github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #5499] minecraft-launcher: minecraft does not work #3016

New issue
Open
opened 2026-05-05 09:40:08 -06:00 by gitea-mirror · 8 comments
gitea-mirror commented 2026-05-05 09:40:08 -06:00
Owner
Copy link

Originally created by @tzsz0 on GitHub (Dec 2, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5499

Description

While it's possible to open the minecraft launcher itself, the actual game does not start. I can open the launcher, den then click on Start/Play, this only results in Exit Code 1.

Steps to Reproduce

Install firejail (0.9.70), download minecraft-launcher from minecraft.net and extract it to games/minecraft-launcher. Create file minecraft.local with content

include /etc/firejail/minecraft-launcher.profile
whitelist ~/games/minecraft-launcher

And then execute firejail --profile=minecraft.local games/minecraft-launcher/minecraft-launcher.
Login to minecraft and try launching the game with the latest version (1.19.2 as of writing this)

Note, the launcher does not crash but only displays a small pop up with the exit code. When running with --noprofile,
the game works fine.

  1. Run in bash LC_ALL=C firejail PROGRAM (LC_ALL=C to get a consistent output in English that can be understood by everybody)
  2. Click on '....'
  3. Scroll down to '....'
  4. See error ERROR
Reading profile firejail.profiles/minecraft
Reading profile /etc/firejail/minecraft-launcher.profile
Reading profile /etc/firejail/allow-java.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 804584, child pid 804585
Warning: skipping minecraft-launcher for private /opt
Private /opt installed in 0.06 ms
1 program installed in 0.88 ms
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: skipping ati for private /etc
Warning: skipping ca-certificates for private /etc
Warning: skipping drirc for private /etc
Warning: skipping gtk-2.0 for private /etc
Warning: skipping gtk-3.0 for private /etc
Warning: skipping java-10-openjdk for private /etc
Warning: skipping java-11-openjdk for private /etc
Warning: skipping java-12-openjdk for private /etc
Warning: skipping java-13-openjdk for private /etc
Warning: skipping java-14-openjdk for private /etc
Warning: skipping java-7-openjdk for private /etc
Warning: skipping java-8-openjdk for private /etc
Warning: skipping java-9-openjdk for private /etc
Warning: skipping java-openjdk for private /etc
Warning: skipping nvidia for private /etc
Warning: skipping timezone for private /etc
Private /etc installed in 41.54 ms
Private /usr/etc installed in 0.00 ms
Blacklist violations are logged to syslog
Child process initialized in 91.73 ms
https://launchermeta.mojang.com/v1/products/launcher/snip/linux.json
[1202/174612.756159:INFO:main_context.cpp(130)] CEF initialized successfully.
[1202/174612.756212:INFO:main_context.cpp(132)] CEF version: 99.2.14+g3f796b8+chromium-99.0.4844.84

(minecraft-launcher:34): dbind-WARNING **: 17:46:12.760: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: Datei oder Verzeichnis nicht gefunden
Created browser window for reuse: 0x4200002
[1202/174612.863305:ERROR:sandbox_linux.cc(377)] InitializeSandbox() called with multiple threads in process gpu-process.
Created browser window for reuse: 0x42001bf
[1202/174630.384693:INFO:LauncherAppRenderer.cpp(542)] OnContextReleased: no frame (unknown context), browser id=2
[1202/174630.445794:INFO:LauncherAppRenderer.cpp(542)] OnContextReleased: no frame (unknown context), browser id=2
[1202/174630.446965:WARNING:connection.cc(61)] X error received.  Request: DestroyWindowRequest, Error: WindowError{.sequence = 28772, .bad_value = 69206464, .minor_opcode = 0, .major_opcode = 4}
Created browser window for reuse: 0x42001e7
[1202/174634.718462:INFO:LauncherAppRenderer.cpp(52)] [Info: 2022-12-02 16:46:12.625260898: LauncherMain.cpp(112)] Initiated models
[1202/174634.718867:INFO:LauncherAppRenderer.cpp(52)] [Info: 2022-12-02 16:46:12.625438355: LauncherController.cpp(555)] Constructing launcher controller with workDir: /.../.minecraft, isActive: 0
[1202/174634.719207:INFO:LauncherAppRenderer.cpp(52)] [Info: 2022-12-02 16:46:32.574467567: LauncherAppRenderer.cpp(173)] Javascript bridge extended in OnWebKitInitialized.
[1202/174634.927268:INFO:LauncherAppRenderer.cpp(542)] OnContextReleased: no frame (unknown context), browser id=3
[1202/174634.929449:INFO:LauncherAppRenderer.cpp(70)] OnBrowserDestroyed: id=3
terminate called after throwing an instance of 'std::bad_function_call'
  what():  bad_function_call
[1202/174733.722662:WARNING:connection.cc(61)] X error received.  Request: DestroyWindowRequest, Error: WindowError{.sequence = 39617, .bad_value = 69206019, .minor_opcode = 0, .major_opcode = 4}

