[GH-ISSUE #4875] shellcheck: cannot enable executable stack (mdwe)

gitea-mirror commented

2026-05-05 09:27:12 -06:00

Owner

Originally created by @redxef on GitHub (Jan 21, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4875

Description

Running shellcheck results in the following error when using firejail

$ /usr/local/bin/shellcheck
/usr/bin/shellcheck: error while loading shared libraries: libHSrts-ghc9.0.2.so: cannot enable executable stack as shared object requires: Operation not permitted

But succeeds when running directly

$ /usr/bin/shellcheck
No files specified.

<usage output, etc.>

shellcheck version: 0.8.0
firejail version: 0.9.66

Steps to Reproduce

Steps to reproduce the behavior

Try to run shellcheck
observe crash

Expected behavior

shellcheck should be able to run.

Actual behavior

Shellcheck aborts with the error message /usr/bin/shellcheck: error while loading shared libraries: libHSrts-ghc9.0.2.so: cannot enable executable stack as shared object requires: Operation not permitted

Behavior without a profile

What changed calling LC_ALL=C firejail --noprofile /path/to/program in a terminal?

The program runs as expected.

Additional context

Environment

Linux Distro: Arch Linux, up to date as of 2022-01-21 10:42:38+0100
Firejail version: 0.9.66
shellcheck version: 0.8.0

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

/usr/bin/shellcheck: error while loading shared libraries: libHSrts-ghc9.0.2.so: cannot enable executable stack as shared object requires: Operation not permitted

Output of LC_ALL=C firejail --debug /path/to/program

Originally created by @redxef on GitHub (Jan 21, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/4875  ### Description Running shellcheck results in the following error when using firejail ``` $ /usr/local/bin/shellcheck /usr/bin/shellcheck: error while loading shared libraries: libHSrts-ghc9.0.2.so: cannot enable executable stack as shared object requires: Operation not permitted ``` But succeeds when running directly ``` $ /usr/bin/shellcheck No files specified. <usage output, etc.> ``` _shellcheck version_: `0.8.0` _firejail version_: `0.9.66` ### Steps to Reproduce _Steps to reproduce the behavior_ 1. Try to run shellcheck 2. observe crash ### Expected behavior shellcheck should be able to run. ### Actual behavior Shellcheck aborts with the error message `/usr/bin/shellcheck: error while loading shared libraries: libHSrts-ghc9.0.2.so: cannot enable executable stack as shared object requires: Operation not permitted` ### Behavior without a profile _What changed calling `LC_ALL=C firejail --noprofile /path/to/program` in a terminal?_ The program runs as expected. ### Additional context ### Environment - _Linux Distro_: Arch Linux, up to date as of `2022-01-21 10:42:38+0100` - _Firejail version_: `0.9.66` - _shellcheck version_: `0.8.0` ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` /usr/bin/shellcheck: error while loading shared libraries: libHSrts-ghc9.0.2.so: cannot enable executable stack as shared object requires: Operation not permitted ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p> ``` ``` </p> </details>

gitea-mirror closed this issue

2026-05-05 09:27:13 -06:00

gitea-mirror commented

2026-05-05 09:27:14 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 21, 2022):

Does firejail --ignore=memory-deny-write-execute /usr/bin/shellcheck … work?

@rusty-snake commented on GitHub (Jan 21, 2022): Does `firejail --ignore=memory-deny-write-execute /usr/bin/shellcheck …` work?

gitea-mirror commented

2026-05-05 09:27:15 -06:00

Author

Owner

@ghost commented on GitHub (Jan 22, 2022):

On Arch Linux I cannot reproduce BUT I use shellcheck-bin from AUR, which doesn't have the haskell dependencies. That version works as expected here, including with memory-deny-write-execute (a nice option to have in a sandbox). I'm assuming the referenced libHSrts-ghc9.0.2.so in your error is a haskell kib, correct?

There's not a trace of haskell in our repo currently. Maybe someone who has experience with it could create a allow-haskell.inc and its counterparts.

@ghost commented on GitHub (Jan 22, 2022): On Arch Linux I cannot reproduce BUT I use [shellcheck-bin](https://aur.archlinux.org/packages/shellcheck-bin/) from AUR, which doesn't have the haskell dependencies. That version works as expected here, including with memory-deny-write-execute (a nice option to have in a sandbox). I'm assuming the referenced `libHSrts-ghc9.0.2.so` in your error is a haskell kib, correct? There's not a trace of haskell in our repo currently. Maybe someone who has experience with it could create a allow-haskell.inc and its counterparts.

gitea-mirror commented

2026-05-05 09:27:16 -06:00

Author

Owner

@redxef commented on GitHub (Jan 27, 2022):

firejail --ignore=memory-deny-write-execute /usr/bin/shellcheck solves the problem.

@redxef commented on GitHub (Jan 27, 2022): `firejail --ignore=memory-deny-write-execute /usr/bin/shellcheck` solves the problem.

gitea-mirror commented

2026-05-05 09:27:18 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 27, 2022):

Is there any seccomp related error?

5356609ae9/etc/templates/syscalls.txt (L92-L99)

Or anything else in you syslog?

If not, you have to comment the profile and uncomment it line for line.

@rusty-snake commented on GitHub (Jan 27, 2022): Is there any seccomp related error? https://github.com/netblue30/firejail/blob/5356609ae972c55c699bb08acc6bb09fbb054216/etc/templates/syscalls.txt#L92-L99 Or anything else in you syslog? If not, you have to comment the profile and uncomment it line for line.

gitea-mirror commented

2026-05-05 09:27:19 -06:00

Author

Owner

@redxef commented on GitHub (Jan 27, 2022):

Seccomp reported mprotect, since the last option in the shellcheck config was memory-deny-write-execute I disabled this option which solved it. Switching seccomp to seccomp !mprotect didn't help though.

@redxef commented on GitHub (Jan 27, 2022): Seccomp reported `mprotect`, since the last option in the shellcheck config was `memory-deny-write-execute` I disabled this option which solved it. Switching `seccomp` to `seccomp !mprotect` didn't help though.

gitea-mirror commented

2026-05-05 09:27:20 -06:00

Author

Owner

@MiltiadisKoutsokeras commented on GitHub (Feb 4, 2022):

Confirmed in Arch Linux, Firejail 0.9.66 and shellcheck 0.8.0. Workaround firejail --ignore=memory-deny-write-execute /usr/bin/shellcheck works.

@MiltiadisKoutsokeras commented on GitHub (Feb 4, 2022): Confirmed in Arch Linux, Firejail 0.9.66 and shellcheck 0.8.0. Workaround `firejail --ignore=memory-deny-write-execute /usr/bin/shellcheck` works.

gitea-mirror referenced this issue

2026-05-05 10:00:20 -06:00

[GH-ISSUE #6994] Remove overlayfs support/--overlay commands #3445

gitea-mirror referenced this issue

2026-05-05 10:50:44 -06:00

[PR #6632] [MERGED] docs: clarify unmaintained status of overlayfs in configure.ac #6099