github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #4626] Strange issue with xonotic.profile on Arch #2728

New issue
Closed
opened 2026-05-05 09:23:33 -06:00 by gitea-mirror · 12 comments
gitea-mirror commented 2026-05-05 09:23:33 -06:00
Owner
Copy link

Originally created by @jose1711 on GitHub (Oct 19, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4626

Can't wrap my head around this 😞 Updated Arch Linux, xonotic installed from community repo, latest firejail from master. There are 3 binaries in /usr/bin:

/usr/bin/xonotic-dedicated: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7d9e228eb4389da867dbcb6d5c02674c2a375c0b, for GNU/Linux 3.2.0, stripped
/usr/bin/xonotic-glx:       ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=e2f4d1533ef8c2b67aa6103485b12e42cbf9e9c2, for GNU/Linux 3.2.0, stripped
/usr/bin/xonotic-sdl:       ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1726aef21639cca734120f22a8cfe094b46911d3, for GNU/Linux 3.2.0, stripped

The profile defines a private-bin as follows:

private-bin blind-id,darkplaces-glx,darkplaces-sdl,dirname,ldd,netstat,ps,readlink,sh,uname,xonotic*

If I run the game I get:

$ xonotic-sdl
Error: cannot find the program in the path

This is odd so I change xonotic* to xonotic-sdl. Now the game starts. I revert the change and run a bash inside the profile. Inside it I can see that all 3 files were copied as expected

$ firejail --profile=xonotic-sdl bash
bash-5.1$ echo /usr/bin/*xonotic*
/usr/bin/xonotic-dedicated /usr/bin/xonotic-glx /usr/bin/xonotic-sdl

So it looks like the globbing worked. Any idea where is this coming from?

Originally created by @jose1711 on GitHub (Oct 19, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4626 Can't wrap my head around this :disappointed: Updated Arch Linux, `xonotic` installed from community repo, latest `firejail` from master. There are 3 binaries in `/usr/bin`: ``` /usr/bin/xonotic-dedicated: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=7d9e228eb4389da867dbcb6d5c02674c2a375c0b, for GNU/Linux 3.2.0, stripped /usr/bin/xonotic-glx: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=e2f4d1533ef8c2b67aa6103485b12e42cbf9e9c2, for GNU/Linux 3.2.0, stripped /usr/bin/xonotic-sdl: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=1726aef21639cca734120f22a8cfe094b46911d3, for GNU/Linux 3.2.0, stripped ``` The profile defines a `private-bin` as follows: ``` private-bin blind-id,darkplaces-glx,darkplaces-sdl,dirname,ldd,netstat,ps,readlink,sh,uname,xonotic* ``` If I run the game I get: ``` $ xonotic-sdl Error: cannot find the program in the path ``` This is odd so I change `xonotic*` to `xonotic-sdl`. Now the game starts. I revert the change and run a bash inside the profile. Inside it I can see that all 3 files were copied as expected ``` $ firejail --profile=xonotic-sdl bash bash-5.1$ echo /usr/bin/*xonotic* /usr/bin/xonotic-dedicated /usr/bin/xonotic-glx /usr/bin/xonotic-sdl ``` So it looks like the globbing worked. Any idea where is this coming from?
gitea-mirror 2026-05-05 09:23:33 -06:00
  • closed this issue
  • added the
    bug
         label
gitea-mirror commented 2026-05-05 09:23:35 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Oct 20, 2021):

Any idea where is this coming from?

$ git grep "cannot find the program in the path"
src/firejail/run_symlink.c:             fprintf(stderr, "Error: cannot find the program in the path\n");

void run_symlink(int argc, char **argv, int run_as_is) {
    ...
    char *p = find_in_path(program);
    if (!p) {
        fprintf(stderr, "Error: cannot find the program in the path\n");
        exit(1);
    }
    ...

Can you run firejail --debug /usr/bin/xonotic-sdl.

What does which -a xonotic-sdl show?
Maybe 7a1dd38c broke it? cc @smitsohu

<!-- gh-comment-id:947371301 --> @rusty-snake commented on GitHub (Oct 20, 2021): > Any idea where is this coming from? ```console $ git grep "cannot find the program in the path" src/firejail/run_symlink.c: fprintf(stderr, "Error: cannot find the program in the path\n"); ``` ```C void run_symlink(int argc, char **argv, int run_as_is) { ... char *p = find_in_path(program); if (!p) { fprintf(stderr, "Error: cannot find the program in the path\n"); exit(1); } ... ``` Can you run `firejail --debug /usr/bin/xonotic-sdl`. What does `which -a xonotic-sdl` show? Maybe 7a1dd38c broke it? cc @smitsohu
gitea-mirror commented 2026-05-05 09:23:36 -06:00
Author
Owner
Copy link

@SkewedZeppelin commented on GitHub (Oct 20, 2021):

I noticed this a few months ago on Fedora 34.
Had to revert the wildcard.

