github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5428] QOwnNotes: cannot access whitelisted external media directory (disable-mnt) #2990

New issue

Open

opened 2026-05-05 09:38:50 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:38:50 -06:00

Owner

Originally created by @mYnDstrEAm on GitHub (Oct 18, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5428

Description

Maybe it's just a trivial thing: I have this in /home/username/.config/firejail/QOwnNotes.local:

noblacklist /media/veracryptId/dir/
whitelist /media/veracryptId/dir/
net none

Edit: it was as trivial as adding ignore disable-mnt, see the comment below.

When I launch it this is the output (please comment if you spot something that shouldn't be there):

Parent pid x, child pid x
2 programs installed in x ms
Warning: skipping crypto-policies for private /etc
Private /etc installed in x ms
Warning: skipping alternatives for private /usr/etc
Warning: skipping ca-certificates for private /usr/etc
Warning: skipping crypto-policies for private /usr/etc
Warning: skipping fonts for private /usr/etc
Warning: skipping host.conf for private /usr/etc
Warning: skipping hosts for private /usr/etc
Warning: skipping ld.so.cache for private /usr/etc
Warning: skipping ld.so.preload for private /usr/etc
Warning: skipping machine-id for private /usr/etc
Warning: skipping nsswitch.conf for private /usr/etc
Warning: skipping pki for private /usr/etc
Warning: skipping pulse for private /usr/etc
Warning: skipping resolv.conf for private /usr/etc
Warning: skipping ssl for private /usr/etc
Private /usr/etc installed in x ms
Error: can't chdir to Nextcloud
Blacklist violations are logged to syslog
Child process initialized in x ms
Warning: doLinuxDarkModeCheck  - 'doLinuxDarkModeCheck' returned false (:0, )
libEGL warning: wayland-egl: could not open /dev/dri/card0 (No such file or directory)
Warning: onResult  - 'network reply error':  QNetworkReply::HostNotFoundError ((null):0, (null))
Critical: "kf5-applications.menu"  not found in  () ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
libEGL warning: wayland-egl: could not open /dev/dri/card0 (No such file or directory)
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Failed to create secure directory (/run/user/1000/pulse): Permission denied
Failed to create secure directory (/run/user/1000/pulse): Permission denied
[id] vlcpulse audio output error: PulseAudio server connection failure: Connection refused
Failed to create secure directory (/run/user/1000/pulse): Permission denied
[id2] vlcpulse audio output error: PulseAudio server connection failure: Connection refused
[id2] main audio output error: no suitable audio output module
Failed to create secure directory (/run/user/1000/pulse): Permission denied
[id3] vlcpulse audio output error: PulseAudio server connection failure: Connection refused
[id3] main audio output error: no suitable audio output module
[id4] main decoder error: failed to create audio output

The net none is in the profile mainly because of this: https://github.com/pbek/QOwnNotes/issues/2602 (it would be great if firejail could prompt the user about whether or not to allow an application Internet access whenever it is first run, but that's a separate issue).

The last few errors about PulseAudio are repeated many times.

I think it has to do with veracrypt: Wayland support in Debian11/KDE is not good so it often crashes and whenever the session is restored VeraCrypt is missing from the traybar and also can't be launched as it just shows a messagebox "VeraCrypt is already running". If anybody knows a solution to this problem: the two questions about this are here: https://unix.stackexchange.com/questions/676989/how-to-circumvent-veracrypt-is-already-running and https://unix.stackexchange.com/q/603777/233262 It may have to do with the PulseAudio messages. I'll check whether QOwnNotes can access the directories when I reboot.

Steps to Reproduce

Steps to reproduce the behavior

Run in bash LC_ALL=C firejail QOwnNotes with the above QOwnNotes.local
Click on Note->Import->Import notes from text files
Try to access the whitelisted veracrypt dir

