[GH-ISSUE #5067] 0ad: unable to install mods in-game

gitea-mirror commented

2026-05-05 09:31:36 -06:00

Owner

Originally created by @CaseOf on GitHub (Mar 23, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5067

Description

In-game when trying to install a mod, I get an error from the game, and the mod is not installed.

Steps to Reproduce

Steps to reproduce the behavior

Run in bash LC_ALL=C firejail 0ad (LC_ALL=C to get a consistent output in English that can be understood by everybody)
Click on 'Settings' in the left navigation panel
Click on 'Mod Selection'
Click on 'Download Mods' at the bottom right corner
Click on 'Accept' on in-game dialog window
Click on 'Refresh List' at the bottom right corner of in-game window
Click on 'delenda-est' on the list
Click on 'Download' at the bottom right corner of in-game window
Wait for download to complete
See error error: Failed to rename '/home/<username>/.local/share/0ad/mods/delenda-est/delenda-est.zip.temp' into '/home/<username>/.cache/0ad/_modscache/delenda-est.zip/delenda-est.zip.zip' Failed to install '/home/<username>/.local/share/0ad/mods/delenda-est/delenda-est.zip.temp' at the top left corner in-game.

Expected behavior

Mods should be installed in-game. They are installed in $HOME/.local/share/0ad/mods.
The game should allow you to enable them.

Actual behavior

Mods can’t be installed and error is shown systematically when 0ad is started via firejail.
It fails for all mods.

Behavior without a profile

Without a profile, mods can be installed and enabled.

Additional context

Discussion with Stanislas Dolcini, a 0ad developer on official IRC channel (on QuakeNet, channel #0ad):

22:34 -- Le titre pour #0ad est "0AD public channel | https://play0ad.com/  | Issue tracker: https://trac.wildfiregames.com/ | Publicly logged: http://irclogs.wildfiregames.com/ | FAQ https://trac.wildfiregames.com/wiki/FAQ"
22:34 -- Titre défini par Stan` le lun., 10 mai 2021 09:06:36
22:34 -- Canal #0ad : 26 pseudos (2 ops, 0 voice, 24 normaux)
22:34 -- Canal créé le mer., 05 août 2009 12:26:06
22:38 <Case_Of> hi, I have issues installing Delenda Est, I am using firejail to start 0ad, here is a screenshot of the error message: https://0x0.st/oZ6r.png
22:44 <Langbart> maybe Stan knows, but he is always busy. did u try it within the ingame mod downloader?
23:06 <Case_Of> yeah I know Stan is always busy
23:07 <Case_Of> Langbart: yes within the ingame mod downloader
23:07 <@Stan> Why is called .temp?
23:08 <Case_Of> i dont know
23:09 <@Stan> What version are you running and where did you download the mod from ?
23:10 <@Stan> Nvm the second question
23:10 <@Stan> I think download failed
23:10 <@Stan> Cause it's a big mod
23:11 <Case_Of> alpha 25
23:11 <Case_Of> Stan: I tried with smaller mods and it fails too
23:14 <@Stan> Case_Of: Mmh is it possible you have permission issues?
23:14 <@Stan> If it can't write there it will fail
23:17 <Case_Of> Stan: https://raw.githubusercontent.com/netblue30/firejail/master/etc/profile-a-l/0ad.profile
23:18 <Case_Of> it has access to .cache/0ad .config/0ad .local/share/0ad
23:23 <@Stan> Mmh then I don't know but 9/10 on linux with custom stuff like that it's a permission issue
23:25 <@Stan> I don't suppose there is way to see easily on linux where a process is trying to write
23:58 <Case_Of> Stan: firejail --debug 0ad https://0x0.st/oZ66.txt
00:00 <Case_Of> Stan: should I open an issue on firejail github repository?
00:00 <@Stan> Well you could see what they say about 
00:00 <@Stan> https://stackoverflow.com/questions/24209886/invalid-cross-device-link-error-with-boost-filesystem#24210631
00:01 <@Stan> They could blame us for not handling the edge case where you can't rename a file in a jail
00:01 <Case_Of> ah yes maybe
00:03 <Case_Of> but while these dirs are whitelisted, it shouldn’t affect the rename command
00:03 <Case_Of> .cache dir in this profile isn’t a tmpfs
00:05 <@Stan> You got 417 occurences of permission denied
00:05 <@Stan> Maybe something there too
00:07 <Case_Of> ah this is from firejail predefined directories of potential softwares to hide from sandbox
00:07 <Case_Of> so it’s not relevant in our case
00:08 <Case_Of> some are just not installed on my system
00:40 <@Stan> So yeah report to them see what they have to say and hit me back if it goes south
02:46 <Case_Of> will do that
02:46 <Case_Of> tomorrow probably
02:46 <Case_Of> thanks for your help