-rw-r--r--. 1 root root 1.4K Aug 20 11:31 /etc/firejail/xonotic.profile
<!-- gh-comment-id:947373610 --> @SkewedZeppelin commented on GitHub (Oct 20, 2021): I noticed this a few months ago on Fedora 34. Had to revert the wildcard. ``` -rw-r--r--. 1 root root 1.4K Aug 20 11:31 /etc/firejail/xonotic.profile ```
gitea-mirror commented 2026-05-05 09:23:38 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Oct 20, 2021):

Tried to revert 7a1dd38c51 but it's still the same. Maybe we want to go back from xonotic* to explicitly naming the files? (partially revert 41f69f7a74)

<!-- gh-comment-id:947647870 --> @jose1711 commented on GitHub (Oct 20, 2021): Tried to revert https://github.com/netblue30/firejail/commit/7a1dd38c5155bf833e62a55aab56450b8377db75 but it's still the same. Maybe we want to go back from `xonotic*` to explicitly naming the files? (partially revert https://github.com/netblue30/firejail/commit/41f69f7a748f1533b7506f1e28529520d660b894)
gitea-mirror commented 2026-05-05 09:23:39 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Oct 20, 2021):

firejail --debug --private /usr/bin/xonotic-sdl works for me ...

Can you try with --debug.

<!-- gh-comment-id:947655700 --> @rusty-snake commented on GitHub (Oct 20, 2021): `firejail --debug --private /usr/bin/xonotic-sdl` works for me ... Can you try with `--debug`.
gitea-mirror commented 2026-05-05 09:23:39 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Oct 20, 2021):

firejail --debug --private /usr/bin/xonotic-sdl works for me ...

Can you try with --debug.

Same. Are you on Arch as well? Also which part of the output should I paste (it's massive).

<!-- gh-comment-id:947694544 --> @jose1711 commented on GitHub (Oct 20, 2021): > `firejail --debug --private /usr/bin/xonotic-sdl` works for me ... > > Can you try with `--debug`. Same. Are you on Arch as well? Also which part of the output should I paste (it's massive).
gitea-mirror commented 2026-05-05 09:23:40 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Oct 20, 2021):

Fedora 34.

The lines before "cannot find the program in the path" e.g. where tries to search.

<!-- gh-comment-id:947697094 --> @rusty-snake commented on GitHub (Oct 20, 2021): Fedora 34. The lines before "cannot find the program in the path" e.g. where tries to search.
gitea-mirror commented 2026-05-05 09:23:41 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Oct 20, 2021):

..
Active seccomp files:
cat /run/firejail/mnt/seccomp/seccomp.list
/run/firejail/mnt/seccomp/seccomp.protocol
/run/firejail/mnt/seccomp/seccomp.32
/run/firejail/mnt/seccomp/seccomp
Create the new ld.so.preload file
Blacklist violations are logged to syslog
Mount the new ld.so.preload file
Dropping all capabilities
noroot user namespace installed
Dropping all capabilities
NO_NEW_PRIVS set
Drop privileges: pid 1, uid 1000, gid 100, nogroups 0
Supplementary groups: 92 91 50 
Warning: Cannot confine the application using AppArmor.
Maybe firejail-default AppArmor profile is not loaded into the kernel.
As root, run "aa-enforce firejail-default" to load it.
Starting application
LD_PRELOAD=(null)
execvp argument 0: /usr/bin/xonotic-sdl
Child process initialized in 124.10 ms
Installing /run/firejail/mnt/seccomp/seccomp seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter
Error: cannot find the program in the path
monitoring pid 48
<!-- gh-comment-id:947709499 --> @jose1711 commented on GitHub (Oct 20, 2021): ``` .. Active seccomp files: cat /run/firejail/mnt/seccomp/seccomp.list /run/firejail/mnt/seccomp/seccomp.protocol /run/firejail/mnt/seccomp/seccomp.32 /run/firejail/mnt/seccomp/seccomp Create the new ld.so.preload file Blacklist violations are logged to syslog Mount the new ld.so.preload file Dropping all capabilities noroot user namespace installed Dropping all capabilities NO_NEW_PRIVS set Drop privileges: pid 1, uid 1000, gid 100, nogroups 0 Supplementary groups: 92 91 50 Warning: Cannot confine the application using AppArmor. Maybe firejail-default AppArmor profile is not loaded into the kernel. As root, run "aa-enforce firejail-default" to load it. Starting application LD_PRELOAD=(null) execvp argument 0: /usr/bin/xonotic-sdl Child process initialized in 124.10 ms Installing /run/firejail/mnt/seccomp/seccomp seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter Error: cannot find the program in the path monitoring pid 48 ```
gitea-mirror commented 2026-05-05 09:23:41 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Oct 20, 2021):

In the debug log there might be a section like this

Searching $PATH for bla
trying #/usr/local/bin/bla#
trying #/usr/bin/bla#
trying #/bin/bla#
trying #/usr/local/sbin/bla#
trying #/usr/sbin/bla#

You may also want to compare the output of firejail --profile=xonotic --quiet sh -c "echo $PATH" to echo $PATH outside the sandbox.

