github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #4697] [solved] Firejail 0.9.66-1~0ubuntu21.10.1 Breaks Tor 11.0.1 (disabling apparmor for tor fixed this) #2752

New issue
Closed
opened 2026-05-05 09:24:58 -06:00 by gitea-mirror · 12 comments
gitea-mirror commented 2026-05-05 09:24:58 -06:00
Owner
Copy link

Originally created by @rugabunda on GitHub (Nov 18, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4697

Happened in both Kubuntu, and Lubuntu.

"Tor exited during startup. This might be due to an error in your torrc file, a bug in Tor or another program on your system, or faulty hardware. Until you fix the underlying problem and restart Tor, Tor Browser will not start."

These stick out to me:

Warning: file gxmessage not found
Warning: file kdialog not found
Warning: file tor-browser not found
Warning: file tor-browser-en not found

--noprofile works.

firejail --debug torbrowser-launcher | grep warning
Reading profile /etc/firejail/torbrowser-launcher.profile
Reading profile /etc/firejail/allow-python2.inc
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Warning: networking feature is disabled in Firejail configuration file
[profile] combined protocol list: "unix,inet,inet6"
DISPLAY=:0 parsed as 0
Parent pid 16538, child pid 16540
Warning: file gxmessage not found
Warning: file kdialog not found
Warning: file tor-browser not found
Warning: file tor-browser-en not found
34 programs installed in 64.37 ms
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning fcopy: skipping /etc/alternatives/x-www-browser, cannot find inode
Warning fcopy: skipping /etc/alternatives/pinentry-x11, cannot find inode
Warning fcopy: skipping /etc/alternatives/ebtables-save, cannot find inode
Warning fcopy: skipping /etc/alternatives/rvim, cannot find inode
Warning fcopy: skipping /etc/alternatives/ebtables, cannot find inode
Warning fcopy: skipping /etc/alternatives/netcat, cannot find inode
Warning fcopy: skipping /etc/alternatives/iptables, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzfgrep, cannot find inode
Warning fcopy: skipping /etc/alternatives/stream-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/vi, cannot find inode
Warning fcopy: skipping /etc/alternatives/identify, cannot find inode
Warning fcopy: skipping /etc/alternatives/x-terminal-emulator, cannot find inode
Warning fcopy: skipping /etc/alternatives/identify-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/x-session-manager, cannot find inode
Warning fcopy: skipping /etc/alternatives/mogrify, cannot find inode
Warning fcopy: skipping /etc/alternatives/compare, cannot find inode
Warning fcopy: skipping /etc/alternatives/display-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/unlzma, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzcat, cannot find inode
Warning fcopy: skipping /etc/alternatives/infobrowser, cannot find inode
Warning fcopy: skipping /etc/alternatives/import, cannot find inode
Warning fcopy: skipping /etc/alternatives/iptables-restore, cannot find inode
Warning fcopy: skipping /etc/alternatives/rcp, cannot find inode
Warning fcopy: skipping /etc/alternatives/conjure, cannot find inode
Warning fcopy: skipping /etc/alternatives/composite-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/pico, cannot find inode
Warning fcopy: skipping /etc/alternatives/arptables-save, cannot find inode
Warning fcopy: skipping /etc/alternatives/animate-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/rview, cannot find inode
Warning fcopy: skipping /etc/alternatives/convert-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/composite, cannot find inode
Warning fcopy: skipping /etc/alternatives/vimdiff, cannot find inode
Warning fcopy: skipping /etc/alternatives/ssh-askpass, cannot find inode
Warning fcopy: skipping /etc/alternatives/montage, cannot find inode
Warning fcopy: skipping /etc/alternatives/rmt, cannot find inode
Warning fcopy: skipping /etc/alternatives/vim, cannot find inode
Warning fcopy: skipping /etc/alternatives/convert, cannot find inode
Warning fcopy: skipping /etc/alternatives/arptables, cannot find inode
Warning fcopy: skipping /etc/alternatives/animate, cannot find inode
Warning fcopy: skipping /etc/alternatives/awk, cannot find inode
Warning fcopy: skipping /etc/alternatives/iptables-save, cannot find inode
Warning fcopy: skipping /etc/alternatives/import-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/cpp, cannot find inode
Warning fcopy: skipping /etc/alternatives/ex, cannot find inode
Warning fcopy: skipping /etc/alternatives/montage-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzdiff, cannot find inode
Warning fcopy: skipping /etc/alternatives/mogrify-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/write, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzcmp, cannot find inode
Warning fcopy: skipping /etc/alternatives/editor, cannot find inode