Expected behavior

Successful game startup

Actual behavior

Launcher can't start game and reports Exit Code 1

Behavior without a profile

Game was playable

Additional context

.

Environment

  • Fedora 37 with java 17
  • 0.9.70

Checklist

  • The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
  • I can reproduce the issue without custom modifications (e.g. globals.local).
  • The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
  • The profile (and redirect profile if exists) hasn't already been fixed upstream. [note by @rusty-snake: originally ticket as [? ]]
  • I have performed a short search for similar issues (to avoid opening a duplicate).
    • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
  • I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

EDIT by @rusty-snake: Fix markdown

Originally created by @tzsz0 on GitHub (Dec 2, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5499 <!-- See the following links for help with formatting: https://guides.github.com/features/mastering-markdown/ https://docs.github.com/en/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax --> ### Description While it's possible to open the minecraft launcher itself, the actual game does not start. I can open the launcher, den then click on Start/Play, this only results in Exit Code 1. ### Steps to Reproduce Install firejail (0.9.70), download minecraft-launcher from minecraft.net and extract it to games/minecraft-launcher. Create file minecraft.local with content ``` include /etc/firejail/minecraft-launcher.profile whitelist ~/games/minecraft-launcher ``` And then execute `firejail --profile=minecraft.local games/minecraft-launcher/minecraft-launcher`. Login to minecraft and try launching the game with the latest version (1.19.2 as of writing this) Note, the launcher does not crash but only displays a small pop up with the exit code. When running with --noprofile, the game works fine. 1. Run in bash `LC_ALL=C firejail PROGRAM` (`LC_ALL=C` to get a consistent output in English that can be understood by everybody) 2. Click on '....' 3. Scroll down to '....' 4. See error `ERROR` ``` Reading profile firejail.profiles/minecraft Reading profile /etc/firejail/minecraft-launcher.profile Reading profile /etc/firejail/allow-java.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-shell.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 804584, child pid 804585 Warning: skipping minecraft-launcher for private /opt Private /opt installed in 0.06 ms 1 program installed in 0.88 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping ati for private /etc Warning: skipping ca-certificates for private /etc Warning: skipping drirc for private /etc Warning: skipping gtk-2.0 for private /etc Warning: skipping gtk-3.0 for private /etc Warning: skipping java-10-openjdk for private /etc Warning: skipping java-11-openjdk for private /etc Warning: skipping java-12-openjdk for private /etc Warning: skipping java-13-openjdk for private /etc Warning: skipping java-14-openjdk for private /etc Warning: skipping java-7-openjdk for private /etc Warning: skipping java-8-openjdk for private /etc Warning: skipping java-9-openjdk for private /etc Warning: skipping java-openjdk for private /etc Warning: skipping nvidia for private /etc Warning: skipping timezone for private /etc Private /etc installed in 41.54 ms Private /usr/etc installed in 0.00 ms Blacklist violations are logged to syslog Child process initialized in 91.73 ms https://launchermeta.mojang.com/v1/products/launcher/snip/linux.json [1202/174612.756159:INFO:main_context.cpp(130)] CEF initialized successfully. [1202/174612.756212:INFO:main_context.cpp(132)] CEF version: 99.2.14+g3f796b8+chromium-99.0.4844.84 (minecraft-launcher:34): dbind-WARNING **: 17:46:12.760: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: Datei oder Verzeichnis nicht gefunden Created browser window for reuse: 0x4200002 [1202/174612.863305:ERROR:sandbox_linux.cc(377)] InitializeSandbox() called with multiple threads in process gpu-process. Created browser window for reuse: 0x42001bf [1202/174630.384693:INFO:LauncherAppRenderer.cpp(542)] OnContextReleased: no frame (unknown context), browser id=2 [1202/174630.445794:INFO:LauncherAppRenderer.cpp(542)] OnContextReleased: no frame (unknown context), browser id=2 [1202/174630.446965:WARNING:connection.cc(61)] X error received. Request: DestroyWindowRequest, Error: WindowError{.sequence = 28772, .bad_value = 69206464, .minor_opcode = 0, .major_opcode = 4} Created browser window for reuse: 0x42001e7 [1202/174634.718462:INFO:LauncherAppRenderer.cpp(52)] [Info: 2022-12-02 16:46:12.625260898: LauncherMain.cpp(112)] Initiated models [1202/174634.718867:INFO:LauncherAppRenderer.cpp(52)] [Info: 2022-12-02 16:46:12.625438355: LauncherController.cpp(555)] Constructing launcher controller with workDir: /.../.minecraft, isActive: 0 [1202/174634.719207:INFO:LauncherAppRenderer.cpp(52)] [Info: 2022-12-02 16:46:32.574467567: LauncherAppRenderer.cpp(173)] Javascript bridge extended in OnWebKitInitialized. [1202/174634.927268:INFO:LauncherAppRenderer.cpp(542)] OnContextReleased: no frame (unknown context), browser id=3 [1202/174634.929449:INFO:LauncherAppRenderer.cpp(70)] OnBrowserDestroyed: id=3 terminate called after throwing an instance of 'std::bad_function_call' what(): bad_function_call [1202/174733.722662:WARNING:connection.cc(61)] X error received. Request: DestroyWindowRequest, Error: WindowError{.sequence = 39617, .bad_value = 69206019, .minor_opcode = 0, .major_opcode = 4} ``` ### Expected behavior Successful game startup ### Actual behavior Launcher can't start game and reports Exit Code 1 ### Behavior without a profile Game was playable ### Additional context . ### Environment - Fedora 37 with java 17 - 0.9.70 ### Checklist <!-- Note: Items are checked with an "x", like so: - [x] This is a checked item. --> - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). [note by @rusty-snake: originally ticket as `[? ]`] - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) --- EDIT by @rusty-snake: Fix markdown
gitea-mirror added the
needinfo
 label 2026-05-05 09:40:08 -06:00
gitea-mirror commented 2026-05-05 09:40:10 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 2, 2022):

