeforlinux.local` and start without `--nodbus`) ``` dbus-user filter dbus-user.talk org.kde.StatusNotifierWatcher dbus-user.talk org.freedesktop.Notifications dbus-user.talk org.freedesktop.secrets dbus-system none ```

gitea-mirror commented

2026-05-05 09:20:48 -06:00

Author

Owner

@yderi commented on GitHub (Oct 18, 2021):

Created a local profile as you suggested, but then no icon in the system tray. So it is where we began from.
starting app as following:
firejail /usr/bin/skypeforlinux %U

@yderi commented on GitHub (Oct 18, 2021): Created a local profile as you suggested, but then no icon in the system tray. So it is where we began from. starting app as following: firejail /usr/bin/skypeforlinux %U

gitea-mirror commented

2026-05-05 09:20:49 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 18, 2021):

Then try to extend it with dbus-user.own com.skype.Client (IDK if this is the right) and dbus-user.own org.kde.*. If this does not work, we either need a different name for the first own rule or change filesystem commands.

@rusty-snake commented on GitHub (Oct 18, 2021): Then try to extend it with `dbus-user.own com.skype.Client` (IDK if this is the right) and `dbus-user.own org.kde.*`. If this does not work, we either need a different name for the first own rule or change filesystem commands.

gitea-mirror commented

2026-05-05 09:20:50 -06:00

Author

Owner

@yderi commented on GitHub (Oct 18, 2021):

Still no luck with either of them. Mean it starts but no systray icon is present.

@yderi commented on GitHub (Oct 18, 2021): Still no luck with either of them. Mean it starts but no systray icon is present.

gitea-mirror commented

2026-05-05 09:20:51 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 18, 2021):

Then try to ignore private-tmp (#1137).

@rusty-snake commented on GitHub (Oct 18, 2021): Then try to `ignore private-tmp` (#1137).

gitea-mirror commented

2026-05-05 09:20:51 -06:00

Author

Owner

@yderi commented on GitHub (Oct 18, 2021):

simply adding the statement:
ignore private-tmp

into the :
~/.config/firejail/skypeforlinux.local

allows starting the Skype and shows the systray icon.

Don't know what way is more secure in skypeforlinux.local

using statement ignore private-tmp
or use the

mkdir /tmp/FOO-tmp
whitelist /tmp/FOO-tmp
env TMPDIR=/tmp/FOO-tmp
env TMP=/tmp/FOO-tmp

@yderi commented on GitHub (Oct 18, 2021): simply adding the statement: `ignore private-tmp` into the : `~/.config/firejail/skypeforlinux.local` allows starting the Skype and shows the systray icon. Don't know what way is more secure in `skypeforlinux.local` 1. using statement `ignore private-tmp` 2. or use the ``` mkdir /tmp/FOO-tmp whitelist /tmp/FOO-tmp env TMPDIR=/tmp/FOO-tmp env TMP=/tmp/FOO-tmp ```

gitea-mirror commented

2026-05-05 09:20:52 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 18, 2021):

If this works, it is the most secure one we have so far.

dbus-user filter
dbus-user.talk org.kde.StatusNotifierWatcher
dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.secrets
dbus-system none

mkdir /tmp/skype
whitelist /tmp/skype
env TMPDIR=/tmp/skype
env TMP=/tmp/skype

closing as duplicate of #1137.

@rusty-snake commented on GitHub (Oct 18, 2021): If this works, it is the most secure one we have so far. ``` dbus-user filter dbus-user.talk org.kde.StatusNotifierWatcher dbus-user.talk org.freedesktop.Notifications dbus-user.talk org.freedesktop.secrets dbus-system none mkdir /tmp/skype whitelist /tmp/skype env TMPDIR=/tmp/skype env TMP=/tmp/skype ``` closing as duplicate of #1137.

gitea-mirror commented

2026-05-05 09:20:52 -06:00

Author

Owner

@yderi commented on GitHub (Oct 18, 2021):

I Confirm, the statement above works in my configuration (using skypeforlinux.local).

@yderi commented on GitHub (Oct 18, 2021): I Confirm, the statement above works in my configuration (using `skypeforlinux.local`).

Rows
Columns

[GH-ISSUE #4494] skypeforlinux - systray icon not shown #2683