[GH-ISSUE #4965] The latest stable chrome (98.0.4758.102) does not start with firejail.

gitea-mirror commented

2026-05-05 09:29:40 -06:00

Owner

Originally created by @reagentoo on GitHub (Feb 20, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4965

Description

Latest stable chrome (98.0.4758.102) does not start with firejail.

Steps to Reproduce

Steps to reproduce the behavior

Run chrome with wayland support or without it.

Expected behavior

Open browser.

Actual behavior

Browser does not start.

Behavior without a profile

Browser works without a profile.

Environment

Linux Gentoo ~amd64
firejail version 0.9.68
chrome 98.0.4758.102

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
[?] The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail --debug google-chrome-stable -ozone-platform=wayland

https://gist.github.com/reagentoo/b93887dde23d149b945b6e9c97760e20

Originally created by @reagentoo on GitHub (Feb 20, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/4965  ### Description Latest stable chrome (98.0.4758.102) does not start with firejail. ### Steps to Reproduce _Steps to reproduce the behavior_ 1. Run chrome with wayland support or without it. ### Expected behavior Open browser. ### Actual behavior Browser does not start. ### Behavior without a profile Browser works without a profile. ### Environment Linux Gentoo ~amd64 firejail version 0.9.68 chrome 98.0.4758.102 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [?] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail --debug google-chrome-stable -ozone-platform=wayland</code></summary> <p> https://gist.github.com/reagentoo/b93887dde23d149b945b6e9c97760e20 </p> </details>

gitea-mirror

2026-05-05 09:29:40 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 09:29:42 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 20, 2022):

~~Duplicate of #4961/#4960 I guess.~~ edit: no, duplicate of #4929.

Does firejail --ignore=nogroups /usr/bin/google-chrome-stable --ozone-platform=wayland work?

@rusty-snake commented on GitHub (Feb 20, 2022): ~Duplicate of #4961/#4960 I guess.~ edit: no, duplicate of #4929. Does `firejail --ignore=nogroups /usr/bin/google-chrome-stable --ozone-platform=wayland` work?

gitea-mirror commented

2026-05-05 09:29:43 -06:00

Author

Owner

@reagentoo commented on GitHub (Feb 20, 2022):

Does firejail --ignore=nogroups /usr/bin/google-chrome-stable --ozone-platform=wayland work?

Does not work.

@reagentoo commented on GitHub (Feb 20, 2022): > Does `firejail --ignore=nogroups /usr/bin/google-chrome-stable --ozone-platform=wayland` work? Does not work.

gitea-mirror commented

2026-05-05 09:29:44 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 20, 2022):

Can you post /etc/firejail/chromium-common.profile.

@rusty-snake commented on GitHub (Feb 20, 2022): Can you post `/etc/firejail/chromium-common.profile`.

gitea-mirror commented

2026-05-05 09:29:45 -06:00

Author

Owner

@reagentoo commented on GitHub (Feb 20, 2022):

Can you post /etc/firejail/chromium-common.profile.

Output of cat /etc/firejail/chromium-common.profile

# Firejail profile for chromium-common
# This file is overwritten after every install/update
# Persistent local customizations
include chromium-common.local
# Persistent global definitions
# added by caller profile
#include globals.local

# noexec ${HOME} breaks DRM binaries.
?BROWSER_ALLOW_DRM: ignore noexec ${HOME}

noblacklist ${HOME}/.local/share/pki
noblacklist ${HOME}/.pki
noblacklist /usr/lib/chromium/chrome-sandbox

# Add the next line to your chromium-common.local if you want Google Chrome/Chromium browser
# to have access to Gnome extensions (extensions.gnome.org) via browser connector
#include allow-python3.inc

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-xdg.inc

mkdir ${HOME}/.local/share/pki
mkdir ${HOME}/.pki
whitelist ${DOWNLOADS}
whitelist ${HOME}/.local/share/pki
whitelist ${HOME}/.pki
whitelist /usr/share/mozilla/extensions
whitelist /usr/share/webext
include whitelist-common.inc
include whitelist-run-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

# Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone.
#include chromium-common-hardened.inc.profile

apparmor
caps.keep sys_admin,sys_chroot
netfilter
nodvd
nogroups
noinput
notv
?BROWSER_DISABLE_U2F: nou2f
shell none

disable-mnt
private-cache
?BROWSER_DISABLE_U2F: private-dev
#private-tmp - issues when using multiple browser sessions

blacklist ${PATH}/curl
blacklist ${PATH}/wget
blacklist ${PATH}/wget2

#dbus-user none - prevents access to passwords saved in GNOME Keyring and KWallet, also breaks Gnome connector.
dbus-system none

