#2801 - [GH-ISSUE #4884] Geeqie - protocol=unix disables map view - github-starred/firejail

gitea-mirror commented

2026-05-05 09:27:26 -06:00

Owner

Originally created by @jose1711 on GitHub (Jan 29, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4884

Description

With protocol unix in geeqie.profile one gets a blank map in map view:

Steps to Reproduce

Steps to reproduce the behavior

Run in bash LC_ALL=C firejail geeqie
Make sure View - Info Sidebar is enabled
Click [+] to Add pane - select GPS map
Locate an image with GPS metadata and select it

Expected behavior

You should get a map view in GPS map, similar to this:

Actual behavior

Map is blank, only pin is visible.

Behavior without a profile

Map is showing up.

Environment

Linux distribution and version: Arch Linux x86_64
Firejail version: 0.9.67-git (a6672757d1)

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Originally created by @jose1711 on GitHub (Jan 29, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/4884  ### Description With `protocol unix` in `geeqie.profile` one gets a blank map in map view: ![obrázok](https://user-images.githubusercontent.com/1406222/151653678-113b529c-47df-4018-adba-96cd29baffec.png) ### Steps to Reproduce _Steps to reproduce the behavior_ 1. Run in bash `LC_ALL=C firejail geeqie` 2. Make sure View - Info Sidebar is enabled 3. Click [+] to Add pane - select GPS map 4. Locate an image with GPS metadata and select it ### Expected behavior You should get a map view in GPS map, similar to this: ![obrázok](https://user-images.githubusercontent.com/1406222/151653979-1b060872-60b6-49fd-8095-5e5c10b74699.png) ### Actual behavior Map is blank, only pin is visible. ### Behavior without a profile Map is showing up. ### Environment - Linux distribution and version: Arch Linux x86_64 - Firejail version: 0.9.67-git (a6672757d1d884d02538ac3f92b13f997ee3efbb) ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)

gitea-mirror closed this issue

2026-05-05 09:27:27 -06:00

gitea-mirror commented

2026-05-05 09:27:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 29, 2022):

Does protocol unix,inet,inet6 work?

@rusty-snake commented on GitHub (Jan 29, 2022): Does `protocol unix,inet,inet6` work?

gitea-mirror commented

2026-05-05 09:27:29 -06:00

Author

Owner

@jose1711 commented on GitHub (Jan 29, 2022):

Does protocol unix,inet,inet6 work?

It does.

@jose1711 commented on GitHub (Jan 29, 2022): > Does `protocol unix,inet,inet6` work? It does.

gitea-mirror commented

2026-05-05 09:27:30 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 29, 2022):

The profile hasn't been touch for 5 year (if you ignore mass updates, ordering, ...). If you want you can try to if this one works.

geeqie.profile

# Firejail profile for geeqie
# Description: Image viewer using GTK+
# This file is overwritten after every install/update
# Persistent local customizations
include geeqie.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.cache/geeqie
noblacklist ${HOME}/.config/geeqie
noblacklist ${HOME}/.local/share/geeqie

# If you have a /usr/libexec dir
#blacklist /usr/libexec

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-proc.inc
include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc

mkdir ${HOME}/.cache/geeqie
mkdir ${HOME}/.config/geeqie
mkdir ${HOME}/.local/share/geeqie
whitelist ${HOME}/.cache/geeqie
whitelist ${HOME}/.config/geeqie
whitelist ${HOME}/.local/share/geeqie
#whitelist /usr/share/geeqie if it exist
include whitelist-common.inc
include whitelist-run-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
machine-id
netfilter
nodvd
nogroups
noinput
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
seccomp.block-secondary
shell none
tracelog

# private-bin geeqie
private-cache
private-dev
private-tmp

dbus-user none
#dbus-user filter
#dbus-user.own org.geeqie.Geeqie
#dbus-user.talk ca.desrt.dconf
dbus-system none

@rusty-snake commented on GitHub (Jan 29, 2022): The profile hasn't been touch for 5 year (if you ignore mass updates, ordering, ...). If you want you can try to if this one works. <details><summary>geeqie.profile</summary> ``` # Firejail profile for geeqie # Description: Image viewer using GTK+ # This file is overwritten after every install/update # Persistent local customizations include geeqie.local # Persistent global definitions include globals.local noblacklist ${HOME}/.cache/geeqie noblacklist ${HOME}/.config/geeqie noblacklist ${HOME}/.local/share/geeqie # If you have a /usr/libexec dir #blacklist /usr/libexec include disable-common.inc include disable-devel.inc include disable-exec.inc include disable-interpreters.inc include disable-proc.inc include disable-programs.inc include disable-shell.inc include disable-xdg.inc mkdir ${HOME}/.cache/geeqie mkdir ${HOME}/.config/geeqie mkdir ${HOME}/.local/share/geeqie whitelist ${HOME}/.cache/geeqie whitelist ${HOME}/.config/geeqie whitelist ${HOME}/.local/share/geeqie #whitelist /usr/share/geeqie if it exist include whitelist-common.inc include whitelist-run-common.inc include whitelist-runuser-common.inc include whitelist-usr-share-common.inc include whitelist-var-common.inc apparmor caps.drop all machine-id netfilter nodvd nogroups noinput nonewprivs noroot nosound notv nou2f novideo protocol unix,inet,inet6 seccomp seccomp.block-secondary shell none tracelog # private-bin geeqie private-cache private-dev private-tmp dbus-user none #dbus-user filter #dbus-user.own org.geeqie.Geeqie #dbus-user.talk ca.desrt.dconf dbus-system none ``` </details>

