[GH-ISSUE #5696] microsoft-edge-stable: cannot launch with default profile

gitea-mirror commented

2026-05-05 09:42:36 -06:00

Owner

Originally created by @GreatBigWhiteWorld on GitHub (Feb 28, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5696

firejail version 0.9.70

firejail /usr/bin/microsoft-edge-stable
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 20480, child pid 20481
Child process initialized in 87.36 ms
Check failed: sys_chroot("/proc/self/fdinfo/") == 0
[1:1:0228/110906.572857:ERROR:nacl_fork_delegate_linux.cc(313)] Bad NaCl helper startup ack (0 bytes)
Check failed: sys_chroot("/proc/self/fdinfo/") == 0
[0228/110906.574720:ERROR:scoped_ptrace_attach.cc(27)] ptrace: Operation not permitted (1)

Parent is shutting down, bye...

Any hint?

Edit: It's strange that the default profile only had microsoft-edge while the app was called microsoft-edge-stable
So creating a profile under ~/.config/firejail/ for microsoft-edge-stable with the content of microsoft-edge profile fixed it.

Originally created by @GreatBigWhiteWorld on GitHub (Feb 28, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5696 firejail version 0.9.70 ``` firejail /usr/bin/microsoft-edge-stable Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc ** Note: you can use --noprofile to disable default.profile ** Parent pid 20480, child pid 20481 Child process initialized in 87.36 ms Check failed: sys_chroot("/proc/self/fdinfo/") == 0 [1:1:0228/110906.572857:ERROR:nacl_fork_delegate_linux.cc(313)] Bad NaCl helper startup ack (0 bytes) Check failed: sys_chroot("/proc/self/fdinfo/") == 0 [0228/110906.574720:ERROR:scoped_ptrace_attach.cc(27)] ptrace: Operation not permitted (1) Parent is shutting down, bye... ``` Any hint? Edit: It's strange that the default profile only had **microsoft-edge** while the app was called **microsoft-edge-stable** So creating a profile under ~/.config/firejail/ for **microsoft-edge-stable** with the content of **microsoft-edge** profile fixed it.

gitea-mirror

2026-05-05 09:42:36 -06:00

closed this issue
added the
needinfo
label

gitea-mirror commented

2026-05-05 09:42:38 -06:00

Author

Owner

@ghost commented on GitHub (Feb 28, 2023):

firejail version 0.9.70

Should be unrelated to this, but still, try to upgrade to the latest stable release, which is 0.9.72 at the time of writing.

The issue seems to be caused by a missing profile for microsoft-edge-stable, and Firejail falls back to its default.profile (which isn't suited for a chromium-based web browser like edge). We do have microsoft-edge, microsoft-edge-beta and microsoft-edge-dev. If you could try placing the below in ~/.config/firejail/microsoft-edge-stable.profile and trying again, we can fix this:

# Firejail profile for Microsoft Edge Stable
# Description: Web browser from Microsoft, stable channel
# This file is overwritten after every install/update
# Persistent local customizations
include microsoft-edge-stable.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.cache/microsoft-edge-stable
noblacklist ${HOME}/.config/microsoft-edge-stable

mkdir ${HOME}/.cache/microsoft-edge-stable
mkdir ${HOME}/.config/microsoft-edge-stable
whitelist ${HOME}/.cache/microsoft-edge-stable
whitelist ${HOME}/.config/microsoft-edge-stable

whitelist /opt/microsoft/msedge-stable

# Redirect
include chromium-common.profile

@ghost commented on GitHub (Feb 28, 2023): > firejail version 0.9.70 Should be unrelated to this, but still, try to upgrade to the latest stable release, which is [0.9.72](https://github.com/netblue30/firejail/releases/tag/0.9.72) at the time of writing. The issue seems to be caused by a missing profile for `microsoft-edge-stable`, and Firejail falls back to its `default.profile` (which isn't suited for a chromium-based web browser like edge). We do have microsoft-edge, microsoft-edge-beta and microsoft-edge-dev. If you could try placing the below in ~/.config/firejail/microsoft-edge-stable.profile and trying again, we can fix this: ``` # Firejail profile for Microsoft Edge Stable # Description: Web browser from Microsoft, stable channel # This file is overwritten after every install/update # Persistent local customizations include microsoft-edge-stable.local # Persistent global definitions include globals.local noblacklist ${HOME}/.cache/microsoft-edge-stable noblacklist ${HOME}/.config/microsoft-edge-stable mkdir ${HOME}/.cache/microsoft-edge-stable mkdir ${HOME}/.config/microsoft-edge-stable whitelist ${HOME}/.cache/microsoft-edge-stable whitelist ${HOME}/.config/microsoft-edge-stable whitelist /opt/microsoft/msedge-stable # Redirect include chromium-common.profile ```

gitea-mirror commented

2026-05-05 09:42:39 -06:00

Author

Owner

@ghost commented on GitHub (Feb 28, 2023):

Edit: It's strange that the default profile only had microsoft-edge while the app was called microsoft-edge-stable
So creating a profile under ~/.config/firejail/ for microsoft-edge-stable with the content of microsoft-edge profile fixed it.

Yeah, that's what I was thinking. Re-opened because we should fix this by adding such microsoft-edge-stable.profile. Can you confirm you have a working sandbox when using the options from microsoft-edge.profile and not the ones like in my post above? In that case the stable channel might have renamed its binary only, and we can edit things accordingly.

Thanks for opening this, it's valuable info!