# The file dialog needs to work without d-bus.
?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1

@reagentoo commented on GitHub (Feb 20, 2022): > Can you post `/etc/firejail/chromium-common.profile`. <details> <summary>Output of <code>cat /etc/firejail/chromium-common.profile</code></summary> <p> ``` # Firejail profile for chromium-common # This file is overwritten after every install/update # Persistent local customizations include chromium-common.local # Persistent global definitions # added by caller profile #include globals.local # noexec ${HOME} breaks DRM binaries. ?BROWSER_ALLOW_DRM: ignore noexec ${HOME} noblacklist ${HOME}/.local/share/pki noblacklist ${HOME}/.pki noblacklist /usr/lib/chromium/chrome-sandbox # Add the next line to your chromium-common.local if you want Google Chrome/Chromium browser # to have access to Gnome extensions (extensions.gnome.org) via browser connector #include allow-python3.inc include disable-common.inc include disable-devel.inc include disable-exec.inc include disable-interpreters.inc include disable-programs.inc include disable-xdg.inc mkdir ${HOME}/.local/share/pki mkdir ${HOME}/.pki whitelist ${DOWNLOADS} whitelist ${HOME}/.local/share/pki whitelist ${HOME}/.pki whitelist /usr/share/mozilla/extensions whitelist /usr/share/webext include whitelist-common.inc include whitelist-run-common.inc include whitelist-runuser-common.inc include whitelist-usr-share-common.inc include whitelist-var-common.inc # Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone. #include chromium-common-hardened.inc.profile apparmor caps.keep sys_admin,sys_chroot netfilter nodvd nogroups noinput notv ?BROWSER_DISABLE_U2F: nou2f shell none disable-mnt private-cache ?BROWSER_DISABLE_U2F: private-dev #private-tmp - issues when using multiple browser sessions blacklist ${PATH}/curl blacklist ${PATH}/wget blacklist ${PATH}/wget2 #dbus-user none - prevents access to passwords saved in GNOME Keyring and KWallet, also breaks Gnome connector. dbus-system none # The file dialog needs to work without d-bus. ?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1 ``` </p> </details>

gitea-mirror commented

2026-05-05 09:29:45 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 20, 2022):

include whitelist-usr-share-common.inc

but it ever Found whitelist-usr-share-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/whitelist--usr-share-common.inc in the log or processing it.

@rusty-snake commented on GitHub (Feb 20, 2022): > include whitelist-usr-share-common.inc but it ever `Found whitelist-usr-share-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/whitelist--usr-share-common.inc` in the log or processing it.

gitea-mirror commented

2026-05-05 09:29:46 -06:00

Author

Owner

@reagentoo commented on GitHub (Feb 20, 2022):

/etc/firejail/whitelist-usr-share-common.inc exists, but it's really missing in the logs..

@reagentoo commented on GitHub (Feb 20, 2022): `/etc/firejail/whitelist-usr-share-common.inc` exists, but it's really missing in the logs..

gitea-mirror commented

2026-05-05 09:29:46 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 20, 2022):

Because it's google-chrome and not chromium.

@rusty-snake commented on GitHub (Feb 20, 2022): Because it's google-chrome and not chromium.

gitea-mirror commented

2026-05-05 09:29:47 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 20, 2022):

Duplicate of #4929

@rusty-snake commented on GitHub (Feb 20, 2022): Duplicate of #4929

gitea-mirror commented

2026-05-05 09:29:47 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 20, 2022):

See https://github.com/netblue30/firejail/issues/4929#issuecomment-1036032104

@rusty-snake commented on GitHub (Feb 20, 2022): See https://github.com/netblue30/firejail/issues/4929#issuecomment-1036032104

gitea-mirror commented

2026-05-05 09:29:48 -06:00

Author

Owner

@reagentoo commented on GitHub (Feb 20, 2022):

Thanks!

echo 'ignore whitelist /usr/share/mozilla/extensions' >> ~/.config/firejail/google-chrome-stable.local
echo 'ignore whitelist /usr/share/webext' >> ~/.config/firejail/google-chrome-stable.local

it has resolved the problem

@reagentoo commented on GitHub (Feb 20, 2022): Thanks! ``` echo 'ignore whitelist /usr/share/mozilla/extensions' >> ~/.config/firejail/google-chrome-stable.local echo 'ignore whitelist /usr/share/webext' >> ~/.config/firejail/google-chrome-stable.local ``` it has resolved the problem

gitea-mirror commented

2026-05-05 09:29:48 -06:00

Author

Owner

@jose1711 commented on GitHub (Mar 4, 2022):

I have a similar problem. Arch Linux, google-chrome 99.0.4844.51-1, firejail 11af029. For me however the browser starts, I am able to select user profile, even loading pages but only those which use http:// protocol. For https:// I am getting:

This is what appears in the console:

[48:53:0304/092733.604017:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202
[48:53:0304/092734.764805:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202
[48:53:0304/092736.897605:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202
[48:53:0304/092740.293125:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202
[48:53:0304/092740.991840:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202
[6:43:0304/092745.481617:ERROR:cert_verify_proc_builtin.cc(681)] CertVerifyProcBuiltin for www.google.com failed:
----- Certificate i=3 (CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE) -----
ERROR: No matching issuer found

Removing lines

whitelist /usr/share/mozilla/extensions
whitelist /usr/share/webext

From chromium-common.profile fixes the problem.

