github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4589] Can't find libstdc++.so.6 due to private-etc and private-lib in aria2c.profile #2714

New issue

Closed

opened 2026-05-05 09:22:41 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:22:41 -06:00

Owner

Originally created by @crocket on GitHub (Oct 5, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4589

Description

This aria2c.local file works around the issue

private-etc ld.so.cache
ignore private-lib

private-lib eliminates /usr/lib/gcc by mounting tmpfs on /usr/lib.
/etc/ld.so.cache is necessary for finding libstdc++.so.6 in /usr/lib/gcc.

Environment

Linux distribution and version // Gentoo Linux
Firejail version (firejail --version).

firejail --version
firejail version 0.9.66

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file and directory whitelisting support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

Originally created by @crocket on GitHub (Oct 5, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4589 ### Description This aria2c.local file works around the issue ``` private-etc ld.so.cache ignore private-lib ``` private-lib eliminates /usr/lib/gcc by mounting tmpfs on /usr/lib. /etc/ld.so.cache is necessary for finding libstdc++.so.6 in /usr/lib/gcc. ### Environment - Linux distribution and version // Gentoo Linux - Firejail version (`firejail --version`). ``` firejail --version firejail version 0.9.66 Compile time support: - always force nonewprivs support is disabled - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is disabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ```

gitea-mirror closed this issue

2026-05-05 09:22:42 -06:00

gitea-mirror commented

2026-05-05 09:22:43 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 5, 2021):

ignore private-lib

We have private-lib …,gcc/*/*/libstdc++.so.*,… already in other profiles, maybe we should just hardcode it?

private-etc ld.so.cache

to sum up:

always necessary: alternatives,ld.so.cache,ld.so.preload
always necessary if there is no net none: ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl
- crypto-policies,pki,ssl can be future restricted to use subdirs

@rusty-snake commented on GitHub (Oct 5, 2021): > ignore private-lib We have `private-lib …,gcc/*/*/libstdc++.so.*,…` already in other profiles, maybe we should just hardcode it? > private-etc ld.so.cache to sum up: - _always_ necessary: `alternatives,ld.so.cache,ld.so.preload` - _always_ necessary if there is no `net none`: `ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl` - `crypto-policies,pki,ssl` can be future restricted to use subdirs

gitea-mirror commented

2026-05-05 09:22:44 -06:00

Author

Owner

@crocket commented on GitHub (Oct 5, 2021):

Perhaps, you could put those in something like /etc/firejail/globals.inc and put include globals.inc in every profile in /etc/firejail?

@crocket commented on GitHub (Oct 5, 2021): Perhaps, you could put those in something like /etc/firejail/globals.inc and put `include globals.inc` in every profile in /etc/firejail?

gitea-mirror commented

2026-05-05 09:22:46 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 5, 2021):

Nope, because not every profiles uses private-etc. I solved this in my overrides with include private-etc:net.inc. Anyway we need private-etc groups like for seccomp (private-etc @network,fonts,...). cloudn't find the issue for it

@rusty-snake commented on GitHub (Oct 5, 2021): Nope, because not every profiles uses `private-etc`. I solved this in my overrides with `include private-etc:net.inc`. Anyway we need private-etc groups like for seccomp (`private-etc @network,fonts,...`). _cloudn't find the issue for it_

gitea-mirror commented

2026-05-05 09:22:47 -06:00

Author

Owner

@crocket commented on GitHub (Oct 5, 2021):

Perhaps, something like this in /etc/firejail/globals.inc can work.

?HAS_PRIVATE_ETC: private-etc alternatives,ld.so.cache,ld.so.preload

@crocket commented on GitHub (Oct 5, 2021): Perhaps, something like this in /etc/firejail/globals.inc can work. ``` ?HAS_PRIVATE_ETC: private-etc alternatives,ld.so.cache,ld.so.preload ```

gitea-mirror commented

2026-05-05 09:22:48 -06:00

Author

Owner

@crocket commented on GitHub (Oct 29, 2021):

I don't think testing profiles is the definite solution because people are going to have private profiles that are not subject to tests.

People will still keep submitting profiles without required files, and you will have to explain every time. That's why it's not the definite solution.

The solution would eradicate the possibility of a wrong profile. Perhaps, private-etc should implicitly add required files, and man page should explain private-etc automatically adds required files.

@crocket commented on GitHub (Oct 29, 2021): I don't think testing profiles is the definite solution because people are going to have private profiles that are not subject to tests. People will still keep submitting profiles without required files, and you will have to explain every time. That's why it's not the definite solution. The solution would eradicate the possibility of a wrong profile. Perhaps, private-etc should implicitly add required files, and man page should explain private-etc automatically adds required files.

gitea-mirror referenced this issue

2026-05-05 10:21:10 -06:00

[PR #2714] [MERGED] Add meteo-qt info #4495

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2714

No description provided.

Rows
Columns