[GH-ISSUE #5416] chromium: can't create /dev/zero (private-dev)

gitea-mirror commented

2026-05-05 09:38:50 -06:00

Owner

Originally created by @allhavebrainimplantsandmore on GitHub (Oct 12, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5416

Description

Blacklists in links in chromium-common.profile (such as in disable-programs.inc) that blacklist .config/chromium folders actually prevent chromium from saving any profile data, and chromium launches every time as if after a fresh install. (And actually some other profile settings were preventing chromium from starting even)

Steps to Reproduce

Steps to reproduce the behavior

Install ungoogled chromium in an Archlinux' systemd-nspawn container. Launch firejail chromium, shut down and launch again. List files in the .config/chromium/Default folder.

Expected behavior

After the first launch chromium creates a bunch of files/folders in .config/chromium folder to save profile settings.

Actual behavior

No files were created.

Additional context

Strangely, the blacklist of .config/chromium folder does not affect the essential functionality of chromium if launched outside of an nspawn container. When it should logically.

Environment

Archlnux, rolling
firejail 0.9.70

Checklist

[x ] The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
[ x] The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
[ x] The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Originally created by @allhavebrainimplantsandmore on GitHub (Oct 12, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5416  ### Description Blacklists in links in chromium-common.profile (such as in disable-programs.inc) that blacklist .config/chromium folders actually prevent chromium from saving any profile data, and chromium launches every time as if after a fresh install. (And actually some other profile settings were preventing chromium from starting even) ### Steps to Reproduce _Steps to reproduce the behavior_ Install ungoogled chromium in an Archlinux' systemd-nspawn container. Launch firejail chromium, shut down and launch again. List files in the .config/chromium/Default folder. ### Expected behavior After the first launch chromium creates a bunch of files/folders in .config/chromium folder to save profile settings. ### Actual behavior No files were created. ### Additional context Strangely, the blacklist of .config/chromium folder does not affect the essential functionality of chromium if launched outside of an nspawn container. When it should logically. ### Environment Archlnux, rolling firejail 0.9.70 ### Checklist  - [x ] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). - [ x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [ ] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)

gitea-mirror commented

2026-05-05 09:38:52 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 12, 2022):

chrome, chromium, ungoogled-chromium, which one do you use?
What command did you used?

chromium-common.profile isn't intended for direct usage.

@rusty-snake commented on GitHub (Oct 12, 2022): chrome, chromium, ungoogled-chromium, which one do you use? What command did you used? chromium-common.profile isn't intended for direct usage.

gitea-mirror commented

2026-05-05 09:38:53 -06:00

Author

Owner

@allhavebrainimplantsandmore commented on GitHub (Oct 13, 2022):

I use ungoogled-chromium. I boot it with firejail chromium with some flags to disable gpu related things. So the profile used is 'chromium.profile' which links to chromium-common.profile, which links to includes such as 'disable-programs.inc', which contain blacklists to .config/chromium folders. Ungoogled-chromium exec is just plain 'chromium' fyi.

@allhavebrainimplantsandmore commented on GitHub (Oct 13, 2022): I use ungoogled-chromium. I boot it with `firejail chromium` with some flags to disable gpu related things. So the profile used is 'chromium.profile' which links to chromium-common.profile, which links to includes such as 'disable-programs.inc', which contain blacklists to .config/chromium folders. Ungoogled-chromium exec is just plain 'chromium' fyi.

gitea-mirror commented

2026-05-05 09:38:53 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 13, 2022):

Ungoogled chromium uses different binary names, depending on the source (AUR, RPMfusion, ...).

So the profile used is 'chromium.profile' which links to chromium-common.profile, which links to includes such as 'disable-programs.inc', which contain blacklists to .config/chromium folders.

So you managed to follow this line, then you opened the profiles? And saw this?

65c5480f2f/etc/profile-a-l/chromium.profile (L10)

Are you 100% sure that ungooled-chromium will write to ~/.config/chromium?

Also you didn't not completely filled the issue template and hide parts of it (instead of leaving them empty).

[edit]Does it work with --noprofile[/edit]

So are your STR correct?