@jose1711 commented on GitHub (Mar 4, 2022): I have a similar problem. Arch Linux, `google-chrome 99.0.4844.51-1`, `firejail` 11af029. For me however the browser starts, I am able to select user profile, even loading pages but only those which use http:// protocol. For https:// I am getting: ![obrázok](https://user-images.githubusercontent.com/1406222/156736775-cd267d54-8cfb-4798-a564-adf67b736391.png) This is what appears in the console: ``` [48:53:0304/092733.604017:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202 [48:53:0304/092734.764805:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202 [48:53:0304/092736.897605:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202 [48:53:0304/092740.293125:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202 [48:53:0304/092740.991840:ERROR:ssl_client_socket_impl.cc(995)] handshake failed; returned -1, SSL error code 1, net_error -202 [6:43:0304/092745.481617:ERROR:cert_verify_proc_builtin.cc(681)] CertVerifyProcBuiltin for www.google.com failed: ----- Certificate i=3 (CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE) ----- ERROR: No matching issuer found ``` Removing lines ``` whitelist /usr/share/mozilla/extensions whitelist /usr/share/webext ``` From `chromium-common.profile` fixes the problem.

gitea-mirror commented

2026-05-05 09:29:48 -06:00

Author

Owner

@ghost commented on GitHub (Mar 4, 2022):

Removing lines
whitelist /usr/share/mozilla/extensions
whitelist /usr/share/webext
From chromium-common.profile fixes the problem.

@jose1711 Nice to see you've found a fix. Those two lines moved from chromium.profile to chromium-common.profile in 0319fbdc4b. Not sure why, but @reinerh probably had good reasons to do so. Let's see if we can come up with a better compromise somehow.

@ghost commented on GitHub (Mar 4, 2022): > Removing lines whitelist /usr/share/mozilla/extensions whitelist /usr/share/webext From chromium-common.profile fixes the problem. @jose1711 Nice to see you've found a fix. Those two lines moved from chromium.profile to chromium-common.profile in https://github.com/netblue30/firejail/commit/0319fbdc4beb95255efe672daf5bcd4f4d6e9445. Not sure why, but @reinerh probably had good reasons to do so. Let's see if we can come up with a better compromise somehow.

gitea-mirror commented

2026-05-05 09:29:49 -06:00

Author

Owner

@reinerh commented on GitHub (Mar 4, 2022):

See discussion in the PR #4828.
(other chromium-based browser also support webwext extensions)

@reinerh commented on GitHub (Mar 4, 2022): See discussion in the PR #4828. (other chromium-based browser also support webwext extensions)

gitea-mirror commented

2026-05-05 09:29:49 -06:00

Author

Owner

@ghost commented on GitHub (Mar 4, 2022):

@reinerh Ah, now I remember, thanks for the link to the discussion. Just a thought, would adding:

ignore whitelist /usr/share/mozilla/extensions
ignore whitelist /usr/share/webext

to our google-chrome-* profiles interfer with Debian bug https://bugs.debian.org/1003234? If not it might be the best of both worlds :-)

@ghost commented on GitHub (Mar 4, 2022): @reinerh Ah, now I remember, thanks for the link to the discussion. Just a thought, would adding: ``` ignore whitelist /usr/share/mozilla/extensions ignore whitelist /usr/share/webext ``` to our google-chrome-* profiles interfer with Debian bug https://bugs.debian.org/1003234? If not it might be the best of both worlds :-)

gitea-mirror commented

2026-05-05 09:29:50 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 4, 2022):

Still in my todo: https://github.com/netblue30/firejail/issues/4929#issuecomment-1036032104 (opera should be fine with #4999).
If someone else is faster, go for it.

@rusty-snake commented on GitHub (Mar 4, 2022): Still in my todo: https://github.com/netblue30/firejail/issues/4929#issuecomment-1036032104 (opera should be fine with #4999). If someone else is faster, go for it.

Rows
Columns

[GH-ISSUE #4965] The latest stable chrome (98.0.4758.102) does not start with firejail. #2840

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Environment

Checklist

Log