github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5321] Double invocation breaks certain applications #2958

New issue

Open

opened 2026-05-05 09:37:12 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:37:12 -06:00

Owner

Originally created by @NetSysFire on GitHub (Aug 18, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5321

Description

When firecfg has been run, so /usr/local/bin/man is symlinked and therefore automagically firejailed, firejail man firejail does not work while just man firejail works.
However, this specifically only breaks man so far. firejail drill example.com for example works.

Steps to Reproduce

Make sure /usr/bin/man points to /usr/bin/firejail.
Run firejail man firejail (you may choose any other manpage of course)
Error getpwuid: main.c:245 init_cfg: No such file or directory

Expected behavior

I know this is a bit of an edge case, but other applications do work with that. E.g firejail drill example.com works.

Actual behavior

It does not work.

Active seccomp files:
cat /run/firejail/mnt/seccomp/seccomp.list
/run/firejail/mnt/seccomp/seccomp.protocol
/run/firejail/mnt/seccomp/seccomp.32
/run/firejail/mnt/seccomp/seccomp
/run/firejail/mnt/seccomp/seccomp.mdwx
/run/firejail/mnt/seccomp/seccomp.mdwx.32
Create the new ld.so.preload file
Blacklist violations are logged to syslog
Mount the new ld.so.preload file
Dropping all capabilities
nogroups command not ignored
noroot user namespace installed
Dropping all capabilities
NO_NEW_PRIVS set
Drop privileges: pid 1, uid 1000, gid 1000, force_nogroups 0
nogroups command not ignored
No supplementary groups
AppArmor enabled
Closing non-standard file descriptors
Starting application
LD_PRELOAD=(null)
execvp argument 0: man
execvp argument 1: firejail
Child process initialized in 157.39 ms
Searching $PATH for man
trying #/usr/local/sbin/man#
trying #/usr/local/bin/man#
Installing /run/firejail/mnt/seccomp/seccomp.mdwx.32 seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.mdwx seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter
Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter
Error getpwuid: main.c:245 init_cfg: No such file or directory
monitoring pid 15

Sandbox monitor: waitpid 15 retval 15 status 256

Parent is shutting down, bye...

Behavior without a profile

n/a

Additional context

Spoke with @glitsj16 on IRC about that.
#2121 appears to be relevant, but this issue does not seem to be about apparmor becaue sudo aa-status lists firejail-default and there is neither man, less or more in the list of active apparmor profiles. --ignore=apparmor does not appear to make a difference here.

3 processes are in enforce mode.
   /usr/bin/man (235029) firejail-default//&unconfined
   /usr/bin/man (235041) firejail-default//&unconfined
   /usr/bin/less (235042) firejail-default//&unconfined

As you can see, those processes are all using the firejail-default profile.

Curiously enough it works when you add private-etc group,passwd to man.local, glitsj16 told me this is what they have been using.
Feel free to assign a lower priority to this weird voodoo issue as a double invocation of firejail is not really the standard and more of a user error than anything else, but glitsj16 wanted me to report this just so it can at least be a known issue.

