mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #5477] claws-mail: seahorse pinentry is blocked #3010
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3010
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Xunil73 on GitHub (Nov 21, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5477
I use claws-mail with the PGP/core PGP/inline and PGP/mime plugins. To pass the pinentry password prompt of the keys i use the "remember password" function of seahorse and the option "use gpg-agent" of claws-mail. The standard firejail profile for claws-mail blocks the pinentry function.
I searched all .profiles for entries like "pinentry" and found things like:
/etc/firejail/psi.profile:# Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for GPG...i guess this is the right way to force claws-mail.profile to accept a pinentry function but i wasn't able to implement it to the profile, i don't know how to enable this.
Is there a way to solve this?
@ghost commented on GitHub (Nov 21, 2022):
Thank you for opening this ticket. Your use case isn't something we've considered when originally creating the claws-mail profile, so we'll need to do some trial-and-error work to get this covered and functioning properly. It's a bit more complicated than usual for me to test this, due to not having 'real world' PGP-encrypted email traffic at hand. But with your help and some Q&A we'll get there.
Looking at the profile the
private-binwhich mentions some of thesepinentry-Xoptions isn't enabled, so those commands are not being blocked. My first guess is it might be something from the seahorse end we need to explicitly allow. Can you try adding the below to a claws-mail.local or email-common.local and report back your findings?@Xunil73 commented on GitHub (Nov 21, 2022):
Thank you for your reply and help! I addend the line above in a .local and the error changed. The original error was "pinentry error" and after adding the line the error switched to (translated) :
"digital signature error: data signing failed, inappropriate IOCTL (I/O-Control) for the device."
@ghost commented on GitHub (Nov 21, 2022):
Aha, I've seen that error before. Do you
export GPG_TTY=$(tty)on your machine? See this for more info.Can you post the full output you get from claws-mail, regardless of errors? I happen to read (some) German, very kind and thoughtful of you to provide the translation :-)
@Xunil73 commented on GitHub (Nov 22, 2022):
Until now i have not set the environment. After setting GPG_TTY the error changed again to "Error with signature, data signature failed, file or directory not found".
Regardless of the previous measure names, the output is always the same:
Remember to register some spam and ham messages before you
use bogofilter to evaluate mail for its probable spam status!
as you can see, there is no prompt in console after closing claws-mail.
This error happens if i try to perform a signature and encryption operation on claws-mail in the sandbox.
After CLOSING the claws-mail GUI the console startet from hangs and
two threads of claws-mail persist:
Edit by @kmk3: Fix formatting.
@kmk3 commented on GitHub (Nov 22, 2022):
(Offtopic)
@Xunil73 See the following links for how to format code blocks in markdown:
@ghost commented on GitHub (Nov 23, 2022):
Do you have that
wordlist.dbfile? The profile makes ${HOME}/.bogofilter accessible so this could just be a matter of not (yet) having used/configured the bogofilter plugin. Anyway, this doesn't seem to be related to pinentry being blocked.At the moment I can't come up with a better strategy than trying to comment lines one by one to find the culprit. One thing you might start with is the
apparmoroption, but this is pure guessing from my part.@Xunil73 commented on GitHub (Nov 24, 2022):
I think i have found the solution. Based on your tips, I tried and tried until it finally worked.
With this
/etc/firejail/claws-mail.locali can use the signature/encryption plugins withmy keyring and Seahorse's "remember password" function:
Annotation: only the entry
ignore nonewprivsmade sure that all associated processes terminated properly when the program was terminated. Without this, two processes always continued to run in the terminal after closing claws-mail.@glitsj16 many thanks for your help!
@ghost commented on GitHub (Nov 25, 2022):
@Xunil73 Thanks for digging into this! I've been doing some experimenting with claws-mail too here and have some remarks/pointers. I use a custom GTK2 build with support for the plugins I actually use, so your mileage may vary.
Does that path exist on your machine? It doesn't on my Arch Linux box, so it might not be needed.
If disabling
D-Busrestrictions is needed for your use case(s), that's fine. Note that this creates a weaker sandbox though, especially allowing access to the system bus. I managed to get encrypting/signing working without allowing it:Maybe you can experiment with these, and hopefully keep a tighter sandbox while using these plugins.
Ignoring nonewprivs is not something I like to do. Again, it weakens the sandbox considerably. Try adding
deterministic-shutdown. That might help with this.I'll keep an eye on this thread so we can add appropriate comments in the relevant profiles for other users who might face this specific problem. IMO it's an important use case we should support 'out of the box'. Thanks again for bringing it to our attention!
@Xunil73 commented on GitHub (Nov 28, 2022):
ok, thanks for this info! But now i'm really confused, i tried firejail->claws-mail now again with a fresh installed Debian and ArchLinux on an laptop. In both cases all encryption and signing works WITHOUT any workaround on the basic
claws-mail.profile. I don't know why, it is the same debian distribution with the same installed packages as on the machine i had the problems with the plugins. Let's see if i can figure it out...@ghost commented on GitHub (Nov 29, 2022):
@Xunil73 Interesting. These things happen, although I cannot explain. Maybe something stale in claws-mail configuration that is now gone. Anyway, I hope it keeps working as expected, in which case we don't need to change our related profiles. I keep checking this encrypting/signing functionality now too as claws-mail is my default mail program on Arch Linux. I'll keep this issue open for now though, just in case.
@marek22k commented on GitHub (Feb 24, 2023):
I also get:
Is there a workaround currently? It works without firejail.
Debug logs:
Adding the following does not help:
@ghost commented on GitHub (Feb 24, 2023):
@marek22k
If you're on Firejail 0.9.72 the following options are already present (either in claws-mail.profile or email-common.profile):
whitelist ${RUNUSER}/gnupg
dbus-user.talk org.freedesktop.secrets
dbus-user.talk org.gnome.keyring
dbus-user.talk org.gnome.keyring.PrivatePrompter
dbus-user.talk org.gnome.keyring.SystemPrompter (BTW, this appears twice in your post)
dbus-user.talk org.gnome.seahorse.Application
Also, 'dbus-user none' isn't used, so ignoring it won't do anything useful.
Assuming you have it working on a non-firejailed claws-mail, what you can try is disabling dbus-user filter, to rule out if what you're seeing is indeed D-Bus related:
ignore dbus-user filter.@marek22k commented on GitHub (Feb 24, 2023):
That works. Thanks for the help!