[GH-ISSUE #5265] jetbrains-toolbox: "Invalid client serial" when using dbus-user=filter

gitea-mirror commented

2026-05-05 09:35:56 -06:00

Owner

Originally created by @mid-kid on GitHub (Jul 20, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5265

Description

Jetbrains Toolbox takes an insane amount of time to load up and display its tray icon when using --dbus-user=filter. Unlike a normal run, it displays the following message:

** (process:10596): WARNING **: 21:28:17.026: Invalid client serial

This message originates from xdg-dbus-proxy, in flatpak-proxy.c.

Steps to Reproduce

Download the toolbox app https://www.jetbrains.com/toolbox-app/
Run firejail --noprofile --dbus-user=proxy --appimage ./jetbrains-toolbox

Expected behavior

The app runs and displays a GtkStatusIcon as a fallback for having no access to a StatusNotifierItem tray.

Actual behavior

It took a solid 5 minutes to start up and do this.

Behavior without a profile

N/A

Additional context

I don't have a StatusNotifierItem implementation like snixembed, yet running outside of firejail makes it work. I want it to run with either --dbus-user=none or --dbus-user=proxy, either is fine.

Environment

Gentoo amd64
i3 window manager with polybar

firejail version 0.9.70

Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is disabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is disabled
	- IDS support is disabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail --noprofile --dbus-user=proxy --appimage ./jetbrains-toolbox

Parent pid 10594, child pid 10598

** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl **

Mounting appimage type 2
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Child process initialized in 50.05 ms

** (process:10596): WARNING **: 21:28:17.026: Invalid client serial

Originally created by @mid-kid on GitHub (Jul 20, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5265 ### Description Jetbrains Toolbox takes an insane amount of time to load up and display its tray icon when using `--dbus-user=filter`. Unlike a normal run, it displays the following message: ``` ** (process:10596): WARNING **: 21:28:17.026: Invalid client serial ``` This message originates from xdg-dbus-proxy, in flatpak-proxy.c. ### Steps to Reproduce 1. Download the toolbox app https://www.jetbrains.com/toolbox-app/ 2. Run `firejail --noprofile --dbus-user=proxy --appimage ./jetbrains-toolbox` ### Expected behavior The app runs and displays a GtkStatusIcon as a fallback for having no access to a StatusNotifierItem tray. ### Actual behavior It took a solid 5 minutes to start up and do this. ### Behavior without a profile N/A ### Additional context I don't have a StatusNotifierItem implementation like snixembed, yet running outside of firejail makes it work. I want it to run with either --dbus-user=none or --dbus-user=proxy, either is fine. ### Environment - Gentoo amd64 - i3 window manager with polybar ``` firejail version 0.9.70 Compile time support: - always force nonewprivs support is disabled - AppArmor support is disabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file transfer support is enabled - firetunnel support is disabled - IDS support is disabled - networking support is enabled - output logging is enabled - overlayfs support is disabled - private-home support is enabled - private-cache and tmpfs as user enabled - SELinux support is disabled - user namespace support is enabled - X11 sandboxing support is enabled ``` ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail --noprofile --dbus-user=proxy --appimage ./jetbrains-toolbox</code></summary> <p> ``` Parent pid 10594, child pid 10598 ** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl ** Mounting appimage type 2 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Child process initialized in 50.05 ms ** (process:10596): WARNING **: 21:28:17.026: Invalid client serial ``` </p> </details>

gitea-mirror

2026-05-05 09:35:56 -06:00

closed this issue
added the
notourbug
label

gitea-mirror commented

2026-05-05 09:35:59 -06:00

Author

Owner

@mid-kid commented on GitHub (Jul 20, 2022):

Reproduced this on a clean debian bullseye install as well.

@mid-kid commented on GitHub (Jul 20, 2022): Reproduced this on a clean debian bullseye install as well.

gitea-mirror commented

2026-05-05 09:36:00 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 20, 2022):

--dbus-user=proxy is not supported. It's filter.

The fallback code a program uses if an dbus name does not exists is outside of the scope of firejail, consider reporting this to jetbrains then.

If you believe this happens because of an implementation deatil of xdg-dbus-proxy, report it there.

TL;DR: Is this a firejail issue?

@rusty-snake commented on GitHub (Jul 20, 2022): `--dbus-user=proxy` is not supported. It's `filter`. --- The fallback code a program uses if an dbus name does not exists is outside of the scope of firejail, consider reporting this to jetbrains then. If you believe this happens because of an implementation deatil of xdg-dbus-proxy, report it there. TL;DR: Is this a firejail issue?

gitea-mirror commented

2026-05-05 09:36:01 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 20, 2022):

GtkStatusIcon

IIRC jetbrains programs do not use GTK.