Warning fcopy: skipping /etc/alternatives/pftp, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzgrep, cannot find inode
Warning fcopy: skipping /etc/alternatives/open, cannot find inode
Warning fcopy: skipping /etc/alternatives/traceroute6, cannot find inode
Warning fcopy: skipping /etc/alternatives/compare-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/conjure-im6, cannot find inode
Warning fcopy: skipping /etc/alternatives/rlogin, cannot find inode
Warning fcopy: skipping /etc/alternatives/figlet, cannot find inode
Warning fcopy: skipping /etc/alternatives/display, cannot find inode
Warning fcopy: skipping /etc/alternatives/arptables-restore, cannot find inode
Warning fcopy: skipping /etc/alternatives/nc, cannot find inode
Warning fcopy: skipping /etc/alternatives/x-window-manager, cannot find inode
Warning fcopy: skipping /etc/alternatives/ip6tables-save, cannot find inode
Warning fcopy: skipping /etc/alternatives/pinentry, cannot find inode
Warning fcopy: skipping /etc/alternatives/telnet, cannot find inode
Warning fcopy: skipping /etc/alternatives/ebtables-restore, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzmore, cannot find inode
Warning fcopy: skipping /etc/alternatives/gnome-www-browser, cannot find inode
Warning fcopy: skipping /etc/alternatives/pager, cannot find inode
Warning fcopy: skipping /etc/alternatives/ip6tables, cannot find inode
Warning fcopy: skipping /etc/alternatives/ip6tables-restore, cannot find inode
Warning fcopy: skipping /etc/alternatives/stream, cannot find inode
Warning fcopy: skipping /etc/alternatives/rsh, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzless, cannot find inode
Warning fcopy: skipping /etc/alternatives/nawk, cannot find inode
Warning fcopy: skipping /etc/alternatives/view, cannot find inode
Warning fcopy: skipping /etc/alternatives/mt, cannot find inode
Warning fcopy: skipping /etc/alternatives/www-browser, cannot find inode
Warning fcopy: skipping /etc/alternatives/ftp, cannot find inode
Warning fcopy: skipping /etc/alternatives/lzegrep, cannot find inode
Warning: file /etc/asound.conf not found.
Warning: skipping asound.conf for private /etc
Warning: file /etc/crypto-policies not found.
Warning: skipping crypto-policies for private /etc
Warning: file /etc/ld.so.preload not found.
Warning: skipping ld.so.preload for private /etc
Warning fcopy: skipping /etc/pulse/client.conf.d/01-enable-autospawn.conf, cannot find inode
Private /etc installed in 27.57 ms
Private /usr/etc installed in 0.01 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
DISPLAY=:0 parsed as 0
Child process initialized in 147.26 ms
Originally created by @rugabunda on GitHub (Nov 18, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4697 Happened in both Kubuntu, and Lubuntu. "Tor exited during startup. This might be due to an error in your torrc file, a bug in Tor or another program on your system, or faulty hardware. Until you fix the underlying problem and restart Tor, Tor Browser will not start." These stick out to me: Warning: file gxmessage not found Warning: file kdialog not found Warning: file tor-browser not found Warning: file tor-browser-en not found --noprofile works. ``` firejail --debug torbrowser-launcher | grep warning Reading profile /etc/firejail/torbrowser-launcher.profile Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Warning: networking feature is disabled in Firejail configuration file [profile] combined protocol list: "unix,inet,inet6" DISPLAY=:0 parsed as 0 Parent pid 16538, child pid 16540 Warning: file gxmessage not found Warning: file kdialog not found Warning: file tor-browser not found Warning: file tor-browser-en not found 34 programs installed in 64.37 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning fcopy: skipping /etc/alternatives/x-www-browser, cannot find inode Warning fcopy: skipping /etc/alternatives/pinentry-x11, cannot find inode Warning fcopy: skipping /etc/alternatives/ebtables-save, cannot find inode Warning fcopy: skipping /etc/alternatives/rvim, cannot find inode Warning fcopy: skipping /etc/alternatives/ebtables, cannot find inode Warning fcopy: skipping /etc/alternatives/netcat, cannot find inode Warning fcopy: skipping /etc/alternatives/iptables, cannot find inode Warning fcopy: skipping /etc/alternatives/lzfgrep, cannot find inode Warning fcopy: skipping /etc/alternatives/stream-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/vi, cannot find inode Warning fcopy: skipping /etc/alternatives/identify, cannot find inode Warning fcopy: skipping /etc/alternatives/x-terminal-emulator, cannot find inode Warning fcopy: skipping /etc/alternatives/identify-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/x-session-manager, cannot find inode Warning fcopy: skipping /etc/alternatives/mogrify, cannot find inode Warning fcopy: skipping /etc/alternatives/compare, cannot find inode Warning fcopy: skipping /etc/alternatives/display-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/unlzma, cannot