Environment

Arch Linux
Firejail version: firejail version 0.9.71, 5ab4aeb35

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Originally created by @NetSysFire on GitHub (Aug 18, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5321  ### Description When `firecfg` has been run, so `/usr/local/bin/man` is symlinked and therefore automagically firejailed, `firejail man firejail` does not work while just `man firejail` works. However, this specifically only breaks man so far. `firejail drill example.com` for example works. ### Steps to Reproduce 1. Make sure `/usr/bin/man` points to `/usr/bin/firejail`. 2. Run `firejail man firejail` (you may choose any other manpage of course) 3. `Error getpwuid: main.c:245 init_cfg: No such file or directory` ### Expected behavior I know this is a bit of an edge case, but other applications do work with that. E.g `firejail drill example.com` works. ### Actual behavior It does not work. ``` Active seccomp files: cat /run/firejail/mnt/seccomp/seccomp.list /run/firejail/mnt/seccomp/seccomp.protocol /run/firejail/mnt/seccomp/seccomp.32 /run/firejail/mnt/seccomp/seccomp /run/firejail/mnt/seccomp/seccomp.mdwx /run/firejail/mnt/seccomp/seccomp.mdwx.32 Create the new ld.so.preload file Blacklist violations are logged to syslog Mount the new ld.so.preload file Dropping all capabilities nogroups command not ignored noroot user namespace installed Dropping all capabilities NO_NEW_PRIVS set Drop privileges: pid 1, uid 1000, gid 1000, force_nogroups 0 nogroups command not ignored No supplementary groups AppArmor enabled Closing non-standard file descriptors Starting application LD_PRELOAD=(null) execvp argument 0: man execvp argument 1: firejail Child process initialized in 157.39 ms Searching $PATH for man trying #/usr/local/sbin/man# trying #/usr/local/bin/man# Installing /run/firejail/mnt/seccomp/seccomp.mdwx.32 seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.mdwx seccomp filter Installing /run/firejail/mnt/seccomp/seccomp seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.32 seccomp filter Installing /run/firejail/mnt/seccomp/seccomp.protocol seccomp filter Error getpwuid: main.c:245 init_cfg: No such file or directory monitoring pid 15 Sandbox monitor: waitpid 15 retval 15 status 256 Parent is shutting down, bye... ``` ### Behavior without a profile n/a ### Additional context Spoke with @glitsj16 on IRC about that. #2121 appears to be relevant, but this issue does not seem to be about apparmor becaue `sudo aa-status` lists `firejail-default` and there is neither man, less or more in the list of active apparmor profiles. `--ignore=apparmor` does not appear to make a difference here. ``` 3 processes are in enforce mode. /usr/bin/man (235029) firejail-default//&unconfined /usr/bin/man (235041) firejail-default//&unconfined /usr/bin/less (235042) firejail-default//&unconfined ``` As you can see, those processes are all using the `firejail-default` profile. Curiously enough it works when you add `private-etc group,passwd` to `man.local`, glitsj16 told me this is what they have been using. Feel free to assign a lower priority to this weird voodoo issue as a double invocation of firejail is not really the standard and more of a user error than anything else, but glitsj16 wanted me to report this just so it can at least be a known issue. ### Environment - Arch Linux - Firejail version: firejail version 0.9.71, 5ab4aeb35 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)

gitea-mirror added the

enhancement

question_old

firejail-in-firejail

labels 2026-05-05 09:37:12 -06:00

gitea-mirror commented

2026-05-05 09:37:14 -06:00

Author

Owner

@ghost commented on GitHub (Aug 18, 2022):

I've seen many references to this 'double invocation' topic in the past. Just wondering if we can do something more than the warning. Turning it into a fatal error would be overkill, but it would be nice to have an OSD notifier tool for making the (GUI) users more aware of things like this.

@ghost commented on GitHub (Aug 18, 2022): I've seen many references to this 'double invocation' topic in the past. Just wondering if we can do something more than the warning. Turning it into a fatal error would be overkill, but it would be nice to have an OSD notifier tool for making the (GUI) users more aware of things like this.

gitea-mirror commented

2026-05-05 09:37:16 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 18, 2022):

Double invocation

Most of the time we say "firejail in firejail" (just to have the term you need to query for older issues)

Curiously enough it works when you add private-etc group,passwd to man.local

Yes, private-etc is the cause. Profiles w/o it are likely not affected.

@rusty-snake commented on GitHub (Aug 18, 2022): > Double invocation Most of the time we say "firejail in firejail" (just to have the term you need to query for older issues) > Curiously enough it works when you add private-etc group,passwd to man.local Yes, `private-etc` is the cause. Profiles w/o it are likely not affected.

gitea-mirror commented

2026-05-05 09:37:17 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 18, 2022):

Actually it's a duplicate of #2877 Issue 1.

@rusty-snake commented on GitHub (Aug 18, 2022): Actually it's a duplicate of #2877 Issue 1.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2958

No description provided.

Rows
Columns