mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #5127] spectacle: cannot take screenshots (KDE Wayland) #2889
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2889
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @wushangwei on GitHub (May 2, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5127
Description
Spectacle not working under KDE Wayland. It opens, but complains "Could not take a screenshot". However it works under x11 session.
Steps to Reproduce
Click the spectacle desktop shortcut and doesn't work.
kioclient exec /home/nikki/.local/share/applications/org.kde.spectacle.desktop, doesn't work.
Logs are shown in Log section.
To reduce the dbus errors above, I created ~/.config/firejail/spectacle.local with the following content:
Run the command above again, DBus errors are gone, but left with Screenshot request failed: "The process is not authorized to take a screenshot". Still doesn't work.
Expected behavior
Spectacle should take screenshots normally under KDE Wayland.
Actual behavior
Cannot take screenshots under KDE Wayland. Does not affect X11 session. Console outputs are provided above.
If I modify the desktop file, replace "spectacle" with "/usr/bin/spectacle", it will take screenshot normally.
Behavior without a profile
LC_ALL=C firejail --noprofile kioclient exec /home/nikki/.local/share/applications/org.kde.spectacle.desktop
Logs are shown in Log Section. Console output is similar with the one after modifying spectacle.local. Doesn't work either.
Additional context
If simply edit the spectacle desktop file and change the Exec from "spectacle" to "/usr/bin/spectacle", it will work normally.
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
kioclient exec /home/nikki/.local/share/applications/org.kde.spectacle.desktopOutput of
kioclient exec /home/nikki/.local/share/applications/org.kde.spectacle.desktopafter modifying spectacle.localOutput of
LC_ALL=C firejail --noprofile kioclient exec /home/nikki/.local/share/applications/org.kde.spectacle.desktopOutput of
LC_ALL=C firejail --noprofile kioclient exec /usr/share/applications/org.kde.spectacle.desktop@rusty-snake commented on GitHub (May 3, 2022):
Can you create an empty
spectacle.profilein~/.config/firejailand kill all running spectacle processes and try again.@rusty-snake commented on GitHub (Jun 8, 2022):
I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
@kiasoc5 commented on GitHub (Jun 10, 2022):
Is this related to https://bugs.kde.org/show_bug.cgi?id=446628 ?
@rusty-snake commented on GitHub (Jun 10, 2022):
Could be.
@kiasoc5 commented on GitHub (Jun 11, 2022):
I think it is related because if I run
firecfg cleanand delete~/.local/share/applications/org.kde.spectacle.desktop, thenspectacleworks butfirejail spectacledoes not.@rusty-snake commented on GitHub (Jan 15, 2023):
From #5245: spectacle does not even work with
@rusty-snake commented on GitHub (Jan 15, 2023):
Somebody needs to investigate how the Wayland implementations works and what is breaking it.
@rusty-snake commented on GitHub (Jan 15, 2023):
Maybe (I'm guessing around) it works with
join-or-start spectacle(maybe in combination withinclude noprofile.profileand nothing else). Or when the dbus activation is firejailed as well using firecfg.py.@vendion commented on GitHub (Jan 15, 2023):
The following debug information has been generated from the following environment:
Distro: Arch Linux
Firejail version: firejail version 0.9.72 (installed from firejail-git 0.9.72rc1.r8990.c93ac4186-1 in the AUR)
KDE Plasma: 5.26.5
noprofile.profileset via $HOME/.config/firejail/spectacle.profileOutput of
LC_ALL=C firejail --debug /usr/bin/spectacle@rusty-snake commented on GitHub (Jan 15, 2023):
https://github.com/flameshot-org/flameshot/issues/1380#issue-812908678:
That's what I'm feared.
May relates to #5035. I'm not sure which pid it exactly looks at and which file it uses and if this then works or not.Update: Relates to #5035 because it looks at
/proc/<pid>/exeand then the pid doesn't matter.And this symlink needs to return the same path as used by
Exec=in the desktop file.https://github.com/KDE/kwin/blob/master/src/wayland/utils/executable_path_proc.cpp
https://github.com/KDE/kservice/blob/master/src/services/kapplicationtrader.cpp
Seem to be the relevant files
If we can foul KApplicationTrader it would be the simplest workaround.
This becomes really difficult to implement. If possible at all.
@jaredmo commented on GitHub (May 12, 2023):
I'm having the same issue. In the interim I commented Spectacle out of
/etc/firejail/firecfg.configand deleted the .desktop file in.local/share/applications.This works until the next time
firecfgruns (which for me is every update). The desktop file is regenerated. How can that be prevented?@kmk3 commented on GitHub (May 12, 2023):
Removing it from firecfg.config should have been enough; see also:
As a workaround, manually create an override in ~/bin and/or
~/.local/share/applications that calls
/usr/bin/spectacleinstead of justspectacle.@jaredmo commented on GitHub (May 12, 2023):
5245 is exactly what I experienced. For now I replaced the file in
.local/share/applicationswith the original as a stopgap. That way firecfg thinks the file already exists and doesn't attempt to recreate.@secretmango commented on GitHub (Sep 4, 2023):
I can confirm this is still happening, Fedora 38, KDE 5.27.3
@alexpyattaev commented on GitHub (Sep 12, 2023):
Update: you need to remove two offending rules to get it to work on Wayland:
With these changes it appears to work fine on firejail version 0.9.72 on Arch.