find inode Warning fcopy: skipping /etc/alternatives/lzcat, cannot find inode Warning fcopy: skipping /etc/alternatives/infobrowser, cannot find inode Warning fcopy: skipping /etc/alternatives/import, cannot find inode Warning fcopy: skipping /etc/alternatives/iptables-restore, cannot find inode Warning fcopy: skipping /etc/alternatives/rcp, cannot find inode Warning fcopy: skipping /etc/alternatives/conjure, cannot find inode Warning fcopy: skipping /etc/alternatives/composite-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/pico, cannot find inode Warning fcopy: skipping /etc/alternatives/arptables-save, cannot find inode Warning fcopy: skipping /etc/alternatives/animate-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/rview, cannot find inode Warning fcopy: skipping /etc/alternatives/convert-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/composite, cannot find inode Warning fcopy: skipping /etc/alternatives/vimdiff, cannot find inode Warning fcopy: skipping /etc/alternatives/ssh-askpass, cannot find inode Warning fcopy: skipping /etc/alternatives/montage, cannot find inode Warning fcopy: skipping /etc/alternatives/rmt, cannot find inode Warning fcopy: skipping /etc/alternatives/vim, cannot find inode Warning fcopy: skipping /etc/alternatives/convert, cannot find inode Warning fcopy: skipping /etc/alternatives/arptables, cannot find inode Warning fcopy: skipping /etc/alternatives/animate, cannot find inode Warning fcopy: skipping /etc/alternatives/awk, cannot find inode Warning fcopy: skipping /etc/alternatives/iptables-save, cannot find inode Warning fcopy: skipping /etc/alternatives/import-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/cpp, cannot find inode Warning fcopy: skipping /etc/alternatives/ex, cannot find inode Warning fcopy: skipping /etc/alternatives/montage-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/lzdiff, cannot find inode Warning fcopy: skipping /etc/alternatives/mogrify-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/write, cannot find inode Warning fcopy: skipping /etc/alternatives/lzcmp, cannot find inode Warning fcopy: skipping /etc/alternatives/editor, cannot find inode Warning fcopy: skipping /etc/alternatives/pftp, cannot find inode Warning fcopy: skipping /etc/alternatives/lzgrep, cannot find inode Warning fcopy: skipping /etc/alternatives/open, cannot find inode Warning fcopy: skipping /etc/alternatives/traceroute6, cannot find inode Warning fcopy: skipping /etc/alternatives/compare-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/conjure-im6, cannot find inode Warning fcopy: skipping /etc/alternatives/rlogin, cannot find inode Warning fcopy: skipping /etc/alternatives/figlet, cannot find inode Warning fcopy: skipping /etc/alternatives/display, cannot find inode Warning fcopy: skipping /etc/alternatives/arptables-restore, cannot find inode Warning fcopy: skipping /etc/alternatives/nc, cannot find inode Warning fcopy: skipping /etc/alternatives/x-window-manager, cannot find inode Warning fcopy: skipping /etc/alternatives/ip6tables-save, cannot find inode Warning fcopy: skipping /etc/alternatives/pinentry, cannot find inode Warning fcopy: skipping /etc/alternatives/telnet, cannot find inode Warning fcopy: skipping /etc/alternatives/ebtables-restore, cannot find inode Warning fcopy: skipping /etc/alternatives/lzmore, cannot find inode Warning fcopy: skipping /etc/alternatives/gnome-www-browser, cannot find inode Warning fcopy: skipping /etc/alternatives/pager, cannot find inode Warning fcopy: skipping /etc/alternatives/ip6tables, cannot find inode Warning fcopy: skipping /etc/alternatives/ip6tables-restore, cannot find inode Warning fcopy: skipping /etc/alternatives/stream, cannot find inode Warning fcopy: skipping /etc/alternatives/rsh, cannot find inode Warning fcopy: skipping /etc/alternatives/lzless, cannot find inode Warning fcopy: skipping /etc/alternatives/nawk, cannot find inode Warning fcopy: skipping /etc/alternatives/view, cannot find inode Warning fcopy: skipping /etc/alternatives/mt, cannot find inode Warning fcopy: skipping /etc/alternatives/www-browser, cannot find inode Warning fcopy: skipping /etc/alternatives/ftp, cannot find inode Warning fcopy: skipping /etc/alternatives/lzegrep, cannot find inode Warning: file /etc/asound.conf not found. Warning: skipping asound.conf for private /etc Warning: file /etc/crypto-policies not found. Warning: skipping crypto-policies for private /etc Warning: file /etc/ld.so.preload not found. Warning: skipping ld.so.preload for private /etc Warning fcopy: skipping /etc/pulse/client.conf.d/01-enable-autospawn.conf, cannot find inode Private /etc installed in 27.57 ms Private /usr/etc installed in 0.01 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups DISPLAY=:0 parsed as 0 Child process initialized in 147.26 ms ```
gitea-mirror commented 2026-05-05 09:25:00 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 18, 2021):