Related: #4961

<!-- gh-comment-id:1335543073 --> @rusty-snake commented on GitHub (Dec 2, 2022): Related: #4961
gitea-mirror commented 2026-05-05 09:40:11 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Dec 2, 2022):

Is there anything in the syslog?

<!-- gh-comment-id:1335547321 --> @rusty-snake commented on GitHub (Dec 2, 2022): Is there anything in the syslog?
gitea-mirror commented 2026-05-05 09:40:12 -06:00
Author
Owner
Copy link

@tzsz0 commented on GitHub (Dec 2, 2022):

I just performed the steps above twice and with different syslog output. For the first run i go:

/usr/libexec/gdm-x-session[6066]: ThunarThumbnailCache: failed to call Move(): GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable

(is this even related, i don't know but the timestamp matches)

And the second run result in

Dez 02 18:10:07 SH-Tower.fritz.box audit[810847]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=810847 comm="minecraft-launc" exe="/home/tzsz/.minecraft/launcher/minecraft-launcher" sig=6 res=1
Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=496 op=LOAD
Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=497 op=LOAD
Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=498 op=LOAD
Dez 02 18:10:07 SH-Tower.fritz.box systemd[1]: Started systemd-coredump@23-810852-0.service - Process Core Dump (PID 810852/UID 0).
Dez 02 18:10:07 SH-Tower.fritz.box audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@23-810852-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Dez 02 18:10:07 SH-Tower.fritz.box systemd-coredump[810853]: [🡕] Process 810847 (minecraft-launc) of user 1000 dumped core.
                                                             