No I guess. I guess ungooled-chromium will use ~/.config/ungoogled-chromium as it should (using ~/.config/chromium would be dangerous and conflicting) and you use the wrong profile.

@rusty-snake commented on GitHub (Oct 13, 2022): Ungoogled chromium uses different binary names, depending on the source (AUR, RPMfusion, ...). > So the profile used is 'chromium.profile' which links to chromium-common.profile, which links to includes such as 'disable-programs.inc', which contain blacklists to .config/chromium folders. So you managed to follow this line, then you opened the profiles? And saw this? https://github.com/netblue30/firejail/blob/65c5480f2f087ec483c240669af53bc0ebdaa2e2/etc/profile-a-l/chromium.profile#L10 --- Are you 100% sure that ungooled-chromium will write to `~/.config/chromium`? Also you didn't not completely filled the issue template and hide parts of it (instead of leaving them empty). [edit]Does it work with --noprofile[/edit] So are your STR correct? No I guess. I guess ungooled-chromium will use `~/.config/ungoogled-chromium` as it should (using `~/.config/chromium` would be dangerous and conflicting) and you use the wrong profile.

gitea-mirror commented

2026-05-05 09:38:54 -06:00

Author

Owner

@allhavebrainimplantsandmore commented on GitHub (Oct 14, 2022):

You are right. Something was preventing chromium from launching so I was editing profiles and changed things around. Which is why didn't see the noblacklist in the original files.
But here's an actual culprit for the profile out of an nspawn container: private-dev. With it, u/chromium compains it can't create /dev/zero at launch and aborts.
As a side note, why does chromium profile still have CAPS.KEEP? It works without any caps now fine.

@allhavebrainimplantsandmore commented on GitHub (Oct 14, 2022): You are right. Something was preventing chromium from launching so I was editing profiles and changed things around. Which is why didn't see the noblacklist in the original files. But here's an actual culprit for the profile out of an nspawn container: private-dev. With it, u/chromium compains it can't create /dev/zero at launch and aborts. As a side note, why does chromium profile still have CAPS.KEEP? It works without any caps now fine.

gitea-mirror commented

2026-05-05 09:38:54 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 14, 2022):

nspawn

Can you give the command.

As a side note, why does chromium profile still have CAPS.KEEP? It works without any caps now fine.

Because it only works if (unprivileged) user namespaces are enabled.
65c5480f2f/etc/profile-a-l/chromium-common.profile (L40-L41)

@rusty-snake commented on GitHub (Oct 14, 2022): > nspawn Can you give the command. > As a side note, why does chromium profile still have CAPS.KEEP? It works without any caps now fine. Because it only works if (unprivileged) user namespaces are enabled. https://github.com/netblue30/firejail/blob/65c5480f2f087ec483c240669af53bc0ebdaa2e2/etc/profile-a-l/chromium-common.profile#L40-L41

gitea-mirror commented

2026-05-05 09:38:55 -06:00

Author

Owner

@allhavebrainimplantsandmore commented on GitHub (Oct 14, 2022):

systemd-nspawn -U -D folder/

@allhavebrainimplantsandmore commented on GitHub (Oct 14, 2022): `systemd-nspawn -U -D folder/`

gitea-mirror commented

2026-05-05 09:38:55 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 14, 2022):

And what error do you get?

@rusty-snake commented on GitHub (Oct 14, 2022): And what error do you get?

gitea-mirror commented

2026-05-05 09:38:56 -06:00

Author

Owner

@allhavebrainimplantsandmore commented on GitHub (Oct 14, 2022):

When a user launches u/chromium with private-dev line in chromium-common.profile uncommented it won't start saying "can't create /dev/zero."

@allhavebrainimplantsandmore commented on GitHub (Oct 14, 2022): When a user launches u/chromium with private-dev line in chromium-common.profile uncommented it won't start saying "can't create /dev/zero."

Rows
Columns

[GH-ISSUE #5416] chromium: can't create /dev/zero (private-dev) #2989

Description

Steps to Reproduce

Expected behavior

Actual behavior

Additional context

Environment

Checklist