github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4508] telegram.profile breaks download, open links und tray icon #2687

New issue

Closed

opened 2026-05-05 09:20:53 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:20:53 -06:00

Owner

Originally created by @Schweber on GitHub (Sep 4, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4508

Using the default telegram.profile, i cannot download files, cannot open links and another tray icon is added every time i re-open the telegram window.

I expect all of this to work out of the box.

I created a telegram.local file whitelisting my download directory but this doesn't change anything. Running telegram-desktop without firejail works fine.

I am running Manjaro Cinnamon 21.1.1 with Kernel 5.10.60-1 and firejail 0.9.66 (no git-version).

Checklist

The profile (and redirect profile if exists) hasn't already been fixed upstream.
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
I have performed a short search for similar issues (to avoid opening a duplicate).
If it is a AppImage, --profile=PROFILENAME is used to set the right profile.
Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

Log

debug output.txt

Originally created by @Schweber on GitHub (Sep 4, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4508 Using the default telegram.profile, i cannot download files, cannot open links and another tray icon is added every time i re-open the telegram window. I expect all of this to work out of the box. I created a telegram.local file whitelisting my download directory but this doesn't change anything. Running telegram-desktop without firejail works fine. I am running Manjaro Cinnamon 21.1.1 with Kernel 5.10.60-1 and firejail 0.9.66 (no git-version). ### Checklist - [X] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [X] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [X] I have performed a short search for similar issues (to avoid opening a duplicate). - [X] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. - [X] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. - [X] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [X] This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions. ### Log [debug output.txt](https://github.com/netblue30/firejail/files/7109396/debug.output.txt)

gitea-mirror

2026-05-05 09:20:53 -06:00

closed this issue
added the
notabug
label

gitea-mirror commented

2026-05-05 09:20:56 -06:00

Author

Owner

@jose1711 commented on GitHub (Feb 9, 2022):

Unable to reproduce the issue with tray icon on Arch Linux and firejail from git (a6672757d1).

@jose1711 commented on GitHub (Feb 9, 2022): Unable to reproduce the issue with tray icon on Arch Linux and `firejail` from git (a6672757d1d884d02538ac3f92b13f997ee3efbb).

gitea-mirror commented

2026-05-05 09:20:56 -06:00

Author

Owner

@davidebeatrici commented on GitHub (Feb 14, 2022):

I cannot reproduce on KDE, with firejail 0.9.68 and Telegram Desktop 3.4.8.

However, I have to add the following to the local profile in order for the tray icon to work:

dbus-user filter
dbus-user.talk org.kde.StatusNotifierWatcher
ignore dbus-user none

The message that appears when the D-Bus message is not allowed:

kf.notifications: env says KDE is running but SNI unavailable -- check KDE_FULL_SESSION and XDG_CURRENT_DESKTOP

@davidebeatrici commented on GitHub (Feb 14, 2022): I cannot reproduce on KDE, with firejail 0.9.68 and Telegram Desktop 3.4.8. However, I have to add the following to the local profile in order for the tray icon to work: ``` dbus-user filter dbus-user.talk org.kde.StatusNotifierWatcher ignore dbus-user none ``` The message that appears when the D-Bus message is not allowed: ``` kf.notifications: env says KDE is running but SNI unavailable -- check KDE_FULL_SESSION and XDG_CURRENT_DESKTOP ```

gitea-mirror commented

2026-05-05 09:20:57 -06:00

Author

Owner

@kmk3 commented on GitHub (Feb 14, 2022):

@davidebeatrici commented on Feb 14:

I cannot reproduce on KDE, with firejail 0.9.68 and Telegram Desktop 3.4.8.

However, I have to add the following to the local profile in order for the
tray icon to work:
dbus-user filter
dbus-user.talk org.kde.StatusNotifierWatcher
ignore dbus-user none

From telegram.profile on 0.9.68:

dbus-user filter
dbus-user.own org.telegram.desktop.*
dbus-user.talk org.freedesktop.Notifications
?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher

Does it work with allow-tray = yes on /etc/firejail/firejail.config and
nothing on the local profile?

Relates to #4510.

@kmk3 commented on GitHub (Feb 14, 2022): @davidebeatrici commented [on Feb 14](https://github.com/netblue30/firejail/issues/4508#issuecomment-1039177368): > I cannot reproduce on KDE, with firejail 0.9.68 and Telegram Desktop 3.4.8. > > However, I have to add the following to the local profile in order for the > tray icon to work: > > ``` > dbus-user filter > dbus-user.talk org.kde.StatusNotifierWatcher > ignore dbus-user none > ``` From telegram.profile on 0.9.68: ```firejail dbus-user filter dbus-user.own org.telegram.desktop.* dbus-user.talk org.freedesktop.Notifications ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher ``` Does it work with `allow-tray = yes` on /etc/firejail/firejail.config and nothing on the local profile? --- Relates to #4510.

gitea-mirror commented

2026-05-05 09:20:59 -06:00

Author

Owner

@davidebeatrici commented on GitHub (Feb 14, 2022):

Confirmed, thanks!

Shouldn't allow-tray be enabled by default?

@davidebeatrici commented on GitHub (Feb 14, 2022): Confirmed, thanks! Shouldn't `allow-tray` be enabled by default?

gitea-mirror commented

2026-05-05 09:21:00 -06:00

Author

Owner

@kmk3 commented on GitHub (Feb 14, 2022):

@davidebeatrici commented on Feb 14:

Confirmed, thanks!

No problem. Closing this as fixed as of 0.9.68.

Shouldn't allow-tray be enabled by default?

It appears that org.kde.StatusNotifierWatcher is unsafe / allows escaping the
sandbox (thus it's hidden behind allow-tray); see:

#4053

@kmk3 commented on GitHub (Feb 14, 2022): @davidebeatrici commented [on Feb 14](https://github.com/netblue30/firejail/issues/4508#issuecomment-1039683330): > Confirmed, thanks! No problem. Closing this as fixed as of 0.9.68. > Shouldn't `allow-tray` be enabled by default? It appears that `org.kde.StatusNotifierWatcher` is unsafe / allows escaping the sandbox (thus it's hidden behind `allow-tray`); see: * #4053

gitea-mirror referenced this issue

2026-05-05 10:20:58 -06:00

[PR #2687] [MERGED] Update keepassxc.profile #4483

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2687

No description provided.

Rows
Columns