Can you try firejail --ignore=private-bin torbrowser-launcher to get more information.

Does firejail --seccomp='!iopl' --ignore=seccomp torbrowser-launcher work?

<!-- gh-comment-id:972594995 --> @rusty-snake commented on GitHub (Nov 18, 2021): Can you try `firejail --ignore=private-bin torbrowser-launcher` to get more information. Does `firejail --seccomp='!iopl' --ignore=seccomp torbrowser-launcher` work?
gitea-mirror commented 2026-05-05 09:25:01 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

Can you try firejail --ignore=private-bin torbrowser-launcher to get more information.

Does firejail --seccomp='!iopl' --ignore=seccomp torbrowser-launcher work?

It does not work, here is the output, firejail --ignore=private-bin torbrowser-launcher

:~$ firejail --ignore=private-bin torbrowser-launcher
Reading profile /etc/firejail/torbrowser-launcher.profile
Reading profile /etc/firejail/allow-python2.inc
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Warning: networking feature is disabled in Firejail configuration file
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 1586, child pid 1587
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: skipping asound.conf for private /etc
Warning: skipping crypto-policies for private /etc
Warning: skipping ld.so.preload for private /etc
Warning fcopy: skipping /etc/pulse/client.conf.d/01-enable-autospawn.conf, cannot find inode
Private /etc installed in 28.06 ms
Private /usr/etc installed in 0.00 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 96.83 ms
Error getpwuid: main.c:236 init_cfg: No such file or directory
<!-- gh-comment-id:973035602 --> @rugabunda commented on GitHub (Nov 18, 2021): > > > Can you try `firejail --ignore=private-bin torbrowser-launcher` to get more information. > > Does `firejail --seccomp='!iopl' --ignore=seccomp torbrowser-launcher` work? It does not work, here is the output, `firejail --ignore=private-bin torbrowser-launcher` ``` :~$ firejail --ignore=private-bin torbrowser-launcher Reading profile /etc/firejail/torbrowser-launcher.profile Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Warning: networking feature is disabled in Firejail configuration file Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 1586, child pid 1587 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping asound.conf for private /etc Warning: skipping crypto-policies for private /etc Warning: skipping ld.so.preload for private /etc Warning fcopy: skipping /etc/pulse/client.conf.d/01-enable-autospawn.conf, cannot find inode Private /etc installed in 28.06 ms Private /usr/etc installed in 0.00 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Child process initialized in 96.83 ms Error getpwuid: main.c:236 init_cfg: No such file or directory ```
gitea-mirror commented 2026-05-05 09:25:02 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 18, 2021):

Replace torbrowser-launcher with /usr/bin/torbrowser-launcher and try again.

<!-- gh-comment-id:973040149 --> @rusty-snake commented on GitHub (Nov 18, 2021): Replace `torbrowser-launcher` with `/usr/bin/torbrowser-launcher` and try again.
gitea-mirror commented 2026-05-05 09:25:03 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

Replace torbrowser-launcher with /usr/bin/torbrowser-launcher and try again.

This works and loads outside firejail, but does not work if I add "firejail" before it.