                                                             Module /home/tzsz/.minecraft/launcher/minecraft-launcher with build-id 902147eadba5befdafcb78397e0d848a28c1bfbc
                                                             Metadata for module /home/tzsz/.minecraft/launcher/minecraft-launcher owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "libunistring",
                                                                     "version" : "1.0-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module /home/tzsz/.minecraft/launcher/libcef.so with build-id 3ed2fdcfd233a40c7cd1fda5c6f0bf5476c336d5
                                                             Metadata for module /home/tzsz/.minecraft/launcher/libcef.so owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "libunistring",
                                                                     "version" : "1.0-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module /home/tzsz/.minecraft/launcher/liblauncher.so with build-id d605e443e6f1146f2e6b72cd883cfad17a29d04b
                                                             Metadata for module /home/tzsz/.minecraft/launcher/liblauncher.so owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "libunistring",
                                                                     "version" : "1.0-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module /run/firejail/lib/libtracelog.so with build-id 58b86ef7bd8ee516b77bac85efebe79077fbd488
                                                             Metadata for module /run/firejail/lib/libtracelog.so owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "libunistring",
                                                                     "version" : "1.0-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module linux-vdso.so.1 with build-id f1344d7d7c9efcbcc6c90cee049c4f55e997d439
                                                             Module libgmp.so.10 with build-id c88399b381c39d7e45a5c8d078e8f34a237cb03b
                                                             Metadata for module libgmp.so.10 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "gmp",
                                                                     "version" : "6.2.1-3.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libhogweed.so.6 with build-id 6f32d090a6de6b372ab9258d2f9656c808aba96d
                                                             Metadata for module libhogweed.so.6 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "nettle",
                                                                     "version" : "3.8-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libnettle.so.8 with build-id c0f18d9e28d93220296008fe3bc58b22347b1835
                                                             Metadata for module libnettle.so.8 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "nettle",
                                                                     "version" : "3.8-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
Module libtasn1.so.6 with build-id fca2bdc5861a580a09853fbc80c9f63591bf0ea6
                                                             Metadata for module libtasn1.so.6 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "libtasn1",
                                                                     "version" : "4.18.0-3.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libunistring.so.2 with build-id 0c89f0c5be4a239b6ab72dc3aa015b95fc8ede0d
                                                             Metadata for module libunistring.so.2 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "libunistring",
                                                                     "version" : "1.0-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libidn2.so.0 with build-id 220865bcdf15c803f8dd897650798ecb5c2ef1e6
                                                             Metadata for module libidn2.so.0 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "libidn2",
                                                                     "version" : "2.3.4-1.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }

--SNIP-- ( i removed some lines because this continued for like 900+ lines only with different libraries.)

Module libglib-2.0.so.0 with build-id 2e3f66df3fd65783975e00e471f9ba46bc371aec
                                                             Metadata for module libglib-2.0.so.0 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "glib2",
                                                                     "version" : "2.74.1-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libgmodule-2.0.so.0 with build-id 96a9fd2bb241550a525c810efc1be53dd6a5e0f7
                                                             Metadata for module libgmodule-2.0.so.0 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "glib2",
                                                                     "version" : "2.74.1-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module ld-linux-x86-64.so.2 with build-id 3abf9e1b0792e260bf11a8023ddc3e2721563ea6
                                                             Module libc.so.6 with build-id 765237b0355c030ff41d969eedcb87bfccb43595
                                                             Module libgcc_s.so.1 with build-id bad96a3adc0a3a006e7ef4900ff3ae1ddcc33ed2
                                                             Module libm.so.6 with build-id fd53990348f5eed735f9a8021f7a47063691353e
                                                             Module libstdc++.so.6 with build-id 5c63442039be42a72c8722574572171b19f18d66
                                                             Module libgobject-2.0.so.0 with build-id be217b1a4293170c6f560645618214fe20be3278
                                                             Metadata for module libgobject-2.0.so.0 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "glib2",
                                                                     "version" : "2.74.1-2.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libgdk-3.so.0 with build-id 0dcfd702ed51964d768492623f9390ea15992b8a
                                                             Metadata for module libgdk-3.so.0 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "gtk3",
                                                                     "version" : "3.24.35-1.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libgtk-3.so.0 with build-id 97206f44d073afdd51487210d43f2d5808c0464a
                                                             Metadata for module libgtk-3.so.0 owned by FDO found: {
                                                                     "type" : "rpm",
                                                                     "name" : "gtk3",
                                                                     "version" : "3.24.35-1.fc37",
                                                                     "architecture" : "x86_64",
                                                                     "osCpe" : "cpe:/o:fedoraproject:fedora:37"
                                                             }
                                                             
