mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4982] geary: fails to fully start and burns CPU #2842
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2842
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @spantaleev on GitHub (Feb 25, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4982
Description
geary (
1:40.0-6on Archlinux) starts, but the UI is frozen.Steps to Reproduce
I'm using the default geary profile. The one deployed by the Archlinux
firejailpackage seems to be up to date with currentmaster.Steps to reproduce the behavior
LC_ALL=C firejail gearyGeary's dialog window still remains running after that, but nothing is clickable.
See the log below for some errors.
Behavior without a profile
What changed calling
LC_ALL=C firejail --noprofile /usr/bin/gearyin a terminal?Geary starts up normally.
Additional context
Any other detail that may help to understand/debug the problem
Environment
firejail --version): 0.9.68Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/program@ghost commented on GitHub (Feb 26, 2022):
This is due to
dbus-user filterand not allowing the app to talk to 'org.a11y.Bus' (I think). None of our profiles allow D-Bus accessibility features. Don't recall any explicit discussion on this option, but can always be added in geary.local if needed. [UNRELATED]Might be due to the very restrictive
private-bin(which only allows the geary executable). [RELATED]I'm not familiar with Geary's certificate-management. But here
private-binmight also be blocking something. [RELATED]Add
private-etc group,login.defs,passwdin geary.local should fix this. [PROFILE BUG]Due to
machine-id/nosoundin the profile, so to be expected. Again, if you need/want Geary to provide audible notifications, you can override these in geary.local. [UNRELATED]To sum up, these are some things you can try to see if they help fixing your Geary by creating
~/.config/firejail/geary.localwith the below content:@spantaleev commented on GitHub (Feb 27, 2022):
Wow, thank you for that very detailed analysis and proposed profile changes!
I've tried with your proposed
geary.localand the output is like this now:Output of
LC_ALL=C firejail /path/to/programThe UI is still frozen and Geary still burns CPU just the same.
@rusty-snake commented on GitHub (Feb 27, 2022):
@ghost commented on GitHub (Feb 28, 2022):
Hmm, that message indicates firejail is trying to sandbox geary twice. If you used
firecfgto generate symlinks in /usr/local/bin (or your package manager did in a post-install hook) the correct call to start a firejailed geary process from a script or from the command line is$ geary <-- because /usr/local/bin preceeds /usr/bin in PATH and /usr/local/bin/geary is a symlink to /usr/bin/firejail
OR
$ /usr/local/bin/geary <-- calling the symlink directly with full path
OR
$ firejail /usr/bin/geary <-- calling firejail with the full path to the geary executable
Which one did you use?
@spantaleev commented on GitHub (Feb 28, 2022):
Oh, silly me! You're right, I've been using
LC_ALL=C firejail gearylately (for making these reports) and I do have symlinks installed.Nevertheless,
~/.config/firejail/geary.localis like this now:and
Output of
LC_ALL=C firejail /usr/bin/geary@ghost commented on GitHub (Feb 28, 2022):
Let me provide some context. I personally don't like the newer Geary UI and use a custom Arch Linux PKGBUILD to install geary 3.34.2. Obviously that doesn't help when trying to debug the reported issues here. So I temporarily moved aside my custom stuff and installed the current geary repo package.
After some testing I created a new geary.profile, which works fine for me here. If you'd like to try that, download the linked gist, place it in
~/.config/firejail/geary.profile(so it overrides /etc/firejail/geary.profile) and (temporarily) remove the ~/.config/firejail/geary.local to avoid confusion. As you can see I integrated above suggestions in the refactored one.I didn't have to use the
seccomp !personalityoption mentioned above and can use the fullseccompoption. We can worry later on what the current geary.profile needs to fix this. Let's try to get it going first on your setup.@spantaleev commented on GitHub (Feb 28, 2022):
With your
geary.profileand with mygeary.localdisabled, Geary is working as per normal now.Output of
LC_ALL=C firejail /usr/bin/gearyThanks for taking the time to figure it all out!
@ghost commented on GitHub (Feb 28, 2022):
Great! Thanks for confirming, very much appreciated. I'll make the necessary changes to our geary.profile later today. Before doing so I want to test if the
seccomp !personalityis indeed needed in case users try to enable audio support. Left that out for now to start with basic functionality but it would be a nice comment.Very welcome. Thanks to your issue report we're now aware of this and will do the work. Just remember to remove your ~/.config/firejail/geary.profiles when Arch Linux pushes a future firejail upgrade to its repo's.
@ghost commented on GitHub (Mar 1, 2022):
@spantaleev The PR is in. Added some minor changes, but sound notifications (Preferences > Plugins) are working, without
seccomp !personality. Just a FYI.@spantaleev commented on GitHub (Mar 1, 2022):
Great work, @glitsj16! I can confirm that everything (including sound) works with the new profile from #4992 without any custom changes (like
seccomp !personality, etc.).@mizzunet commented on GitHub (May 5, 2022):
Yes, geary works fine.
Well, I have this output though