gitea-mirror commented

2026-05-05 09:27:31 -06:00

Author

Owner

@jose1711 commented on GitHub (Jan 29, 2022):

Thank you, will test this profile for a few weeks. Also not sure if inet,inet6 should be the default, perhaps it would be okay just to mention it in the comment. The best option would probably be to only allow communication with map servers (OpenStreetMap and OpenWeatherMap) but that is probably not achievable with firejail, is it?

@jose1711 commented on GitHub (Jan 29, 2022): Thank you, will test this profile for a few weeks. Also not sure if `inet,inet6` should be the default, perhaps it would be okay just to mention it in the comment. The best option would probably be to only allow communication with map servers (OpenStreetMap and OpenWeatherMap) but that is probably not achievable with `firejail`, is it?

gitea-mirror commented

2026-05-05 09:27:32 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 29, 2022):

The best option would probably be to only allow communication with map servers (OpenStreetMap and OpenWeatherMap) but that is probably not achievable with firejail, is it?

In theory you can use netfilter, however OSM uses fastly.net. Allowing the IPs of such big CDNs (cloudflare, fastly, aws, ...) allows so much that it's not worth.

@rusty-snake commented on GitHub (Jan 29, 2022): > The best option would probably be to only allow communication with map servers (OpenStreetMap and OpenWeatherMap) but that is probably not achievable with firejail, is it? In theory you can use `netfilter`, however OSM uses fastly.net. Allowing the IPs of such big CDNs (cloudflare, fastly, aws, ...) allows so much that it's not worth.

gitea-mirror commented

2026-05-05 09:27:33 -06:00

Author

Owner

@jose1711 commented on GitHub (Jan 29, 2022):

The best option would probably be to only allow communication with map servers (OpenStreetMap and OpenWeatherMap) but that is probably not achievable with firejail, is it?

In theory you can use netfilter, however OSM uses fastly.net. Allowing the IPs of such big CDNs (cloudflare, fastly, aws, ...) allows so much that it's not worth.

Thank you, this is a bit off-topic but how about restricting DNS queries? Allow to request IP of tile.openstreetmap.org and restrict anything else.

@jose1711 commented on GitHub (Jan 29, 2022): > > The best option would probably be to only allow communication with map servers (OpenStreetMap and OpenWeatherMap) but that is probably not achievable with firejail, is it? > > In theory you can use `netfilter`, however OSM uses fastly.net. Allowing the IPs of such big CDNs (cloudflare, fastly, aws, ...) allows so much that it's not worth. Thank you, this is a bit off-topic but how about restricting DNS queries? Allow to request IP of `tile.openstreetmap.org` and restrict anything else.

gitea-mirror commented

2026-05-05 09:27:34 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 29, 2022):

You can still access everything by IP if you restrict DNS queries. This would be a false sense of security.
You can use fdns to do so. For example if your goal is privacy (i.e. block telemetry), block ads, known malware&phising, ...
Even if we only allow the IP of tile.openstreetmap.org, there can still be hundreds of other domains behind that IP (because it's a CDN).

@rusty-snake commented on GitHub (Jan 29, 2022): 1. You can still access everything by IP if you restrict DNS queries. This would be a false sense of security. 2. You can use [fdns](https://github.com/netblue30/fdns) to do so. For example if your goal is privacy (i.e. block telemetry), block ads, known malware&phising, ... 3. Even if we only allow the IP of `tile.openstreetmap.org`, there can still be hundreds of other domains behind that IP (because it's a CDN).

gitea-mirror commented

2026-05-05 09:27:35 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 3, 2022):

OK, let's bring in protocol unix,inet,inet6

Fix here: d11a62564d

@netblue30 commented on GitHub (Feb 3, 2022): OK, let's bring in protocol unix,inet,inet6 Fix here: https://github.com/netblue30/firejail/commit/d11a62564de4bd3d2a48e67fdadc81e634939128

Rows
Columns

[GH-ISSUE #4884] Geeqie - protocol=unix disables map view #2801

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Environment

Checklist