github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5401] libreoffice: cannot start due to whitelist-run-common.inc #2985

New issue

Closed

opened 2026-05-05 09:38:25 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 09:38:25 -06:00

Owner

Originally created by @cvlc12 on GitHub (Oct 4, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5401

Description

Libre office needs include whitelist-run-common.inc to be commented out or ignore include whitelist-run-common.incin order to launch, otherwise it complains that User installation could not be completed.

Steps to Reproduce

Running LibreOffice after running $ sudo firecfg

Expected behavior

LO runs normally

Actual behavior

LibreOffice 7.4 - Fatal Error: The application cannot be started. 
User installation could not be completed. 
Sandbox monitor: waitpid 6 retval 6 status 19712

Parent is shutting down, bye...

Behavior without a profile

firejail --noprofile /usr/bin/libreoffice works

Additional context

I don't understand how disabling a whitelist makes it work.

Environment

Arch linux
Firejail version 0.9.70

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

$ LC_ALL=C firejail libreoffice 
Reading profile /etc/firejail/libreoffice.profile
Reading profile /etc/firejail/allow-java.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 34316, child pid 34317
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/60303/gvfs
Warning: not remounting /run/user/60303/doc
Blacklist violations are logged to syslog
Warning: cleaning all supplementary groups
Child process initialized in 68.80 ms
Error getpwuid: main.c:243 init_cfg: Success

Parent is shutting down, bye...

Output of LC_ALL=C firejail --debug /path/to/program

Originally created by @cvlc12 on GitHub (Oct 4, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5401  ### Description Libre office needs `include whitelist-run-common.inc` to be commented out or `ignore include whitelist-run-common.inc`in order to launch, otherwise it complains that `User installation could not be completed.` ### Steps to Reproduce Running LibreOffice after running `$ sudo firecfg ` ### Expected behavior LO runs normally ### Actual behavior ``` LibreOffice 7.4 - Fatal Error: The application cannot be started. User installation could not be completed. Sandbox monitor: waitpid 6 retval 6 status 19712 Parent is shutting down, bye... ``` ### Behavior without a profile `firejail --noprofile /usr/bin/libreoffice` works ### Additional context I don't understand how disabling a whitelist makes it work. ### Environment - Arch linux - Firejail version 0.9.70 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` $ LC_ALL=C firejail libreoffice Reading profile /etc/firejail/libreoffice.profile Reading profile /etc/firejail/allow-java.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 34316, child pid 34317 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: not remounting /run/user/60303/gvfs Warning: not remounting /run/user/60303/doc Blacklist violations are logged to syslog Warning: cleaning all supplementary groups Child process initialized in 68.80 ms Error getpwuid: main.c:243 init_cfg: Success Parent is shutting down, bye... ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` ``` </p> </details>

gitea-mirror

2026-05-05 09:38:25 -06:00

closed this issue
added the
stale
label

gitea-mirror commented

2026-05-05 09:38:28 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 4, 2022):

Can you start LO w/o wrc and post ls -A ${XDG_RUNTIME_DIR}.

I don't understand how disabling a whitelist makes it work.

No whitelist, no missing whitelist. Everything is allowed that isn't blacklisted.

@rusty-snake commented on GitHub (Oct 4, 2022): Can you start LO w/o wrc and post `ls -A ${XDG_RUNTIME_DIR}`. > I don't understand how disabling a whitelist makes it work. No whitelist, no missing whitelist. Everything is allowed that isn't blacklisted.

gitea-mirror commented

2026-05-05 09:38:29 -06:00

Author

Owner

@cvlc12 commented on GitHub (Oct 5, 2022):

The output if ls -A ${XDG_RUNTIME_DIR} doesn't appear to be different before or after launching LO

app
at-spi
bus
dbus-1
.dbus-proxy
dconf
doc
.flatpak
.flatpak-helper
gcr
gnome-session-leader-fifo
gnome-shell
gnupg
gsconnect
gvfs
gvfsd
gvfsd-sftp
ICEauthority
keyring
.mutter-Xwaylandauth.P7L7S1
p11-kit
pipewire-0
pipewire-0.lock
pulse
systemd
wayland-0
wayland-0.lock

