[GH-ISSUE #4627] Impossible to inclure tutanota-desktop-linux.AppImage in a sandbox with firejail with Linux Mint 20.2

gitea-mirror commented

2026-05-05 09:23:47 -06:00

Owner

Originally created by @CocoR55 on GitHub (Oct 20, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4627

Description

** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl **

Mounting appimage type 2
Warning: skipping tutanota-desktop for private /opt
Private /opt installed in 2.54 ms
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: skipping crypto-policies for private /etc
Private /etc installed in 225.95 ms
Private /usr/etc installed in 0.01 ms
Child process initialized in 704.99 ms
the monkey has been patched
(node:16) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use tutanota-desktop --trace-deprecation ... to show where the warning was created)
version: 3.88.4
libva error: vaGetDriverNameByIndex() failed with unknown libva error, driver_name = (null)

(tutanota-desktop:16): libappindicator-WARNING **: 13:30:31.453: Unable to get the session bus: Could not connect: Permission denied

(tutanota-desktop:16): LIBDBUSMENU-GLIB-WARNING **: 13:30:31.454: Unable to get session bus: Could not connect: Permission denied
config up to date
scheduling to check sse in 1 seconds
[ApplicationWindow] startFile: file:///run/firejail/appimage/resources/app.asar/index-desktop.html
[DownloadManager] getting dictionaries from: https://mail.tutanota.com/desktop/dictionaries/
default mailto handler: false
[DownloadManager] spellcheck-dictionary-initialized fr
scheduling to check sse in 10 seconds
sse info not available, skip reconnect
Webapp ready
autoUpdater info:
Checking for update
autoUpdater info:
checking-for-update
/home/leloup/.local/share/applications/tutanota-desktop.desktop does not exist, checking for permission to ask for permission...
....
chmod 777 tutanota-desktop.desktop. Nevertheless, this is the same.

I found that:
leloup@leloup-VirtualBox:/etc/firejail$ cat disable-common.inc | grep -i .local/share/app
read-only ${HOME}/.local/share/applications.

Question: How to fix?

Regards,
CocoR55

Steps to Reproduce

Steps to reproduce the behavior

Run in bash LC_ALL=C firejail PROGRAM (LC_ALL=C to get a consistent output in English that can be understood by everybody)
Click on '....'
Scroll down to '....'
See error ERROR

Expected behavior

What you expected to happen

Actual behavior

What actually happened

Behavior without a profile

What changed calling LC_ALL=C firejail --noprofile /path/to/program in a terminal?

Additional context

Any other detail that may help to understand/debug the problem

Environment

Linux distribution is Linux Mint Cinnamon 20.2
Firejail version (firejail --version) 0.9.66
If you use a development version of firejail, also the commit from which it was compiled (git rev-parse HEAD).

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

output goes here

Output of LC_ALL=C firejail --debug /path/to/program

output goes here

Originally created by @CocoR55 on GitHub (Oct 20, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4627  ### Description ** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl ** Mounting appimage type 2 Warning: skipping tutanota-desktop for private /opt Private /opt installed in 2.54 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping crypto-policies for private /etc Private /etc installed in 225.95 ms Private /usr/etc installed in 0.01 ms Child process initialized in 704.99 ms the monkey has been patched (node:16) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead. (Use `tutanota-desktop --trace-deprecation ...` to show where the warning was created) version: 3.88.4 libva error: vaGetDriverNameByIndex() failed with unknown libva error, driver_name = (null) (tutanota-desktop:16): libappindicator-WARNING **: 13:30:31.453: Unable to get the session bus: Could not connect: Permission denied (tutanota-desktop:16): LIBDBUSMENU-GLIB-WARNING **: 13:30:31.454: Unable to get session bus: Could not connect: Permission denied config up to date scheduling to check sse in 1 seconds [ApplicationWindow] startFile: file:///run/firejail/appimage/resources/app.asar/index-desktop.html [DownloadManager] getting dictionaries from: https://mail.tutanota.com/desktop/dictionaries/ default mailto handler: false [DownloadManager] spellcheck-dictionary-initialized fr scheduling to check sse in 10 seconds sse info not available, skip reconnect Webapp ready autoUpdater info: Checking for update autoUpdater info: checking-for-update **/home/leloup/.local/share/applications/tutanota-desktop.desktop does not exist**, checking for permission to ask for permission... .... chmod 777 tutanota-desktop.desktop. Nevertheless, this is the same. I found that: leloup@leloup-VirtualBox:/etc/firejail$ cat disable-common.inc | grep -i .local/share/app **read-only** ${HOME}/.local/share/applications. **Question: How to fix?** Regards, CocoR55 ### Steps to Reproduce _Steps to reproduce the behavior_ 1. Run in bash `LC_ALL=C firejail PROGRAM` (`LC_ALL=C` to get a consistent output in English that can be understood by everybody) 2. Click on '....' 3. Scroll down to '....' 4. See error `ERROR` ### Expected behavior _What you expected to happen_ ### Actual behavior _What actually happened_ ### Behavior without a profile _What changed calling `LC_ALL=C firejail --noprofile /path/to/program` in a terminal?_ ### Additional context _Any other detail that may help to understand/debug the problem_ ### Environment - Linux distribution is Linux Mint Cinnamon 20.2 - Firejail version (`firejail --version`) **0.9.66** - If you use a development version of firejail, also the commit from which it was compiled (`git rev-parse HEAD`). ### Checklist  - [ ] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [ ] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` output goes here ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p> ``` output goes here ``` </p> </details>

gitea-mirror closed this issue

2026-05-05 09:23:48 -06:00

gitea-mirror commented

2026-05-05 09:23:50 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 20, 2021):

You can not use electron AIs with firejail [edit] if your kernel does not support unprivileged userns.

