github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5572] vlc: program does not shutdown (AppArmor) #3031

New issue

Closed

opened 2026-05-05 09:40:49 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:40:49 -06:00

Owner

Originally created by @smitsohu on GitHub (Jan 5, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5572

Description

VLC does not terminate when it is closed.

Steps to Reproduce

Start VLC, then close it. Verify that the sandbox is still alive using firejail --tree.

$ firejail --tree
3208860:smitsohu::firejail vlc
  3208861:smitsohu::/usr/bin/xdg-dbus-proxy --fd=4 --args=5
  3208863:smitsohu::firejail vlc
    3208878:smitsohu::vlc

Behavior without a profile

VLC terminates when it is closed.

Additional context

From the syslog:

Jan 05 17:54:25 host audit[3208878]: AVC apparmor="DENIED" operation="signal" profile="firejail-default" pid=3208878 comm="vlc" requested_mask="send" denied_mask="send" signal=term peer="firejail-default//&unconfined"

firejail --ignore=apparmor vlc behaves as expected.

--deterministic-shutdown is no workaround, because apparently the issue is in VLC itself.

Environment

$ cat /etc/debian_version
11.6

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).

Originally created by @smitsohu on GitHub (Jan 5, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5572 ### Description VLC does not terminate when it is closed. ### Steps to Reproduce Start VLC, then close it. Verify that the sandbox is still alive using `firejail --tree`. ``` $ firejail --tree 3208860:smitsohu::firejail vlc 3208861:smitsohu::/usr/bin/xdg-dbus-proxy --fd=4 --args=5 3208863:smitsohu::firejail vlc 3208878:smitsohu::vlc ``` ### Behavior without a profile VLC terminates when it is closed. ### Additional context From the syslog: ``` Jan 05 17:54:25 host audit[3208878]: AVC apparmor="DENIED" operation="signal" profile="firejail-default" pid=3208878 comm="vlc" requested_mask="send" denied_mask="send" signal=term peer="firejail-default//&unconfined" ``` `firejail --ignore=apparmor vlc` behaves as expected. `--deterministic-shutdown` is no workaround, because apparently the issue is in VLC itself. ### Environment $ cat /etc/debian_version 11.6 ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate).

gitea-mirror

2026-05-05 09:40:49 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 09:40:52 -06:00

Author

Owner

@smitsohu commented on GitHub (Jan 5, 2023):

Sorry, this has been fixed already in #5317.

Instead, there is a small bug in the Makefile, that installs the firejail-default apparmor profile to /usr/local/etc/apprmor.d by default, where the AppArmor scripts won't find it. Or perhaps it is a bug in my understanding how this is supposed to work?

Anyways, closing again.

@smitsohu commented on GitHub (Jan 5, 2023): Sorry, this has been fixed already in #5317. Instead, there is a small bug in the Makefile, that installs the `firejail-default` apparmor profile to `/usr/local/etc/apprmor.d` by default, where the AppArmor scripts won't find it. Or perhaps it is a bug in my understanding how this is supposed to work? Anyways, closing again.

gitea-mirror commented

2026-05-05 09:40:53 -06:00

Author

Owner

@kmk3 commented on GitHub (Jan 5, 2023):

(Re-closing as "not planned" since nothing was changed in firejail)

@kmk3 commented on GitHub (Jan 5, 2023): (Re-closing as "not planned" since nothing was changed in firejail)

gitea-mirror commented

2026-05-05 09:40:53 -06:00

Author

Owner

@kmk3 commented on GitHub (Sep 2, 2024):

Fixed by #5317.

@kmk3 commented on GitHub (Sep 2, 2024): Fixed by #5317.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3031

No description provided.

Rows
Columns