github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #4923] goldendict: clicking tray icon creates another tray icon instead of opening a program window #2816

New issue
Open
opened 2026-05-05 09:28:09 -06:00 by gitea-mirror · 9 comments
gitea-mirror commented 2026-05-05 09:28:09 -06:00
Owner
Copy link

Originally created by @jose1711 on GitHub (Feb 9, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4923

Description

When goldendict is running and tray icon is enabled clicking the icon duplicates it.

https://user-images.githubusercontent.com/1406222/153288802-24ba0c28-71e1-493e-9917-54ad3064ed97.mp4

Steps to Reproduce

  1. Install Tray Icons: Reloaded Gnome extension (https://extensions.gnome.org/extension/2890/tray-icons-reloaded/)
  2. Install Goldendict, enable tray icon in program settings
    obrázok
  3. Exit Goldendict
  4. Run Goldendict via firejail with the predefined profile
  5. Left-click the icon

Expected behavior

Goldendict window should open.

Actual behavior

No new window opens, but instead an icon is duplicated.

Behavior without a profile

Works without the profile, but to fix the issue all what is needed is to remove private-tmp.

Additional context

Similar issues were reported already:

Environment

Checklist

  • The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
  • I can reproduce the issue without custom modifications (e.g. globals.local).
  • The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
  • The profile (and redirect profile if exists) hasn't already been fixed upstream.
  • I have performed a short search for similar issues (to avoid opening a duplicate).
    • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
  • I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)
Originally created by @jose1711 on GitHub (Feb 9, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/4923 ### Description When `goldendict` is running and tray icon is enabled clicking the icon duplicates it. https://user-images.githubusercontent.com/1406222/153288802-24ba0c28-71e1-493e-9917-54ad3064ed97.mp4 ### Steps to Reproduce 1. Install `Tray Icons: Reloaded` Gnome extension (https://extensions.gnome.org/extension/2890/tray-icons-reloaded/) 2. Install Goldendict, enable tray icon in program settings ![obrázok](https://user-images.githubusercontent.com/1406222/153289278-927c5644-bff9-45a9-97d9-39eb00e8d3af.png) 3. Exit Goldendict 3. Run Goldendict via `firejail` with the predefined profile 4. Left-click the icon ### Expected behavior Goldendict window should open. ### Actual behavior No new window opens, but instead an icon is duplicated. ### Behavior without a profile Works without the profile, but to fix the issue all what is needed is to remove `private-tmp`. ### Additional context Similar issues were reported already: - https://github.com/netblue30/firejail/issues/4508 (mix of multiple issues) - https://github.com/netblue30/firejail/issues/1137 (only mentions chrome applications, goldendict is a Qt app) ### Environment - Arch Linux, x86_64 - Firejail-git a6672757d1d884d02538ac3f92b13f997ee3efbb ### Checklist <!-- Note: Items are checked with an "x", like so: - [x] This is a checked item. --> - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)
gitea-mirror added the
bug
 label 2026-05-05 09:28:09 -06:00
gitea-mirror commented 2026-05-05 09:28:11 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Feb 9, 2022):

If you ignore private-tmp which file does it create/access in /tmp?

<!-- gh-comment-id:1034197981 --> @rusty-snake commented on GitHub (Feb 9, 2022): If you `ignore private-tmp` which file does it create/access in `/tmp`?
gitea-mirror commented 2026-05-05 09:28:12 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Feb 9, 2022):