                                                             Module libpthread.so.0 with build-id 2b81e8ee3d186efc93bb38d855841ae193d09853
                                                             Module libdl.so.2 with build-id 9b8f976e7c6d2c96004d734f77fa2282b6241268
                                                             Stack trace of thread 330:
                                                             #0  0x00007ffac96afe7c __pthread_kill_implementation (libc.so.6 + 0x8ce7c)
                                                             #1  0x00007ffac965faa6 raise (libc.so.6 + 0x3caa6)
                                                             #2  0x00007ffac96497fc abort (libc.so.6 + 0x267fc)
                                                             #3  0x00007ffac98a2b97 _ZN9__gnu_cxx27__verbose_terminate_handlerEv.cold (libstdc++.so.6 + 0xa2b97)
                                                             #4  0x00007ffac98ae48c _ZN10__cxxabiv111__terminateEPFvvE (libstdc++.so.6 + 0xae48c)
                                                             #5  0x00007ffac98ad4f9 __cxa_call_terminate (libstdc++.so.6 + 0xad4f9)
                                                             #6  0x00007ffac98adc16 __gxx_personality_v0 (libstdc++.so.6 + 0xadc16)
                                                             #7  0x00007ffaca436c74 _Unwind_RaiseException_Phase2 (libgcc_s.so.1 + 0x16c74)
                                                             #8  0x00007ffaca4376cd _Unwind_Resume (libgcc_s.so.1 + 0x176cd)
                                                             #9  0x00007ffab2558347 n/a (/home/me/.minecraft/launcher/liblauncher.so + 0x558347)
                                                             ELF object binary architecture: AMD x86-64

Dez 02 18:10:07 SH-Tower.fritz.box systemd[1]: systemd-coredump@23-810852-0.service: Deactivated successfully.
Dez 02 18:10:07 SH-Tower.fritz.box audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@23-810852-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=0 op=UNLOAD
Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=0 op=UNLOAD
Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=0 op=UNLOAD
Dez 02 18:10:08 SH-Tower.fritz.box abrt-server[810998]: Executable '/home/me/.minecraft/launcher/minecraft-launcher' doesn't belong to any package and ProcessUnpackaged is set to 'no'
Dez 02 18:10:08 SH-Tower.fritz.box abrt-server[810998]: 'post-create' on '/var/spool/abrt/ccpp-2022-12-02-18:10:08.149052-810847' exited with 1
Dez 02 18:10:08 SH-Tower.fritz.box abrt-server[810998]: Deleting problem directory '/var/spool/abrt/ccpp-2022-12-02-18:10:08.149052-810847'
Dez 02 18:11:33 SH-Tower.fritz.box /usr/libexec/gdm-x-session[6066]: ThunarThumbnailCache: failed to call Move(): GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable

There is the stacktrace, I just don't know why it didn't show in the first run.