@ghost commented on GitHub (Sep 13, 2023):
@alexpyattaev Nice find. Can you open a PR and fix our spectacle.profile?
@alexpyattaev commented on GitHub (Sep 13, 2023):
I am not sure if my "fix" is a good one. In particular, I am unsure if a
narrower profile would work, or even what exactly noroot command does:)
Should I make a PR?
ke 13. syysk. 2023 klo 4.34 glitsj16 @.***> kirjoitti:
@ghost commented on GitHub (Sep 13, 2023):
That's understandable, although your reasoning looks sound to me. Let's wait for the OP and others to chime in before acting on this.
@alexpyattaev commented on GitHub (Sep 13, 2023):
Well that is what makes it scary - it is just good enough to pass the "sanity check" while being made entirely of guesswork and assumptions. Kinda like GPT4 programming.
@rusty-snake commented on GitHub (Sep 13, 2023):
noroot was already known since https://github.com/netblue30/firejail/issues/5127#issuecomment-1383179762
@ghost commented on GitHub (Sep 13, 2023):
UPDATE: more testing carried out on my OpenSUSE Tumbleweed with KDE Wayland
ignore norootandignore private-devare neededorg.kde.KWin.Screenshot2besides the already presentorg.kde.{S,s}pectacleand several otherorg.kde.KWin.*addressesscreenrecording(in webm or mp4 format) too (so we better open up ${VIDEOS} and dropno3d)I'll need some more time putting together a profile that can deliver all this functionality in a reasonably secure way.
@alexpyattaev commented on GitHub (Sep 14, 2023):
There is additional aspect to this. Apparently, the ~/.local/share/applications/org.kde.spectacle.desktop that firecfg makes somehow manages to make dbus forget that the application has X-KDE-Wayland-Interfaces=zkde_screencast_unstable_v1 permission, which in turn makes Pipewire daemon deny access to the screen recording.
Removing the .desktop file fixes the issue (as the system builtin file is used instead), but firejail remakes the user's local file making spectacle to fail starting. I am unsure what the problem is, as the line in .desktop that enables access to pipewire is still in place.
@secretmango commented on GitHub (Sep 14, 2023):
something that may be interesting: not only spectacle broke, but also Firefox screenshots and Ctrl+P Website printing and Flameshot Flatpak. Is this related? Would all these need seperate profiles?
@ghost commented on GitHub (Sep 15, 2023):
@alexpyattaev I did notice the 'weirdness' of the spectacle desktop file(s) too. Not exactly sure what
firecfgdoes to it (personally never used it), but AFAICT its coded with the assumption that replacingDBusActivatable=truewithDBusActivatable=falseavoids D-Bus activation. But there's no such entree in the spectacle desktop file AFAICT. Maybe using firecfg.py from @rusty-snake might help here, don't know.Anyway, here are my latest findings. Note that I've always opted to start the app with its
-lflag (Launch Spectacle without taking a screenshot) from CLI to keep output sane while experimentingPutting together a reliably working
dbus-user filtercombo (for both screenshot and screenrecording) drove me nuts. Too many variables, too many complications... IMO we should better drop it alltogether from spectacle's profile. Obviously this is open for debate and just my opinion, no more, no less.ignore norootignore private-devIf anyone wants to test/confirm/deny, here's my proposed spectacle.profile:
$ cat ~/.config/firejail/spectacle.profile
HTH
@ghost commented on GitHub (Sep 15, 2023):
@firefoxlover Hard to tell whether those are related. Are you seeing all that on KDE Wayland? Or how should we understand your comment in this issues context? Please try to describe exactly what broke where. One thing is clear though, Flatpak and Firejail don't mix:
eb5c97197b/src/man/firejail.1.in (L82-L84)@alexpyattaev commented on GitHub (Sep 15, 2023):
Firefox and chrome work just fine for me. In Firejail both of them. So I do not think it is 100% related.
@rusty-snake commented on GitHub (Sep 15, 2023):
Firefox Screenshots: Not blocked by firejail, check your Firefox profile.
Ctrl+P: Unrelated => new issue
@secretmango commented on GitHub (Sep 21, 2023):
This is not my experience though. After removing the .desktop entry generated by firejail it suddenly worked again. I didnt change anything on the profile. Ctrl+P always crashed, and screenshots had really weird issues, getting the wrong areas etc.
I expected a wayland bug but on the same system, different user profile the bugs where completely gone.
After removing the firejail .desktop files, everything was working again.