Environment

Linux distribution and version: Gentoo
Firejail version: 0.9.68
0ad version 0.0.25 (aka alpha 25)

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
[NOT APPLICABLE] I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
[NOT APPLICABLE] I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

Output of LC_ALL=C firejail --debug /path/to/program

GitHub is complaining that my message is too long:

Then I did post logs in a gist: https://gist.github.com/CaseOf/97d37f52b1f245b57579993ad697623b

Originally created by @CaseOf on GitHub (Mar 23, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5067  ### Description In-game when trying to install a mod, I get an error from the game, and the mod is not installed. ### Steps to Reproduce _Steps to reproduce the behavior_ 1. Run in bash `LC_ALL=C firejail 0ad` (`LC_ALL=C` to get a consistent output in English that can be understood by everybody) 2. Click on 'Settings' in the left navigation panel 3. Click on 'Mod Selection' 4. Click on 'Download Mods' at the bottom right corner 5. Click on 'Accept' on in-game dialog window 6. Click on 'Refresh List' at the bottom right corner of in-game window 7. Click on 'delenda-est' on the list 8. Click on 'Download' at the bottom right corner of in-game window 9. Wait for download to complete 10. See error `error: Failed to rename '/home/<username>/.local/share/0ad/mods/delenda-est/delenda-est.zip.temp' into '/home/<username>/.cache/0ad/_modscache/delenda-est.zip/delenda-est.zip.zip'` `Failed to install '/home/<username>/.local/share/0ad/mods/delenda-est/delenda-est.zip.temp'` at the top left corner in-game. ### Expected behavior Mods should be installed in-game. They are installed in $HOME/.local/share/0ad/mods. The game should allow you to enable them. ### Actual behavior Mods can’t be installed and error is shown systematically when 0ad is started via firejail. It fails for all mods. ### Behavior without a profile Without a profile, mods can be installed and enabled. ### Additional context Discussion with Stanislas Dolcini, a 0ad developer on official IRC channel (on QuakeNet, channel #0ad): ``` 22:34 -- Le titre pour #0ad est "0AD public channel | https://play0ad.com/ | Issue tracker: https://trac.wildfiregames.com/ | Publicly logged: http://irclogs.wildfiregames.com/ | FAQ https://trac.wildfiregames.com/wiki/FAQ" 22:34 -- Titre défini par Stan` le lun., 10 mai 2021 09:06:36 22:34 -- Canal #0ad : 26 pseudos (2 ops, 0 voice, 24 normaux) 22:34 -- Canal créé le mer., 05 août 2009 12:26:06 22:38 <Case_Of> hi, I have issues installing Delenda Est, I am using firejail to start 0ad, here is a screenshot of the error message: https://0x0.st/oZ6r.png 22:44 <Langbart> maybe Stan knows, but he is always busy. did u try it within the ingame mod downloader? 23:06 <Case_Of> yeah I know Stan is always busy 23:07 <Case_Of> Langbart: yes within the ingame mod downloader 23:07 <@Stan> Why is called .temp? 23:08 <Case_Of> i dont know 23:09 <@Stan> What version are you running and where did you download the mod from ? 23:10 <@Stan> Nvm the second question 23:10 <@Stan> I think download failed 23:10 <@Stan> Cause it's a big mod 23:11 <Case_Of> alpha 25 23:11 <Case_Of> Stan: I tried with smaller mods and it fails too 23:14 <@Stan> Case_Of: Mmh is it possible you have permission issues? 23:14 <@Stan> If it can't write there it will fail 23:17 <Case_Of> Stan: https://raw.githubusercontent.com/netblue30/firejail/master/etc/profile-a-l/0ad.profile 23:18 <Case_Of> it has access to .cache/0ad .config/0ad .local/share/0ad 23:23 <@Stan> Mmh then I don't know but 9/10 on linux with custom stuff like that it's a permission issue 23:25 <@Stan> I don't suppose there is way to see easily on linux where a process is trying to write 23:58 <Case_Of> Stan: firejail --debug 0ad https://0x0.st/oZ66.txt 00:00 <Case_Of> Stan: should I open an issue on firejail github repository? 00:00 <@Stan> Well you could see what they say about 00:00 <@Stan> https://stackoverflow.com/questions/24209886/invalid-cross-device-link-error-with-boost-filesystem#24210631 00:01 <@Stan> They could blame us for not handling the edge case where you can't rename a file in a jail 00:01 <Case_Of> ah yes maybe 00:03 <Case_Of> but while these dirs are whitelisted, it shouldn’t affect the rename command 00:03 <Case_Of> .cache dir in this profile isn’t a tmpfs 00:05 <@Stan> You got 417 occurences of permission denied 00:05 <@Stan> Maybe something there too 00:07 <Case_Of> ah this is from firejail predefined directories of potential softwares to hide from sandbox 00:07 <Case_Of> so it’s not relevant in our case 00:08 <Case_Of> some are just not installed on my system 00:40 <@Stan> So yeah report to them see what they have to say and hit me back if it goes south 02:46 <Case_Of> will do that 02:46 <Case_Of> tomorrow probably 02:46 <Case_Of> thanks for your help ``` ### Environment - Linux distribution and version: Gentoo - Firejail version: 0.9.68 - 0ad version 0.0.25 (aka alpha 25) ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] [NOT APPLICABLE] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] [NOT APPLICABLE] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> GitHub is complaining that my message is too long: ![GitHub error message](https://i.imgur.com/zJwQCje.png) Then I did post logs in a gist: https://gist.github.com/CaseOf/97d37f52b1f245b57579993ad697623b