$ strace -f  /usr/bin/goldendict 2>&1 | grep /tmp
connect(3, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0
getpeername(3, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0
[pid 62476] connect(6, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0
[pid 62476] getpeername(6, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0
[pid 62476] connect(10, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0
[pid 62476] getpeername(10, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0
[pid 62476] connect(10, {sa_family=AF_UNIX, sun_path="/tmp/dbus-HA15SEvcI2"}, 22) = 0
[pid 62476] connect(15, {sa_family=AF_UNIX, sun_path=@"/tmp/.ICE-unix/1490"}, 22) = 0
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] readlink("/tmp", 0x7ffdd1bc6090, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] openat(AT_FDCWD, "/tmp/qtsingleapp-Golden-86bf-3e8-lockfile", O_RDWR|O_CREAT|O_CLOEXEC, 0666) = 16
[pid 62476] readlink("/tmp", 0x7ffdd1bc6000, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] bind(17, {sa_family=AF_UNIX, sun_path="/tmp/qtsingleapp-Golden-86bf-3e8"}, 110) = -1 EADDRINUSE (Address already in use)
[pid 62476] readlink("/tmp", 0x7ffdd1bc6150, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] unlink("/tmp/qtsingleapp-Golden-86bf-3e8") = 0
[pid 62476] readlink("/tmp", 0x7ffdd1bc6000, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] bind(17, {sa_family=AF_UNIX, sun_path="/tmp/qtsingleapp-Golden-86bf-3e8"}, 110) = 0
[pid 62480] connect(25, {sa_family=AF_UNIX, sun_path="/tmp/dbus-HA15SEvcI2"}, 22) = 0
<!-- gh-comment-id:1034207687 --> @jose1711 commented on GitHub (Feb 9, 2022): ``` $ strace -f /usr/bin/goldendict 2>&1 | grep /tmp connect(3, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0 getpeername(3, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0 [pid 62476] connect(6, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0 [pid 62476] getpeername(6, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0 [pid 62476] connect(10, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0 [pid 62476] getpeername(10, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0 [pid 62476] connect(10, {sa_family=AF_UNIX, sun_path="/tmp/dbus-HA15SEvcI2"}, 22) = 0 [pid 62476] connect(15, {sa_family=AF_UNIX, sun_path=@"/tmp/.ICE-unix/1490"}, 22) = 0 [pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318 [pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318 [pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318 [pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318 [pid 62476] readlink("/tmp", 0x7ffdd1bc6090, 1023) = -1 EINVAL (Invalid argument) [pid 62476] openat(AT_FDCWD, "/tmp/qtsingleapp-Golden-86bf-3e8-lockfile", O_RDWR|O_CREAT|O_CLOEXEC, 0666) = 16 [pid 62476] readlink("/tmp", 0x7ffdd1bc6000, 1023) = -1 EINVAL (Invalid argument) [pid 62476] bind(17, {sa_family=AF_UNIX, sun_path="/tmp/qtsingleapp-Golden-86bf-3e8"}, 110) = -1 EADDRINUSE (Address already in use) [pid 62476] readlink("/tmp", 0x7ffdd1bc6150, 1023) = -1 EINVAL (Invalid argument) [pid 62476] unlink("/tmp/qtsingleapp-Golden-86bf-3e8") = 0 [pid 62476] readlink("/tmp", 0x7ffdd1bc6000, 1023) = -1 EINVAL (Invalid argument) [pid 62476] bind(17, {sa_family=AF_UNIX, sun_path="/tmp/qtsingleapp-Golden-86bf-3e8"}, 110) = 0 [pid 62480] connect(25, {sa_family=AF_UNIX, sun_path="/tmp/dbus-HA15SEvcI2"}, 22) = 0 ```
gitea-mirror commented 2026-05-05 09:28:13 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Feb 9, 2022):

/tmp/qtsingleapp-Golden*

Mutex is stored in /tmp without subdir, we need to remove private-tmp from the profile use join-or-start goldendict.

Can you test if adding join-or-start goldendict works.

<!-- gh-comment-id:1034209145 --> @rusty-snake commented on GitHub (Feb 9, 2022): > `/tmp/qtsingleapp-Golden*` Mutex is stored in /tmp without subdir, we need to ~remove `private-tmp` from the profile~ use `join-or-start goldendict`. Can you test if adding `join-or-start goldendict` works.
gitea-mirror commented 2026-05-05 09:28:14 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Feb 9, 2022):

Can you test if adding join-or-start goldendict works.

Yup, I can confirm. That really fixes it!

<!-- gh-comment-id:1034212354 --> @jose1711 commented on GitHub (Feb 9, 2022): > Can you test if adding `join-or-start goldendict` works. Yup, I can confirm. That really fixes it!
gitea-mirror commented 2026-05-05 09:28:15 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Feb 9, 2022):

flameshot.profile suffers from the same issue (and join-or-start flameshot fixes that too)

<!-- gh-comment-id:1034233268 --> @jose1711 commented on GitHub (Feb 9, 2022): `flameshot.profile` suffers from the same issue (and `join-or-start flameshot` fixes that too)
gitea-mirror commented 2026-05-05 09:28:16 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Feb 9, 2022):

That's because Qt uses it's own socket instead of D-Bus (like GTK) for instance management.

To continue the list:

  • keepassxc
  • maybe vlc?
  • maybe qtox?
  • ...
<!-- gh-comment-id:1034236469 --> @rusty-snake commented on GitHub (Feb 9, 2022): That's because Qt uses it's own socket instead of D-Bus (like GTK) for instance management. To continue the list: - keepassxc - maybe vlc? - maybe qtox? - ...
gitea-mirror commented 2026-05-05 09:28:17 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Feb 9, 2022):

Tried both keepassxc and vlc and cannot reproduce the same problem for those.

<!-- gh-comment-id:1034239745 --> @jose1711 commented on GitHub (Feb 9, 2022): Tried both keepassxc and vlc and cannot reproduce the same problem for those.
gitea-mirror commented 2026-05-05 09:28:18 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Feb 9, 2022):

keepassxc already has j-o-s and for vlc I'm not sure (maybe depending on the config?).

<!-- gh-comment-id:1034241989 --> @rusty-snake commented on GitHub (Feb 9, 2022): keepassxc already has j-o-s and for vlc I'm not sure (maybe depending on the config?).
gitea-mirror commented 2026-05-05 09:28:18 -06:00
Author
Owner
Copy link

@jose1711 commented on GitHub (Feb 9, 2022):

keepassxc already has j-o-s

ah, true..

<!-- gh-comment-id:1034255790 --> @jose1711 commented on GitHub (Feb 9, 2022): > keepassxc already has j-o-s ah, true..
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2816
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?