<!-- gh-comment-id:1335562903 --> @tzsz0 commented on GitHub (Dec 2, 2022): I just performed the steps above twice and with different syslog output. For the first run i go: ``` /usr/libexec/gdm-x-session[6066]: ThunarThumbnailCache: failed to call Move(): GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable ``` (is this even related, i don't know but the timestamp matches) And the second run result in ``` Dez 02 18:10:07 SH-Tower.fritz.box audit[810847]: ANOM_ABEND auid=1000 uid=1000 gid=1000 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=810847 comm="minecraft-launc" exe="/home/tzsz/.minecraft/launcher/minecraft-launcher" sig=6 res=1 Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=496 op=LOAD Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=497 op=LOAD Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=498 op=LOAD Dez 02 18:10:07 SH-Tower.fritz.box systemd[1]: Started systemd-coredump@23-810852-0.service - Process Core Dump (PID 810852/UID 0). Dez 02 18:10:07 SH-Tower.fritz.box audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@23-810852-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Dez 02 18:10:07 SH-Tower.fritz.box systemd-coredump[810853]: [🡕] Process 810847 (minecraft-launc) of user 1000 dumped core. Module /home/tzsz/.minecraft/launcher/minecraft-launcher with build-id 902147eadba5befdafcb78397e0d848a28c1bfbc Metadata for module /home/tzsz/.minecraft/launcher/minecraft-launcher owned by FDO found: { "type" : "rpm", "name" : "libunistring", "version" : "1.0-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module /home/tzsz/.minecraft/launcher/libcef.so with build-id 3ed2fdcfd233a40c7cd1fda5c6f0bf5476c336d5 Metadata for module /home/tzsz/.minecraft/launcher/libcef.so owned by FDO found: { "type" : "rpm", "name" : "libunistring", "version" : "1.0-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module /home/tzsz/.minecraft/launcher/liblauncher.so with build-id d605e443e6f1146f2e6b72cd883cfad17a29d04b Metadata for module /home/tzsz/.minecraft/launcher/liblauncher.so owned by FDO found: { "type" : "rpm", "name" : "libunistring", "version" : "1.0-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module /run/firejail/lib/libtracelog.so with build-id 58b86ef7bd8ee516b77bac85efebe79077fbd488 Metadata for module /run/firejail/lib/libtracelog.so owned by FDO found: { "type" : "rpm", "name" : "libunistring", "version" : "1.0-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module linux-vdso.so.1 with build-id f1344d7d7c9efcbcc6c90cee049c4f55e997d439 Module libgmp.so.10 with build-id c88399b381c39d7e45a5c8d078e8f34a237cb03b Metadata for module libgmp.so.10 owned by FDO found: { "type" : "rpm", "name" : "gmp", "version" : "6.2.1-3.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libhogweed.so.6 with build-id 6f32d090a6de6b372ab9258d2f9656c808aba96d Metadata for module libhogweed.so.6 owned by FDO found: { "type" : "rpm", "name" : "nettle", "version" : "3.8-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libnettle.so.8 with build-id c0f18d9e28d93220296008fe3bc58b22347b1835 Metadata for module libnettle.so.8 owned by FDO found: { "type" : "rpm", "name" : "nettle", "version" : "3.8-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libtasn1.so.6 with build-id fca2bdc5861a580a09853fbc80c9f63591bf0ea6 Metadata for module libtasn1.so.6 owned by FDO found: { "type" : "rpm", "name" : "libtasn1", "version" : "4.18.0-3.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libunistring.so.2 with build-id 0c89f0c5be4a239b6ab72dc3aa015b95fc8ede0d Metadata for module libunistring.so.2 owned by FDO found: { "type" : "rpm", "name" : "libunistring", "version" : "1.0-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libidn2.so.0 with build-id 220865bcdf15c803f8dd897650798ecb5c2ef1e6 Metadata for module libidn2.so.0 owned by FDO found: { "type" : "rpm", "name" : "libidn2", "version" : "2.3.4-1.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } --SNIP-- ( i removed some lines because this continued for like 900+ lines only with different libraries.) Module libglib-2.0.so.0 with build-id 2e3f66df3fd65783975e00e471f9ba46bc371aec Metadata for module libglib-2.0.so.0 owned by FDO found: { "type" : "rpm", "name" : "glib2", "version" : "2.74.1-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libgmodule-2.0.so.0 with build-id 96a9fd2bb241550a525c810efc1be53dd6a5e0f7 Metadata for module libgmodule-2.0.so.0 owned by FDO found: { "type" : "rpm", "name" : "glib2", "version" : "2.74.1-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module ld-linux-x86-64.so.2 with build-id 3abf9e1b0792e260bf11a8023ddc3e2721563ea6 Module libc.so.6 with build-id 765237b0355c030ff41d969eedcb87bfccb43595 Module libgcc_s.so.1 with build-id bad96a3adc0a3a006e7ef4900ff3ae1ddcc33ed2 Module libm.so.6 with build-id fd53990348f5eed735f9a8021f7a47063691353e Module libstdc++.so.6 with build-id 5c63442039be42a72c8722574572171b19f18d66 Module libgobject-2.0.so.0 with build-id be217b1a4293170c6f560645618214fe20be3278 Metadata for module libgobject-2.0.so.0 owned by FDO found: { "type" : "rpm", "name" : "glib2", "version" : "2.74.1-2.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libgdk-3.so.0 with build-id 0dcfd702ed51964d768492623f9390ea15992b8a Metadata for module libgdk-3.so.0 owned by FDO found: { "type" : "rpm", "name" : "gtk3", "version" : "3.24.35-1.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libgtk-3.so.0 with build-id 97206f44d073afdd51487210d43f2d5808c0464a Metadata for module libgtk-3.so.0 owned by FDO found: { "type" : "rpm", "name" : "gtk3", "version" : "3.24.35-1.fc37", "architecture" : "x86_64", "osCpe" : "cpe:/o:fedoraproject:fedora:37" } Module libpthread.so.0 with build-id 2b81e8ee3d186efc93bb38d855841ae193d09853 Module libdl.so.2 with build-id 9b8f976e7c6d2c96004d734f77fa2282b6241268 Stack trace of thread 330: #0 0x00007ffac96afe7c __pthread_kill_implementation (libc.so.6 + 0x8ce7c) #1 0x00007ffac965faa6 raise (libc.so.6 + 0x3caa6) #2 0x00007ffac96497fc abort (libc.so.6 + 0x267fc) #3 0x00007ffac98a2b97 _ZN9__gnu_cxx27__verbose_terminate_handlerEv.cold (libstdc++.so.6 + 0xa2b97) #4 0x00007ffac98ae48c _ZN10__cxxabiv111__terminateEPFvvE (libstdc++.so.6 + 0xae48c) #5 0x00007ffac98ad4f9 __cxa_call_terminate (libstdc++.so.6 + 0xad4f9) #6 0x00007ffac98adc16 __gxx_personality_v0 (libstdc++.so.6 + 0xadc16) #7 0x00007ffaca436c74 _Unwind_RaiseException_Phase2 (libgcc_s.so.1 + 0x16c74) #8 0x00007ffaca4376cd _Unwind_Resume (libgcc_s.so.1 + 0x176cd) #9 0x00007ffab2558347 n/a (/home/me/.minecraft/launcher/liblauncher.so + 0x558347) ELF object binary architecture: AMD x86-64 Dez 02 18:10:07 SH-Tower.fritz.box systemd[1]: systemd-coredump@23-810852-0.service: Deactivated successfully. Dez 02 18:10:07 SH-Tower.fritz.box audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@23-810852-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=0 op=UNLOAD Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=0 op=UNLOAD Dez 02 18:10:07 SH-Tower.fritz.box audit: BPF prog-id=0 op=UNLOAD Dez 02 18:10:08 SH-Tower.fritz.box abrt-server[810998]: Executable '/home/me/.minecraft/launcher/minecraft-launcher' doesn't belong to any package and ProcessUnpackaged is set to 'no' Dez 02 18:10:08 SH-Tower.fritz.box abrt-server[810998]: 'post-create' on '/var/spool/abrt/ccpp-2022-12-02-18:10:08.149052-810847' exited with 1 Dez 02 18:10:08 SH-Tower.fritz.box abrt-server[810998]: Deleting problem directory '/var/spool/abrt/ccpp-2022-12-02-18:10:08.149052-810847' Dez 02 18:11:33 SH-Tower.fritz.box /usr/libexec/gdm-x-session[6066]: ThunarThumbnailCache: failed to call Move(): GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name is not activatable ``` There is the stacktrace, I just don't know why it didn't show in the first run.
gitea-mirror commented 2026-05-05 09:40:14 -06:00
Author
Owner
Copy link