@rusty-snake commented on GitHub (Oct 20, 2021): You can not use electron AIs with firejail [edit] if your kernel does not support unprivileged userns.

gitea-mirror commented

2026-05-05 09:23:51 -06:00

Author

Owner

@CocoR55 commented on GitHub (Oct 20, 2021):

Bonjour rusty-snake
Could you clarify? Do you mean electron? Alsa..?
Regards,
Leloup

@CocoR55 commented on GitHub (Oct 20, 2021): Bonjour rusty-snake Could you clarify? Do you mean electron? Alsa..? Regards, Leloup

gitea-mirror commented

2026-05-05 09:23:52 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 20, 2021):

Yes, electron. When you type fast …
AIs: AppImages

@rusty-snake commented on GitHub (Oct 20, 2021): - Yes, electron. When you type fast … - `AIs`: **A**pp**I**mages

gitea-mirror commented

2026-05-05 09:23:53 -06:00

Author

Owner

@CocoR55 commented on GitHub (Oct 20, 2021):

'To give more precision leloup@leloup-VirtualBox firejail --appimage --profile=/etc/firejail/tutanota-desktop.profile /home/leloup/Tutanota/tutanota-desktop-linux.AppImage that does not works.
leloup@leloup-VirtualBox firejail --appimage -noprofile /home/leloup/Tutanota/tutanota-desktop-linux.AppImage that works but no any sandbox is created.'

@CocoR55 commented on GitHub (Oct 20, 2021): 'To give more precision leloup@leloup-VirtualBox firejail --appimage --profile=/etc/firejail/tutanota-desktop.profile /home/leloup/Tutanota/tutanota-desktop-linux.AppImage that does not works. leloup@leloup-VirtualBox firejail --appimage -noprofile /home/leloup/Tutanota/tutanota-desktop-linux.AppImage that works but no any sandbox is created.'

gitea-mirror commented

2026-05-05 09:23:54 -06:00

Author

Owner

@CocoR55 commented on GitHub (Oct 20, 2021):

I am not convinced. There is no shortage of them to make it work

@CocoR55 commented on GitHub (Oct 20, 2021): I am not convinced. There is no shortage of them to make it work

gitea-mirror commented

2026-05-05 09:23:55 -06:00

Author

Owner

@CocoR55 commented on GitHub (Oct 20, 2021):

noblacklist ${HOME}/.config/ is to allow acces to .config.
read-only ${HOME}/.local/share/applications is to allow read-only file.
What command is to alllow read-write ${HOME}/.local/share/applications?

@CocoR55 commented on GitHub (Oct 20, 2021): noblacklist ${HOME}/.config/ is to allow acces to .config. read-only ${HOME}/.local/share/applications is to allow read-only file. What command is to alllow read-write ${HOME}/.local/share/applications?

gitea-mirror commented

2026-05-05 09:23:56 -06:00

Author

Owner

@CocoR55 commented on GitHub (Oct 20, 2021):

In the Error window, it is written: " Could not access secret storage " Please see FAQ at tutanota.com/faq/#secretstorage

I don't find...

@CocoR55 commented on GitHub (Oct 20, 2021): In the Error window, it is written: " Could not access secret storage " Please see FAQ at tutanota.com/faq/#secretstorage I don't find...

gitea-mirror commented

2026-05-05 09:23:57 -06:00

Author

Owner

@CocoR55 commented on GitHub (Oct 20, 2021):

When I say it doesn't work, it's not quite right.
The Tutanota window opens and tutanota.appimage is in the firejail --list but I can only get it from the command line for now and the error message above doesn't make it clean

@CocoR55 commented on GitHub (Oct 20, 2021): When I say it doesn't work, it's not quite right. The Tutanota window opens and tutanota.appimage is in the firejail --list but I can only get it from the command line for now and the error message above doesn't make it clean

gitea-mirror commented

2026-05-05 09:23:57 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 20, 2021):

Just two FYIs (I still don't get what you are trying and what works and what not).

If you allow tutanota-desktop to write to ~/.local/share/applications once, the resulting desktop file will run tutanota-desktop unsandboxed. (And if you allow it always, you've open one more hole in the sbox).

If you want it give it access to the gnome-keyring to save your password:

ignore dbus-user none
dbus-user filter
dbus-user.talk org.freedesktop.secretservice
dbus-user.talk org.freedesktop.secrets

@rusty-snake commented on GitHub (Oct 20, 2021): Just two FYIs (I still don't get what you are trying and what works and what not). 1. If you allow tutanota-desktop to write to `~/.local/share/applications` once, the resulting desktop file will run tutanota-desktop unsandboxed. (And if you allow it always, you've open one more hole in the sbox). 2. If you want it give it access to the gnome-keyring to save your password: <pre><code>ignore dbus-user none dbus-user filter <s>dbus-user.talk org.freedesktop.secretservice</s> dbus-user.talk org.freedesktop.secrets </code></pre>

gitea-mirror commented

2026-05-05 09:23:58 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 8, 2022):

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

@rusty-snake commented on GitHub (Jun 8, 2022): I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

Rows
Columns

[GH-ISSUE #4627] Impossible to inclure tutanota-desktop-linux.AppImage in a sandbox with firejail with Linux Mint 20.2 #2733

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Additional context

Environment

Checklist

Log