@cvlc12 commented on GitHub (Oct 5, 2022): The output if `ls -A ${XDG_RUNTIME_DIR}` doesn't appear to be different before or after launching LO ``` app at-spi bus dbus-1 .dbus-proxy dconf doc .flatpak .flatpak-helper gcr gnome-session-leader-fifo gnome-shell gnupg gsconnect gvfs gvfsd gvfsd-sftp ICEauthority keyring .mutter-Xwaylandauth.P7L7S1 p11-kit pipewire-0 pipewire-0.lock pulse systemd wayland-0 wayland-0.lock ```

gitea-mirror commented

2026-05-05 09:38:30 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 5, 2022):

What does echo $DBUS_SESSION_BUS_ADDRESS show?

Does it work if you whitelist ${RUNUSER}/*? Assuming yes, add whitelist for all of them and remove them one by one (for file in ${XDG_RUNTIME_DIR}/*; do echo "whitelist $file"; done).

@rusty-snake commented on GitHub (Oct 5, 2022): What does `echo $DBUS_SESSION_BUS_ADDRESS` show? Does it work if you `whitelist ${RUNUSER}/*`? Assuming yes, add whitelist for all of them and remove them one by one (`for file in ${XDG_RUNTIME_DIR}/*; do echo "whitelist $file"; done`).

gitea-mirror commented

2026-05-05 09:38:31 -06:00

Author

Owner

@cvlc12 commented on GitHub (Oct 8, 2022):

$ echo $DBUS_SESSION_BUS_ADDRESS
unix:path=/run/user/60303/bus

Apparently, whitelisting ${RUNUSER}/* doesn't work (LO doesn't even launch):

$ libreoffice 
Reading profile /etc/firejail/libreoffice.profile
Reading profile /etc/firejail/libreoffice.local
Reading profile /etc/firejail/allow-java.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 13839, child pid 13840
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Error fstat: fs_whitelist.c:156 whitelist_file: Permission denied
Error: proc 13839 cannot sync with peer: unexpected EOF
Peer 13840 unexpectedly exited with status 1

but just to make sure, is this what you meant ?

$ cat /etc/firejail/libreoffice.local 
whitelist ${RUNUSER}/*

@cvlc12 commented on GitHub (Oct 8, 2022): ``` $ echo $DBUS_SESSION_BUS_ADDRESS unix:path=/run/user/60303/bus ``` Apparently, whitelisting `${RUNUSER}/*` doesn't work (LO doesn't even launch): ``` $ libreoffice Reading profile /etc/firejail/libreoffice.profile Reading profile /etc/firejail/libreoffice.local Reading profile /etc/firejail/allow-java.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 13839, child pid 13840 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Error fstat: fs_whitelist.c:156 whitelist_file: Permission denied Error: proc 13839 cannot sync with peer: unexpected EOF Peer 13840 unexpectedly exited with status 1 ``` but just to make sure, is this what you meant ? ``` $ cat /etc/firejail/libreoffice.local whitelist ${RUNUSER}/* ```

gitea-mirror commented

2026-05-05 09:38:32 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 8, 2022):

FUSE, could had though about it.

Anyway, then do file in ${XDG_RUNTIME_DIR}/*; do echo "whitelist $file"; done and remove gvfs and flatpak (app, doc) stuff.

@rusty-snake commented on GitHub (Oct 8, 2022): FUSE, could had though about it. Anyway, then do `file in ${XDG_RUNTIME_DIR}/*; do echo "whitelist $file"; done` and remove gvfs and flatpak (app, doc) stuff.

gitea-mirror commented

2026-05-05 09:38:32 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 30, 2022):

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

@rusty-snake commented on GitHub (Oct 30, 2022): I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2985

No description provided.

Rows
Columns