@kmk3 commented on GitHub (Dec 2, 2022):

(Offtopic)

@tzsz0

Please see the following links for how to format code blocks in markdown:

<!-- gh-comment-id:1335564409 --> @kmk3 commented on GitHub (Dec 2, 2022): (Offtopic) @tzsz0 Please see the following links for how to format code blocks in markdown: * <https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks> * <https://github.github.com/gfm/#fenced-code-blocks>
gitea-mirror commented 2026-05-05 09:40:14 -06:00
Author
Owner
Copy link

@tzsz0 commented on GitHub (Dec 2, 2022):

(fixed formatting)

<!-- gh-comment-id:1335620939 --> @tzsz0 commented on GitHub (Dec 2, 2022): (fixed formatting)
gitea-mirror commented 2026-05-05 09:40:15 -06:00
Author
Owner
Copy link

@tzsz0 commented on GitHub (Dec 3, 2022):

So, I tried to find the line in the profile that hinders the game from launching. After some digging, I thought I found it but now I am at a state where firejail doesnt sandbox anything anymore.
Running firejail --profile=/etc/firejail/minecraft-launcher.profile games/minecraft/minecraft-launcher/minecraft-launcher launches the launcher and(!) the game but the first line in the terminal states

Warning: an existing sandbox was detected. games/minecraft/minecraft-launcher/minecraft-launcher will run without any additional sandboxing features

So I guess that refers to the chromium part of the launcher. However, it would still leave the rest of the game without any further security constraints. The most problematic part is that malicious mods could escape the game and do harm to my system and/or read/write important files in my /home directory.*

And I don't know why the game runs now, I am using the same profile as I did in the beginning

*EDIT: I tried, the program can read all subdirectories (incl contents) in my homedir
EDIT2: /etc/firejail/minecraft-launcher.profile is the original file, I made all modifications to a local file
EDIT3: appearently I was in a sandboxed shell...