gitea-mirror commented

2026-05-05 09:31:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 23, 2022):

.cache dir in this profile isn’t a tmpfs

It is, try ignore private-cache.

maximum is 65536 characters

32-bit integers are to new 😛

@rusty-snake commented on GitHub (Mar 23, 2022): > .cache dir in this profile isn’t a tmpfs It is, try `ignore private-cache`. > maximum is 65536 characters 32-bit integers are to new :stuck_out_tongue:

gitea-mirror commented

2026-05-05 09:31:40 -06:00

Author

Owner

@CaseOf commented on GitHub (Mar 23, 2022):

Tried with ignore private-cache and it is still failing.

@CaseOf commented on GitHub (Mar 23, 2022): Tried with `ignore private-cache` and it is still failing.

gitea-mirror commented

2026-05-05 09:31:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 24, 2022):

How did you tried? You must add ignore private-cache before private-cache in the include-chain.

@rusty-snake commented on GitHub (Mar 24, 2022): How did you tried? You must add `ignore private-cache` before `private-cache` in the include-chain.

gitea-mirror commented

2026-05-05 09:31:41 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 24, 2022):

Does it work if you comment whitelist ${HOME}/... and include whitelist-common.inc?

@rusty-snake commented on GitHub (Mar 24, 2022): Does it work if you comment `whitelist ${HOME}/...` and `include whitelist-common.inc`?

gitea-mirror commented

2026-05-05 09:31:42 -06:00

Author

Owner

@CaseOf commented on GitHub (Mar 24, 2022):

How did you tried? You must add ignore private-cache before private-cache in the include-chain.

I did add it in 0ad.local then it should be set at the beginning

@CaseOf commented on GitHub (Mar 24, 2022): > How did you tried? You must add `ignore private-cache` before `private-cache` in the include-chain. I did add it in 0ad.local then it should be set at the beginning

gitea-mirror commented

2026-05-05 09:31:43 -06:00

Author

Owner

@CaseOf commented on GitHub (Mar 24, 2022):

Does it work if you comment whitelist ${HOME}/... and include whitelist-common.inc?

whitelist-common is already part of the profile

@CaseOf commented on GitHub (Mar 24, 2022): > Does it work if you comment `whitelist ${HOME}/...` and `include whitelist-common.inc`? whitelist-common is already part of the profile

gitea-mirror commented

2026-05-05 09:31:43 -06:00

Author

Owner

@CaseOf commented on GitHub (Mar 24, 2022):

whitelisting ${HOME} does not help

@CaseOf commented on GitHub (Mar 24, 2022): whitelisting ${HOME} does not help

gitea-mirror commented

2026-05-05 09:31:44 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 24, 2022):

You should comment them.

@rusty-snake commented on GitHub (Mar 24, 2022): You should comment them.

gitea-mirror commented

2026-05-05 09:31:45 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 2, 2022):

@CaseOf ping

@rusty-snake commented on GitHub (Apr 2, 2022): @CaseOf ping

gitea-mirror commented

2026-05-05 09:31:46 -06:00

Author

Owner

@CaseOf commented on GitHub (Apr 2, 2022):

Sorry for my late answer.
Commenting whitelist ${HOME}/... and include whitelist-common.inc makes it work.
I did keep the ignore private-cache. Tried without this last one and of course it did not work.
All combined is required for mods being installed.

@CaseOf commented on GitHub (Apr 2, 2022): Sorry for my late answer. Commenting `whitelist ${HOME}/...` and `include whitelist-common.inc` makes it work. I did keep the `ignore private-cache`. Tried without this last one and of course it did not work. All combined is required for mods being installed.