@IPlayZed commented on GitHub (Dec 19, 2023):
Removing the local desktop file solves the issue, but that is just a workaround, doesn't solve the actual problem.
This also happens to me when launching
spectaclefrom the terminal. My terminal is a Flatpak installation.Full log:
at this point the GUI error message pops up, after hitting OK on it, the log continues:
Spectacle's window opens, but no screenshot is taken.
I set up Pacman to auto generate these entries.
@secretmango commented on GitHub (Dec 19, 2023):
thanks for keeping track of this! I am more interested in bubblejail, but that one has even less tooling, so unless some big org decides to support it, it will take some time to get usable
@Real-Gecko commented on GitHub (May 15, 2024):
For me spectacle does not work on with X server too, only removing symlink from
/usr/local/binand.desktopfile from$HOME/.local/share/applicationsunlocks it to full. No advice from this issue worked.Arch, Spectacle
24.02.2, plasma-desktop6.0.4, xorg-server21.1.13@gcb commented on GitHub (Jul 19, 2024):
given that most distros ship with wayland nowadays, should firejail ship with something like:
in
firecfg.conf? and this becomes an enhacement to add the profile?@IPlayZed commented on GitHub (Jul 23, 2024):
@kmk3
If you disable it X users will not benefit from it.
@kmk3 commented on GitHub (Jul 23, 2024):
The comment you just quoted said that firejailed spectacle does not work on X
either.
But even if it did, profiles should work by default on common setups (xorg and
wayland) and apparently spectacle does not work at all even with
noprofile.profile on plasma/wayland.
The effect is worse for programs that are usually not started from the CLI, as
the user will not see stderr, so it's harder to tell that the issue is caused
by firejail.
Lastly, in firejail-git you can include more programs in firecfg by adding them
to /etc/firejail/firecfg.d/:
@IPlayZed commented on GitHub (Jul 28, 2024):
Ok, so what is left to complete so we can mark this issue as completed? And as far as I understand (I tried reading the thread), the problem seems to be coming from Spectacle behaving weirdly?
@gcb commented on GitHub (Aug 8, 2024):
Do we want to do the same for things like
obsand maybe others which main functionality depends on screen capture somehow?@Utini2000 commented on GitHub (Oct 11, 2024):
Ye so after reading this and trying all kind of workarounds, the only solution was to exclude spectacle (and obs) from firecfg.
@gcb commented on GitHub (Oct 30, 2024):
this have bite me again and again :) I remove it from the config list, but then the .desktop file remains and for some reason without the permission lines it needs. And i cannot take screenshots until i remember i have to delete my desktop file in ~/.local something.
maybe someone who knows better the code can comment if the "fix" for this is to add a "delete all user desktop files created by firejail" before reaching the copy step https://github.com/netblue30/firejail/blob/master/src/firecfg/desktop_files.c#L189 ?
@kmk3 commented on GitHub (Oct 30, 2024):
firecfg --cleanshould remove it.See also:
Does it work with firejail-git?
If not, please open a new issue and follow the bug report template:
@gcb commented on GitHub (Oct 31, 2024):
My point was that
firecfg --fixshould do a--cleanbeforehand. Kinda like the root user firecfg flow does with the rules.@VLOD-ZDOV commented on GitHub (Feb 6, 2025):
this SOMETIMES happens when I take a screenshot of an area.
@gcb commented on GitHub (May 7, 2025):
Hi everyone.
This still creates the spectacle desktop files for users. Despite spectacle being commented upstream since forever.
It's the worse of both cases: no sand-boxing, no screenshots.
@pedroadame commented on GitHub (May 19, 2025):
Probably not related, but I also get these errors (libva error, QWaylandGLContext::makeCurrent: eglError 0x3003, etc) when trying to invoke spectacle by shortcut to capture a region when playing Riven Remake (I haven't figured out why, no other related errors appear when playing), and then Wayland freezes (can't render new windows nor resize or move existing ones) until I close the game. I'm currently looking for an answer.
@nayrosk commented on GitHub (Feb 10, 2026):
I found a temporary solution to automatically disable the creation of the .desktop file by firejail when install / upgrade / remove a package. I should point out that this works with pacman, but should be adaptable for others. When installing Firejail, you probably created a pacman hook to configure the symlinks for each install/upgrade/remove.
In accordance with this installation guide, I set up this hook:
Steps
Update
firecfg.configEnsure that
spectacleis disabled in the firejail configuration. If it is not, comment it out:Add a Pacman hook that will be executed after the firejail hook
According to the manual:
All you need to do is create a new hook that deletes the file recreated by Firejail. IMPORTANT: this hook must be higher in alphabetical order than Firejail's (you can use the notation “00-xxx.hook”):
Replace [YOUR_USER_FOLDER] by your real user folder (without brackets).
Now when you modify your packages, the
.desktopfile will be automatically deleted:Of course, if you run the
firecfgcommand manually, you will still need to delete the file.