Inside the sandbox, after private-bin was processed, there should be no Firejail symbolic links at all. Because private-bin mounts a tmpfs on /usr/local/bin, which is where these links normally go.

<!-- gh-comment-id:948112016 --> @smitsohu commented on GitHub (Oct 20, 2021): In the debug log there _might_ be a section like this ``` Searching $PATH for bla trying #/usr/local/bin/bla# trying #/usr/bin/bla# trying #/bin/bla# trying #/usr/local/sbin/bla# trying #/usr/sbin/bla# ``` You may also want to compare the output of `firejail --profile=xonotic --quiet sh -c "echo $PATH"` to `echo $PATH` outside the sandbox. Inside the sandbox, after `private-bin` was processed, there _should_ be no Firejail symbolic links at all. Because `private-bin` mounts a tmpfs on /usr/local/bin, which is where these links normally go.
gitea-mirror commented 2026-05-05 09:23:42 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Oct 21, 2021):

There is no such section/lines:

$ firejail --debug --private /usr/bin/xonotic-sdl 2>&1 | grep -e Search -e trying
$

You may also want to compare the output of

PATH is the same inside and outside the sandbox.

there should be no Firejail symbolic links

OK then I think that is probably the issue, b/c:

$ firejail --profile=xonotic --quiet sh -c 'ls -l /usr/local/bin/xonotic*'
-rwxr-xr-x 1 nobody nobody 3410952 okt 21 13:59 /usr/local/bin/xonotic-dedicated
lrwxrwxrwx 1 nobody nobody      17 okt 21 13:59 /usr/local/bin/xonotic-glx -> /usr/bin/firejail
lrwxrwxrwx 1 nobody nobody      17 okt 21 13:59 /usr/local/bin/xonotic-sdl -> /usr/bin/firejail
<!-- gh-comment-id:948542098 --> @jose1711 commented on GitHub (Oct 21, 2021): There is no such section/lines: ``` $ firejail --debug --private /usr/bin/xonotic-sdl 2>&1 | grep -e Search -e trying $ ``` > You may also want to compare the output of `PATH` is the same inside and outside the sandbox. > there should be no Firejail symbolic links OK then I think that is probably the issue, b/c: ``` $ firejail --profile=xonotic --quiet sh -c 'ls -l /usr/local/bin/xonotic*' -rwxr-xr-x 1 nobody nobody 3410952 okt 21 13:59 /usr/local/bin/xonotic-dedicated lrwxrwxrwx 1 nobody nobody 17 okt 21 13:59 /usr/local/bin/xonotic-glx -> /usr/bin/firejail lrwxrwxrwx 1 nobody nobody 17 okt 21 13:59 /usr/local/bin/xonotic-sdl -> /usr/bin/firejail ```
gitea-mirror commented 2026-05-05 09:23:43 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Oct 21, 2021):

Ok, that's strange.
You didn't by chance enable private-bin-no-local in the Firejail configuration file (/etc/firejail/firejail.config)?

firejail --private-bin=ls --profile=xonotic --quiet ls -l /usr/bin
Does that show all of /usr/bin, or do you have a restricted view?

<!-- gh-comment-id:948935130 --> @smitsohu commented on GitHub (Oct 21, 2021): Ok, that's strange. You didn't by chance enable `private-bin-no-local` in the Firejail configuration file (`/etc/firejail/firejail.config`)? `firejail --private-bin=ls --profile=xonotic --quiet ls -l /usr/bin` Does that show all of /usr/bin, or do you have a restricted view?
gitea-mirror commented 2026-05-05 09:23:44 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Oct 22, 2021):

firejail.config is stock (all entries are commented out).