Expected behavior

It can access the veracrypt directory

Actual behavior

It can't access the whitelisted veracrypt directory

Behavior without a profile

Additional context

Environment

Linux distribution and version: Debian11/KDE
Firejail version: 0.9.70

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Originally created by @mYnDstrEAm on GitHub (Oct 18, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5428  ### Description Maybe it's just a trivial thing: I have this in `/home/username/.config/firejail/QOwnNotes.local`: ``` noblacklist /media/veracryptId/dir/ whitelist /media/veracryptId/dir/ net none ``` Edit: it was as trivial as adding `ignore disable-mnt`, see the comment below. When I launch it this is the output (please comment if you spot something that shouldn't be there): ``` Parent pid x, child pid x 2 programs installed in x ms Warning: skipping crypto-policies for private /etc Private /etc installed in x ms Warning: skipping alternatives for private /usr/etc Warning: skipping ca-certificates for private /usr/etc Warning: skipping crypto-policies for private /usr/etc Warning: skipping fonts for private /usr/etc Warning: skipping host.conf for private /usr/etc Warning: skipping hosts for private /usr/etc Warning: skipping ld.so.cache for private /usr/etc Warning: skipping ld.so.preload for private /usr/etc Warning: skipping machine-id for private /usr/etc Warning: skipping nsswitch.conf for private /usr/etc Warning: skipping pki for private /usr/etc Warning: skipping pulse for private /usr/etc Warning: skipping resolv.conf for private /usr/etc Warning: skipping ssl for private /usr/etc Private /usr/etc installed in x ms Error: can't chdir to Nextcloud Blacklist violations are logged to syslog Child process initialized in x ms Warning: doLinuxDarkModeCheck - 'doLinuxDarkModeCheck' returned false (:0, ) libEGL warning: wayland-egl: could not open /dev/dri/card0 (No such file or directory) Warning: onResult - 'network reply error': QNetworkReply::HostNotFoundError ((null):0, (null)) Critical: "kf5-applications.menu" not found in () ((null):0, (null)) Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null)) Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null)) libEGL warning: wayland-egl: could not open /dev/dri/card0 (No such file or directory) Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null)) Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null)) Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null)) Failed to create secure directory (/run/user/1000/pulse): Permission denied Failed to create secure directory (/run/user/1000/pulse): Permission denied [id] vlcpulse audio output error: PulseAudio server connection failure: Connection refused Failed to create secure directory (/run/user/1000/pulse): Permission denied [id2] vlcpulse audio output error: PulseAudio server connection failure: Connection refused [id2] main audio output error: no suitable audio output module Failed to create secure directory (/run/user/1000/pulse): Permission denied [id3] vlcpulse audio output error: PulseAudio server connection failure: Connection refused [id3] main audio output error: no suitable audio output module [id4] main decoder error: failed to create audio output ``` The `net none` is in the profile mainly because of this: https://github.com/pbek/QOwnNotes/issues/2602 (it would be great if firejail could prompt the user about whether or not to allow an application Internet access whenever it is first run, but that's a separate issue). The last few errors about PulseAudio are repeated many times. I think it has to do with veracrypt: Wayland support in Debian11/KDE is not good so it often crashes and whenever the session is restored VeraCrypt is missing from the traybar and also can't be launched as it just shows a messagebox "VeraCrypt is already running". If anybody knows a solution to this problem: the two questions about this are here: https://unix.stackexchange.com/questions/676989/how-to-circumvent-veracrypt-is-already-running and https://unix.stackexchange.com/q/603777/233262 It may have to do with the PulseAudio messages. I'll check whether QOwnNotes can access the directories when I reboot. ### Steps to Reproduce _Steps to reproduce the behavior_ 1. Run in bash `LC_ALL=C firejail QOwnNotes` with the above QOwnNotes.local 2. Click on Note->Import->Import notes from text files 3. Try to access the whitelisted veracrypt dir ### Expected behavior It can access the veracrypt directory ### Actual behavior It can't access the whitelisted veracrypt directory ### Behavior without a profile ### Additional context ### Environment - Linux distribution and version: Debian11/KDE - Firejail version: 0.9.70 ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log

gitea-mirror commented

2026-05-05 09:38:51 -06:00

Author

Owner

@mYnDstrEAm commented on GitHub (Oct 18, 2022):

Tried after rebooting but had the same problem: it was solved by adding ignore disable-mnt to the .local profile.

Shouldn't disable-mnt be added to the QOwnNotes profile? And is there already info about how to undo / override settings via ignore in .local profiles in the docs (man page)?

Moreover, when trying to open a note in the file explorer with "Show note in file manager" it doesn't open Dolphin and has this in the console: Warning: Unable to detect a launcher for 'file:///home/username/dir/Notebooks' ((null):0, (null))

@mYnDstrEAm commented on GitHub (Oct 18, 2022): Tried after rebooting but had the same problem: it was solved by adding `ignore disable-mnt` to the .local profile. Shouldn't `disable-mnt` be added to the QOwnNotes profile? And is there already info about how to undo / override settings via `ignore` in .local profiles in the docs (man page)? Moreover, when trying to open a note in the file explorer with "Show note in file manager" it doesn't open Dolphin and has this in the console: `Warning: Unable to detect a launcher for 'file:///home/username/dir/Notebooks' ((null):0, (null))`

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2990

No description provided.

Rows
Columns