[GH-ISSUE #5014] Newest Steam client has black window under firejail (fix included) #2859

New issue

Closed

opened 2026-05-05 09:30:59 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:30:59 -06:00

Owner

Originally created by @TheOneric on GitHub (Mar 5, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5014

Description

After yesterdays (2022.03.04) Steam client update, all content tabs in the Steam client are just black.
Running steam outside of firejail or with --ignore-seccomp fixes it. See below for details on the syscalls.

Steps to Reproduce

Install newest Steam client update.
(Re)start Steam.
See only a black area where content should be.

Fix

Following the recommend seccomp debug procedure in a Fedora VM, the offending syscall was made from a steamwebhelper process and is arch=c000003e syscall=161, i.e. chroot. This was tested on top of my changes to make Proton 5.13+ work, as described here: https://github.com/netblue30/firejail/issues/4366#issuecomment-1053756405.
Similar to those changes, adding seccomp !chroot to /etc/firejail/steam.local did nothing, only altering the seccomp line in /etc/firejail/steam.profile was successful in unblocking the syscall. Together with the changes for Proton, the diff is:

  # seccomp sometimes causes issues (see #2951, #3267).
  # Add 'ignore seccomp' to your steam.local if you experience this
- seccomp !ptrace
+ seccomp !ptrace,!mount,!name_to_handle_at,!pivot_root,!umount2,!chroot
  # tracelog breaks integrated browser
  #tracelog

Environment

OpenSUSE Tumbleweed
Firejail version: 0.9.68

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).

Originally created by @TheOneric on GitHub (Mar 5, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5014 ### Description After yesterdays (2022.03.04) Steam client update, all content tabs in the Steam client are just black. Running steam outside of firejail or with `--ignore-seccomp` fixes it. See below for details on the syscalls. ### Steps to Reproduce 1. Install newest Steam client update. 2. (Re)start Steam. 3. See only a black area where content should be. ### Fix Following the recommend seccomp debug procedure in a Fedora VM, the offending syscall was made from a `steamwebhelper` process and is `arch=c000003e syscall=161`, i.e. `chroot`. This was tested on top of my changes to make Proton 5.13+ work, as described here: https://github.com/netblue30/firejail/issues/4366#issuecomment-1053756405. Similar to those changes, adding `seccomp !chroot` to `/etc/firejail/steam.local` did nothing, only altering the seccomp line in `/etc/firejail/steam.profile` was successful in unblocking the syscall. Together with the changes for Proton, the diff is: ```diff # seccomp sometimes causes issues (see #2951, #3267). # Add 'ignore seccomp' to your steam.local if you experience this - seccomp !ptrace + seccomp !ptrace,!mount,!name_to_handle_at,!pivot_root,!umount2,!chroot # tracelog breaks integrated browser #tracelog ``` ### Environment - OpenSUSE Tumbleweed - Firejail version: `0.9.68` ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate).

gitea-mirror closed this issue

2026-05-05 09:31:00 -06:00

gitea-mirror commented

2026-05-05 09:31:02 -06:00

Author

Owner

@ghost commented on GitHub (Mar 5, 2022):

Very nice debug work. Thanks for doing the work (also for #4366).

Similar to those changes, adding seccomp !chroot to /etc/firejail/steam.local did nothing, only altering the seccomp line in /etc/firejail/steam.profile was successful in unblocking the syscall.

That's because seccomp doesn't seem to accumulate (any longer) like for example private-bin and private-etc do. It takes a completely new seccomp line that has all the needed exceptions to work from a foo.local file, followed by ignore seccomp to stop the one from the foo.profile to override it. Have a look in /etc/firejail/palemoon.profile for an example.

Can you open a PR for this and #4366?

@ghost commented on GitHub (Mar 5, 2022): Very nice debug work. Thanks for doing the work (also for #4366). > Similar to those changes, adding seccomp !chroot to /etc/firejail/steam.local did nothing, only altering the seccomp line in /etc/firejail/steam.profile was successful in unblocking the syscall. That's because seccomp doesn't seem to accumulate (any longer) like for example private-bin and private-etc do. It takes a completely new seccomp line that has all the needed exceptions to work from a foo.local file, followed by `ignore seccomp` to stop the one from the foo.profile to override it. Have a look in /etc/firejail/palemoon.profile for an example. Can you open a PR for this and #4366?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2859

No description provided.

Rows
Columns