<!-- gh-comment-id:1336003766 --> @tzsz0 commented on GitHub (Dec 3, 2022): So, I tried to find the line in the profile that hinders the game from launching. After some digging, I thought I found it but now I am at a state where firejail doesnt sandbox anything anymore. Running `firejail --profile=/etc/firejail/minecraft-launcher.profile games/minecraft/minecraft-launcher/minecraft-launcher` launches the launcher and(!) the game but the first line in the terminal states ``` Warning: an existing sandbox was detected. games/minecraft/minecraft-launcher/minecraft-launcher will run without any additional sandboxing features ``` So I guess that refers to the chromium part of the launcher. However, it would still leave the rest of the game without any further security constraints. The most problematic part is that malicious mods could escape the game and do harm to my system and/or read/write important files in my /home directory.* And I don't know why the game runs now, I am using the same profile as I did in the beginning *EDIT: I tried, the program can read all subdirectories (incl contents) in my homedir EDIT2: /etc/firejail/minecraft-launcher.profile is the original file, I made all modifications to a local file EDIT3: appearently I was in a sandboxed shell...
gitea-mirror commented 2026-05-05 09:40:16 -06:00
Author
Owner
Copy link

@kmk3 commented on GitHub (Dec 3, 2022):

@tzsz0 commented on Dec 2:

Install firejail (0.9.70), download minecraft-launcher from minecraft.net and
extract it to games/minecraft-launcher. Create file minecraft.local with
content

include /etc/firejail/minecraft-launcher.profile
whitelist ~/games/minecraft-launcher

Note that /etc/firejail/minecraft-launcher.profile already includes
minecraft-launcher.local at the beginning of the file.

So that include should either be removed or changed into something like the
following:

whitelist ~/games/minecraft-launcher

include ${CFG}/minecraft-launcher.local

Which includes /etc/firejail/minecraft-launcher.local if it exists. This way,
the commands in the profiles would effectively be executed in the following
order:

  1. ~/.config/firejail/minecraft-launcher.local
  2. /etc/firejail/minecraft-launcher.local
  3. /etc/firejail/minecraft-launcher.profile
<!-- gh-comment-id:1336121458 --> @kmk3 commented on GitHub (Dec 3, 2022): @tzsz0 commented [on Dec 2](https://github.com/netblue30/firejail/issues/5499#issue-1473162399): > Install firejail (0.9.70), download minecraft-launcher from minecraft.net and > extract it to games/minecraft-launcher. Create file minecraft.local with > content > > ``` > include /etc/firejail/minecraft-launcher.profile > whitelist ~/games/minecraft-launcher > ``` Note that /etc/firejail/minecraft-launcher.profile already includes minecraft-launcher.local at the beginning of the file. So that include should either be removed or changed into something like the following: > ``` > whitelist ~/games/minecraft-launcher > > include ${CFG}/minecraft-launcher.local > ``` Which includes /etc/firejail/minecraft-launcher.local if it exists. This way, the commands in the profiles would effectively be executed in the following order: 1. ~/.config/firejail/minecraft-launcher.local 2. /etc/firejail/minecraft-launcher.local 3. /etc/firejail/minecraft-launcher.profile
gitea-mirror commented 2026-05-05 09:40:17 -06:00
Author
Owner
Copy link

@kmk3 commented on GitHub (Dec 3, 2022):

To make sure that this does not have the same cause as #4961 (as mentioned
by @rusty-snake), does it work with the following in minecraft-launcher.local?

ignore nogroups
ignore noroot
ignore novideo
<!-- gh-comment-id:1336121618 --> @kmk3 commented on GitHub (Dec 3, 2022): To make sure that this does not have the same cause as #4961 (as [mentioned][1] by @rusty-snake), does it work with the following in minecraft-launcher.local? ``` ignore nogroups ignore noroot ignore novideo ``` [1]: https://github.com/netblue30/firejail/issues/5499#issuecomment-1335543073
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3016
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?