mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4929] Opera not starting after updating profiles #2823
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2823
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @saddy001 on GitHub (Feb 11, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4929
This is Ubuntu 20.04, firejail 0.9.68. Updated the firejail profiles yesterday, now Opera won't start. Complaints:
I fixed the GSettings problem by adding --whitelist=/usr/share/glib-2.0/schemas. Opera starts, but it cannot fetch stored passwords. I have KeePassXC running. Think it's related to the dbus errors above? Maybe https://github.com/netblue30/firejail/issues/4917 also related.
@saddy001 commented on GitHub (Feb 11, 2022):
Tried
https://github.com/netblue30/firejail/issues/4917#issuecomment-1033595197
But password store retrieval still not working.
@saddy001 commented on GitHub (Feb 11, 2022):
For sake of completeness, here's the log after GSettings fix (successful start):
@rusty-snake commented on GitHub (Feb 11, 2022):
We will need to add
to all of them.
@saddy001 commented on GitHub (Feb 11, 2022):
Thanks. Are there command line switches for these two parameters above? I'd like to avoid a custom profile as long as I can.
Could take a while until the patches will reach the Ubuntu repos.
@rusty-snake commented on GitHub (Feb 11, 2022):
@saddy001 commented on GitHub (Feb 11, 2022):
I decided for option 2. but still no autofill. I added these lines in between in in /etc/firejail/opera.profile:
Is something wrong with that?
@saddy001 commented on GitHub (Feb 17, 2022):
I found out it's a bit different. Autofill seemed not to work because there were no entries anymore since the profiles update. However, I can store new entries and they are accessable after that. The question is, what happened to the old entries? Maybe they are stored in a different location now?
Since autofill works and I have backups of the old entries it's no issue for me now. Ticket can be closed.
@saddy001 commented on GitHub (Feb 17, 2022):
I take it back. Password entries are not accessible again after restarting Opera.
@smitsohu commented on GitHub (Mar 5, 2022):
Does it work if you start opera this way:
firejail --ignore=whitelist opera?If yes please try the following: Head to /etc/firejail/firejail.config and (only for debugging) append a line
seccomp-filter-add !chrootThen run
firejail --build opera, try to get your passwords, and exit. At this point you should see many recommendations forwhitelistdirectives, which may give a hint to what's missing here.@saddy001 commented on GitHub (Mar 6, 2022):
It's hard to say since I have stored my passwords again in the meantime. However, they are accessible and the gsettings workaround seems not necessary anymore. Since I have backed up my passwords before, I skipped your steps 2 and 3.
@ghost commented on GitHub (Mar 7, 2022):
Those Widevine errors relate to
include disable-exec.incand the conditional'?BROWSER_ALLOW_DRM: ignore noexec ${HOME}fromchromium-common.profile. If you haven't changed any defaults in /etc/firejail/firejail.config this particular conditional returns 'false', the noexec is never ignored and Opera complains about it.Most of the other errors I see here to, but they don't seem to break any functionality. Like the bus.cc lines, to be expected due to 'dbus-system none'. Some also show up when running non-girejailed (Invalid url pattern for example). That leaves the NSS one, which doesn't show for me. In fact, I can't reproduce any of this on Arch Linux with Firejail built from git and opera 84.0.4316.31. Passwords are accessible, show up in Opera's settings, can be exported and autofill functions properly. Only thing changed from defaults is I
include chromium-common-hardened.inc.profilein a chromium-common.local for extra hardening. We haven't much to go on yet to really help, which leads to more questions...Do you use the deb.opera.com repository on your Ubuntu? Do you use AppArmor? Is the Opera's internal sandbox SUID on your installation? Check these specifics please and report back.
@saddy001 commented on GitHub (Mar 7, 2022):
I assume the password problem is (or was) related to my use of KeePassXC as mentioned in an earlier post. To my knowledge it intercepts the browser's password accesses but I don't know the technical details.
At the moment, I'm able to start opera again and access my passwords so we can close this ticket?
@ghost commented on GitHub (Mar 7, 2022):
Thanks for posting the outputs, they're fine. Just remember to add
ignore noexec ${HOME}in opera.local if you want to play DRM protected content.I don't have anything else so personally I'm fine with closing here. @netblue30 marked this as a bug so I'll leave it up to him. There might be something he wants to look at.
@netblue30 commented on GitHub (Mar 11, 2022):
Let's close it, not a bug on our side. Thanks!