<!-- gh-comment-id:973154923 --> @rugabunda commented on GitHub (Nov 18, 2021): > > > Replace `torbrowser-launcher` with `/usr/bin/torbrowser-launcher` and try again. This works and loads outside firejail, but does not work if I add "firejail" before it.
gitea-mirror commented 2026-05-05 09:25:04 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 18, 2021):

So if you run it with --ignore=private-bin you do not get a more useful error, if you run it with the seccomp exceptions it still does not work.

Then, is anything in the syslog? If not you need to comment the profile and uncomment it line for line.

edit: The seccomp exception should actually be firejail --seccomp='!iopl,!chroot' --ignore=seccomp /usr/bin/torbrowser-launcher.

<!-- gh-comment-id:973158202 --> @rusty-snake commented on GitHub (Nov 18, 2021): So if you run it with `--ignore=private-bin` you do not get a more useful error, if you run it with the seccomp exceptions it still does not work. Then, is anything in the syslog? If not you need to comment the profile and uncomment it line for line. edit: The seccomp exception should actually be `firejail --seccomp='!iopl,!chroot' --ignore=seccomp /usr/bin/torbrowser-launcher`.
gitea-mirror commented 2026-05-05 09:25:05 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

@rusty-snake

 firejail --ignore=private-bin torbrowser-launcher
Reading profile /etc/firejail/torbrowser-launcher.profile                                                                                                                
Reading profile /etc/firejail/allow-python2.inc                                                                                                                          
Reading profile /etc/firejail/allow-python3.inc                                                                                                                          
Reading profile /etc/firejail/disable-common.inc                                                                                                                         
Reading profile /etc/firejail/disable-devel.inc                                                                                                                          
Reading profile /etc/firejail/disable-exec.inc                                                                                                                           
Reading profile /etc/firejail/disable-interpreters.inc                                                                                                                   
Reading profile /etc/firejail/disable-passwdmgr.inc                                                                                                                      
Reading profile /etc/firejail/disable-programs.inc                                                                                                                       
Reading profile /etc/firejail/disable-xdg.inc                                                                                                                            
Reading profile /etc/firejail/whitelist-common.inc                                                                                                                       
Reading profile /etc/firejail/whitelist-var-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Warning: networking feature is disabled in Firejail configuration file
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 2810, child pid 2811
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: skipping asound.conf for private /etc
Warning: skipping crypto-policies for private /etc
Warning: skipping ld.so.preload for private /etc
Warning fcopy: skipping /etc/pulse/client.conf.d/01-enable-autospawn.conf, cannot find inode
Private /etc installed in 27.73 ms
Private /usr/etc installed in 0.00 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 98.94 ms
Error getpwuid: main.c:236 init_cfg: No such file or directory

Parent is shutting down, bye...

Same error with --seccomp='!iopl,!chroot'

I'm seeing the following in KERN.log

Nov 18 14:27:54 pcb kernel: [  962.631029] audit: type=1400 audit(1637263674.392:65): apparmor="DENIED" operation="open" profile="torbrowser_firefox" name="/sys/bus/pci/devices/" pid=3874 comm="firefox.real" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Nov 18 14:27:54 pcb kernel: [  962.631186] firefox.real[3874]: segfault at 0 ip 00007f1087d61f47 sp 00007ffcaf2028e0 error 6 in libxul.so[7f1084900000+70d8000]
Nov 18 14:27:54 pcb kernel: [  962.631194] Code: 00 00 00 48 83 ec 08 80 3d bd 29 1b 04 00 74 02 58 c3 c6 05 b2 29 1b 04 01 48 8d 05 3c 56 be 01 48 8b 0d 2c 87 0a 04 48 89 01 <c7> 04 25 00 00 00 00 8f 01 00 00 e8 09 ed b9 fc 66 0f 1f 84 00 00
Nov 18 14:27:54 pcb kernel: [  962.817733] audit: type=1400 audit(1637263674.576:66): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="torbrowser_firefox" name="/home/pc/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Tor/tor" pid=3904 comm="firefox.real" requested_mask="x" denied_mask="x" fsuid=1000 ouid=1000 target="torbrowser_tor"

Is apparmor the culprit?

