mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4698] firefox: freeze with custom profile (seccomp) #2754
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2754
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @fpusersuggest on GitHub (Nov 18, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4698
Description
Describe the bug
Hello, I have a custom profile for firefox.
If I go on a specific facebook group, that firefox tab freeze and I have to close it.
I found an error in the log and I like to know how to fix it.
This is the log:
nov 18 20:48:14 mypc audit[10931]: SECCOMP auid=1000 uid=1000 gid=1001 ses=1 subj=firejail-default pid=10931 comm=57656220436F6E74656E74 exe="/usr/lib/firefox/firefox" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7fe97668589d code=0x0
nov 18 20:48:14 mypc kernel: audit: type=1326 audit(1637264894.948:51): auid=1000 uid=1000 gid=1001 ses=1 subj=firejail-default pid=10931 comm=57656220436F6E74656E74 exe="/usr/lib/firefox/firefox" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7fe97668589d code=0x0
Steps to Reproduce
LC_ALL=C firejail PROGRAM(LC_ALL=Cto get a consistent output in English that can be understood by everybody)$ LC_ALL=C firejail firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 14951, child pid 14952
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Post-exec seccomp protector enabled
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 182.72 ms
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
I connect to facebook and then to the following facebook group
https://www.facebook.com/groups/477126719059034
after that the facebook tab freeze and I see the error in the log:
nov 18 20:55:56 audit[15170]: SECCOMP auid=1000 uid=1000 gid=1001 ses=1 subj=firejail-default pid=15170 comm=57656220436F6E74656E74 exe="/usr/lib/firefox/firefox" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7f0d6896189d code=0x0
nov 18 20:55:56 kernel: audit: type=1326 audit(1637265356.469:52): auid=1000 uid=1000 gid=1001 ses=1 subj=firejail-default pid=15170 comm=57656220436F6E74656E74 exe="/usr/lib/firefox/firefox" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7f0d6896189d code=0x0
Expected behavior
browse facebook without freeze
Environment
Linux distribution and version (e.g. "Ubuntu 20.04" or "Arch Linux")
ubuntu 20.04
$ uname -a
Linux mypc 5.11.0-40-generic #44~20.04.2-Ubuntu SMP Tue Oct 26 18:07:44 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
Firejail version (
firejail --version).firejail version 0.9.62
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Output of
LC_ALL=C firejail --debug /path/to/programWhen I click on that facebook group I get the following in the console:
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
@rusty-snake commented on GitHub (Nov 18, 2021):
Duplicate of #3219
@rusty-snake commented on GitHub (Nov 18, 2021):
Either update firejail (to a version without vulnerabilities) or add
!kcmptoseccomp.@fpusersuggest commented on GitHub (Nov 18, 2021):
thanks, but how should I add it ?
because if I add !kcmp in the following way:
seccomp !chroot !kcmpfirefox don't start and it give the following error:
Error: invalid syscall list entry !chroot !kcmpand exit. If I add in this other way:
firefox freeze.
@rusty-snake commented on GitHub (Nov 19, 2021):
@kmk3 commented on GitHub (Nov 23, 2021):
@fpusersuggest commented on Nov 18:
I'd suggest using a more recent version; see:
@rusty-snake commented on GitHub (Nov 29, 2021):
https://bugs.launchpad.net/ubuntu/+source/firejail/+bug/1950683/comments/5:
ed142c62bf).