$ firejail --private-bin=ls --profile=xonotic --quiet ls -l /usr/bin
total 13420
-rwxr-xr-x 1 nobody nobody   39072 Oct 22 10:07 basename
-rwxr-xr-x 1 nobody nobody  952720 Oct 22 10:07 bash
-rwxr-xr-x 1 nobody nobody   47296 Oct 22 10:07 cut
-rwxr-xr-x 1 nobody nobody 3781264 Oct 22 10:07 darkplaces-glx
-rwxr-xr-x 1 nobody nobody 3765776 Oct 22 10:07 darkplaces-sdl
-rwxr-xr-x 1 nobody nobody   39072 Oct 22 10:07 dirname
-rwsr-xr-x 1 nobody nobody  478664 Oct 22 10:07 firejail
-rwxr-xr-x 1 nobody nobody   63464 Oct 22 10:07 glxinfo
-rwxr-xr-x 1 nobody nobody  235824 Oct 22 10:07 grep
-rwxr-xr-x 1 nobody nobody   47296 Oct 22 10:07 head
-rwxr-xr-x 1 nobody nobody    5443 Oct 22 10:07 ldd
-rwxr-xr-x 1 nobody nobody  146056 Oct 22 10:07 ls
-rwxr-xr-x 1 nobody nobody  153848 Oct 22 10:07 netstat
-rwxr-xr-x 1 nobody nobody  137504 Oct 22 10:07 ps
-rwxr-xr-x 1 nobody nobody   47264 Oct 22 10:07 readlink
-rwxr-xr-x 1 nobody nobody  186712 Oct 22 10:07 sed
lrwxrwxrwx 1 nobody nobody      13 Oct 22 10:07 sh -> /usr/bin/bash
-rwxr-xr-x 1 nobody nobody   39104 Oct 22 10:07 uname
-rwxr-xr-x 1 nobody nobody 3410952 Oct 22 10:07 xonotic-dedicated
lrwxrwxrwx 1 nobody nobody      17 Oct 22 10:07 xonotic-glx -> /usr/bin/firejail
lrwxrwxrwx 1 nobody nobody      17 Oct 22 10:07 xonotic-sdl -> /usr/bin/firejail
-rwxr-xr-x 1 nobody nobody  127368 Oct 22 10:07 zenity
<!-- gh-comment-id:949388789 --> @jose1711 commented on GitHub (Oct 22, 2021): `firejail.config` is stock (all entries are commented out). ``` $ firejail --private-bin=ls --profile=xonotic --quiet ls -l /usr/bin total 13420 -rwxr-xr-x 1 nobody nobody 39072 Oct 22 10:07 basename -rwxr-xr-x 1 nobody nobody 952720 Oct 22 10:07 bash -rwxr-xr-x 1 nobody nobody 47296 Oct 22 10:07 cut -rwxr-xr-x 1 nobody nobody 3781264 Oct 22 10:07 darkplaces-glx -rwxr-xr-x 1 nobody nobody 3765776 Oct 22 10:07 darkplaces-sdl -rwxr-xr-x 1 nobody nobody 39072 Oct 22 10:07 dirname -rwsr-xr-x 1 nobody nobody 478664 Oct 22 10:07 firejail -rwxr-xr-x 1 nobody nobody 63464 Oct 22 10:07 glxinfo -rwxr-xr-x 1 nobody nobody 235824 Oct 22 10:07 grep -rwxr-xr-x 1 nobody nobody 47296 Oct 22 10:07 head -rwxr-xr-x 1 nobody nobody 5443 Oct 22 10:07 ldd -rwxr-xr-x 1 nobody nobody 146056 Oct 22 10:07 ls -rwxr-xr-x 1 nobody nobody 153848 Oct 22 10:07 netstat -rwxr-xr-x 1 nobody nobody 137504 Oct 22 10:07 ps -rwxr-xr-x 1 nobody nobody 47264 Oct 22 10:07 readlink -rwxr-xr-x 1 nobody nobody 186712 Oct 22 10:07 sed lrwxrwxrwx 1 nobody nobody 13 Oct 22 10:07 sh -> /usr/bin/bash -rwxr-xr-x 1 nobody nobody 39104 Oct 22 10:07 uname -rwxr-xr-x 1 nobody nobody 3410952 Oct 22 10:07 xonotic-dedicated lrwxrwxrwx 1 nobody nobody 17 Oct 22 10:07 xonotic-glx -> /usr/bin/firejail lrwxrwxrwx 1 nobody nobody 17 Oct 22 10:07 xonotic-sdl -> /usr/bin/firejail -rwxr-xr-x 1 nobody nobody 127368 Oct 22 10:07 zenity ```
gitea-mirror commented 2026-05-05 09:23:45 -06:00
Author
Owner
Copy link

@smitsohu commented on GitHub (Oct 22, 2021):

Thanks, I think it's clear now. We are skipping these Firejail symbolic links when there is no globbing, but with globbing we need to do the same thing. It's a bug!

<!-- gh-comment-id:949650694 --> @smitsohu commented on GitHub (Oct 22, 2021): Thanks, I think it's clear now. We are skipping these Firejail symbolic links when there is no globbing, but with globbing we need to do the same thing. It's a bug!
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2728
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?