<!-- gh-comment-id:973188534 --> @rugabunda commented on GitHub (Nov 18, 2021): @rusty-snake ``` firejail --ignore=private-bin torbrowser-launcher Reading profile /etc/firejail/torbrowser-launcher.profile Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Warning: networking feature is disabled in Firejail configuration file Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 2810, child pid 2811 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping asound.conf for private /etc Warning: skipping crypto-policies for private /etc Warning: skipping ld.so.preload for private /etc Warning fcopy: skipping /etc/pulse/client.conf.d/01-enable-autospawn.conf, cannot find inode Private /etc installed in 27.73 ms Private /usr/etc installed in 0.00 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Child process initialized in 98.94 ms Error getpwuid: main.c:236 init_cfg: No such file or directory Parent is shutting down, bye... ``` Same error with `--seccomp='!iopl,!chroot' ` I'm seeing the following in KERN.log ``` Nov 18 14:27:54 pcb kernel: [ 962.631029] audit: type=1400 audit(1637263674.392:65): apparmor="DENIED" operation="open" profile="torbrowser_firefox" name="/sys/bus/pci/devices/" pid=3874 comm="firefox.real" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Nov 18 14:27:54 pcb kernel: [ 962.631186] firefox.real[3874]: segfault at 0 ip 00007f1087d61f47 sp 00007ffcaf2028e0 error 6 in libxul.so[7f1084900000+70d8000] Nov 18 14:27:54 pcb kernel: [ 962.631194] Code: 00 00 00 48 83 ec 08 80 3d bd 29 1b 04 00 74 02 58 c3 c6 05 b2 29 1b 04 01 48 8d 05 3c 56 be 01 48 8b 0d 2c 87 0a 04 48 89 01 <c7> 04 25 00 00 00 00 8f 01 00 00 e8 09 ed b9 fc 66 0f 1f 84 00 00 Nov 18 14:27:54 pcb kernel: [ 962.817733] audit: type=1400 audit(1637263674.576:66): apparmor="DENIED" operation="exec" info="no new privs" error=-1 profile="torbrowser_firefox" name="/home/pc/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser/TorBrowser/Tor/tor" pid=3904 comm="firefox.real" requested_mask="x" denied_mask="x" fsuid=1000 ouid=1000 target="torbrowser_tor" ``` Is apparmor the culprit?
gitea-mirror commented 2026-05-05 09:25:06 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

Comment each line individually in torbrowser-launcher.profile?

<!-- gh-comment-id:973191030 --> @rugabunda commented on GitHub (Nov 18, 2021): Comment each line individually in torbrowser-launcher.profile?
gitea-mirror commented 2026-05-05 09:25:06 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Nov 18, 2021):

Comment each line individually in torbrowser-launcher.profile?

Comment all lines and the uncomment line for line.

Is apparmor the culprit?
profile="torbrowser_firefox"

So you run torbrowser in firejail and apparmor? Someone other must help here I never really used AA.

<!-- gh-comment-id:973196538 --> @rusty-snake commented on GitHub (Nov 18, 2021): > Comment each line individually in torbrowser-launcher.profile? Comment all lines and the uncomment line for line. > Is apparmor the culprit? > profile="torbrowser_firefox" So you run torbrowser in firejail and apparmor? Someone other must help here I never really used AA.
gitea-mirror commented 2026-05-05 09:25:07 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

Its working if I disable apparmor, sudo aa-disable /etc/apparmor.d/torbrowser.Browser.firefox

<!-- gh-comment-id:973198277 --> @rugabunda commented on GitHub (Nov 18, 2021): Its working if I disable apparmor, `sudo aa-disable /etc/apparmor.d/torbrowser.Browser.firefox`
gitea-mirror commented 2026-05-05 09:25:07 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

Apparmor profiles may need some updating

<!-- gh-comment-id:973200650 --> @rugabunda commented on GitHub (Nov 18, 2021): Apparmor profiles may need some updating
gitea-mirror commented 2026-05-05 09:25:08 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

Thank you for your efforts! It was much appreciated!

<!-- gh-comment-id:973200781 --> @rugabunda commented on GitHub (Nov 18, 2021): Thank you for your efforts! It was much appreciated!
gitea-mirror commented 2026-05-05 09:25:08 -06:00
Author
Owner
Copy link

@rugabunda commented on GitHub (Nov 18, 2021):

Yes I usually run both without issue but I have ran into similar problems before, particularly with firefox

<!-- gh-comment-id:973201299 --> @rugabunda commented on GitHub (Nov 18, 2021): Yes I usually run both without issue but I have ran into similar problems before, particularly with firefox
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2752
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?