@rusty-snake commented on GitHub (Jul 20, 2022): > GtkStatusIcon IIRC jetbrains programs do not use GTK.

gitea-mirror commented

2026-05-05 09:36:02 -06:00

Author

Owner

@mid-kid commented on GitHub (Jul 20, 2022):

I meant --dbus-user=filter, of course. The --dbus-user=proxy option terminates firejail inmediately.

Anyway, this program uses libappindicator. That's what uses GtkStatusIcon as a fallback.

This problem doesn't happen without firejail, as the fallback works properly in that case, though it's very possible that it's a xdg-dbus-proxy thing.

@mid-kid commented on GitHub (Jul 20, 2022): I meant --dbus-user=filter, of course. The --dbus-user=proxy option terminates firejail inmediately. Anyway, this program uses libappindicator. That's what uses GtkStatusIcon as a fallback. This problem doesn't happen without firejail, as the fallback works properly in that case, though it's very possible that it's a xdg-dbus-proxy thing.

gitea-mirror commented

2026-05-05 09:36:03 -06:00

Author

Owner

@mid-kid commented on GitHub (Jul 20, 2022):

Yeah, I managed to reproduce it with the following setup:

xdg-dbus-proxy "$DBUS_SESSION_BUS_ADDRESS" dbus --log --filter &
DBUS_SESSION_BUS_ADDRESS="unix:path=$PWD/dbus" ~/.local/share/JetBrains/Toolbox/bin/jetbrains-toolbox

@mid-kid commented on GitHub (Jul 20, 2022): Yeah, I managed to reproduce it with the following setup: ``` xdg-dbus-proxy "$DBUS_SESSION_BUS_ADDRESS" dbus --log --filter & DBUS_SESSION_BUS_ADDRESS="unix:path=$PWD/dbus" ~/.local/share/JetBrains/Toolbox/bin/jetbrains-toolbox ```

gitea-mirror commented

2026-05-05 09:36:03 -06:00

Author

Owner

@mid-kid commented on GitHub (Jul 21, 2022):

Opened a bug report in xdg-dbus-proxy: https://github.com/flatpak/xdg-dbus-proxy/issues/45

@mid-kid commented on GitHub (Jul 21, 2022): Opened a bug report in xdg-dbus-proxy: https://github.com/flatpak/xdg-dbus-proxy/issues/45

gitea-mirror commented

2026-05-05 09:36:04 -06:00

Author

Owner

@mid-kid commented on GitHub (Jul 22, 2022):

The library causing the hang turned out to be dbus-java, not libappindicator. The issue is further discussed here, with a potential workaround that might appear in future releases: https://github.com/hypfvieh/dbus-java/issues/177

For now, a different workaround to get the application to not hang yet still display a GtkStatusIcon-powered tray icon would be to run with dbus-user none, and writing the following in ~/.config/JetBrains/Toolbox/toolboxrc to start a dummy non-proxying D-Bus server in the sandbox:

eval $(dbus-launch)
export DBUS_SESSION_BUS_ADDRESS
./$app "$@"
kill $DBUS_SESSION_BUS_PID
exit

@mid-kid commented on GitHub (Jul 22, 2022): The library causing the hang turned out to be dbus-java, not libappindicator. The issue is further discussed here, with a potential workaround that might appear in future releases: https://github.com/hypfvieh/dbus-java/issues/177 For now, a different workaround to get the application to not hang yet still display a GtkStatusIcon-powered tray icon would be to run with `dbus-user none`, and writing the following in `~/.config/JetBrains/Toolbox/toolboxrc` to start a dummy non-proxying D-Bus server in the sandbox: ``` eval $(dbus-launch) export DBUS_SESSION_BUS_ADDRESS ./$app "$@" kill $DBUS_SESSION_BUS_PID exit ```

gitea-mirror commented

2026-05-05 09:36:05 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 22, 2022):

@mid-kid Thanks for the details.

(Re-closing as "not planned" since the bug is not in firejail)

@kmk3 commented on GitHub (Jul 22, 2022): @mid-kid Thanks for the details. (Re-closing as "not planned" since the bug is not in firejail)

Rows
Columns

[GH-ISSUE #5265] jetbrains-toolbox: "Invalid client serial" when using dbus-user=filter #2936

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Additional context

Environment

Checklist

Log