@ghost commented on GitHub (Feb 28, 2023): > Edit: It's strange that the default profile only had microsoft-edge while the app was called microsoft-edge-stable So creating a profile under ~/.config/firejail/ for microsoft-edge-stable with the content of microsoft-edge profile fixed it. Yeah, that's what I was thinking. Re-opened because we should fix this by adding such `microsoft-edge-stable.profile`. Can you confirm you have a working sandbox when using the options from `microsoft-edge.profile` and not the ones like in my post above? In that case the stable channel might have renamed its binary only, and we can edit things accordingly. Thanks for opening this, it's valuable info!

gitea-mirror commented

2026-05-05 09:42:40 -06:00

Author

Owner

@GreatBigWhiteWorld commented on GitHub (Feb 28, 2023):

Hi, thanks for the input.
Well, I just happened to run into another issue: the browser can't remember its last running session at all.
It always launches like I have just installed it: welcome screen, MS account sync login. Everything is lost after closing the browser.
I did recreate the microsoft-edge-stable.profile using the content in your previous post since it's more accurate than the microsoft-edge-dev.profile.

Any idea?

@GreatBigWhiteWorld commented on GitHub (Feb 28, 2023): Hi, thanks for the input. Well, I just happened to run into another issue: the browser can't remember its last running session at all. It always launches like I have just installed it: welcome screen, MS account sync login. Everything is lost after closing the browser. I did recreate the microsoft-edge-stable.profile using the content in your previous post since it's more accurate than the microsoft-edge-dev.profile. Any idea?

gitea-mirror commented

2026-05-05 09:42:40 -06:00

Author

Owner

@ghost commented on GitHub (Feb 28, 2023):

Hmm, might have to do with the noblacklist, mkdir, whitelist routine. In my previous post I used microsoft-edge-stable for all 3. But perhaps this is incorrect and the stable channel still uses microsoft-edge. Can you try moving anything vital you have out of the way and start with a fresh profile? That should at least clear up which ~/.cache and ~/.configure subfolder it is using.

I'm in the middle of downloading the stable, beta and dev channel versions on my machine to check as well. Will keep you updated on that here.

@ghost commented on GitHub (Feb 28, 2023): Hmm, might have to do with the noblacklist, mkdir, whitelist routine. In my previous post I used `microsoft-edge-stable` for all 3. But perhaps this is incorrect and the stable channel still uses `microsoft-edge`. Can you try moving anything vital you have out of the way and start with a fresh profile? That should at least clear up which ~/.cache and ~/.configure subfolder it is using. I'm in the middle of downloading the stable, beta and dev channel versions on my machine to check as well. Will keep you updated on that here.

gitea-mirror commented

2026-05-05 09:42:41 -06:00

Author

Owner

@ghost commented on GitHub (Feb 28, 2023):

UPDATE: Here's my test results. I can get a hardened, fully working sandbox for the stable channel version with the below (redirect) profile. I also noticed msedge uses its own name for the browser's internal sandbox and added that in too (so not chrome-sandbox what our current profiles assume). Latest running session and other configuration changes are respected, so I guess this will suffice.

$ cat ~/.config/firejail/disable-common.local
# Firejail :: persistent local customizations for disable-common.inc

blacklist /opt/microsoft/msedge/msedge-sandbox

$ cat ~/.config/firejail/microsoft-edge-stable.profile
# Firejail profile for Microsoft Edge Stable
# Description: Web browser from Microsoft, stable channel
# This file is overwritten after every install/update
# Persistent local customizations
include microsoft-edge-stable.local
# Persistent global definitions
# added by included profile
#include globals.local

private-opt microsoft

# msedge uses msedge-sandbox instead of chrome-sandbox
noblacklist /opt/microsoft/msedge/msedge-sandbox
ignore noblacklist /usr/lib/chromium/chrome-sandbox

# Redirect
include microsoft-edge.profile

Take all the time you need to test with these updated files. We can bring in the needed changes later. For now we should focus on getting your browsing restored to what you're used to, all included.

@ghost commented on GitHub (Feb 28, 2023): UPDATE: Here's my test results. I can get a hardened, fully working sandbox for the stable channel version with the below (redirect) profile. I also noticed msedge uses its own name for the browser's internal sandbox and added that in too (so not chrome-sandbox what our current profiles assume). Latest running session and other configuration changes are respected, so I guess this will suffice. ```console $ cat ~/.config/firejail/disable-common.local # Firejail :: persistent local customizations for disable-common.inc blacklist /opt/microsoft/msedge/msedge-sandbox ``` ```console $ cat ~/.config/firejail/microsoft-edge-stable.profile # Firejail profile for Microsoft Edge Stable # Description: Web browser from Microsoft, stable channel # This file is overwritten after every install/update # Persistent local customizations include microsoft-edge-stable.local # Persistent global definitions # added by included profile #include globals.local private-opt microsoft # msedge uses msedge-sandbox instead of chrome-sandbox noblacklist /opt/microsoft/msedge/msedge-sandbox ignore noblacklist /usr/lib/chromium/chrome-sandbox # Redirect include microsoft-edge.profile ``` Take all the time you need to test with these updated files. We can bring in the needed changes later. For now we should focus on getting your browsing restored to what you're used to, all included.

gitea-mirror commented

2026-05-05 09:42:42 -06:00

Author

Owner

@kmk3 commented on GitHub (Feb 28, 2023):

@GreatBigWhiteWorld on Feb 28:

Hi, thanks for the input. Well, I just happened to run into another issue:
the browser can't remember its last running session at all. It always
launches like I have just installed it: welcome screen, MS account sync
login. Everything is lost after closing the browser. I did recreate the
microsoft-edge-stable.profile using the content in your previous post since
it's more accurate than the microsoft-edge-dev.profile.

Any idea?

It could be that this version uses different names for its directories, such as
~/.config/microsoft-edge-stable instead of ~/.config/microsoft-edge or
vice-versa.

The directories that it creates can be checked by running it in a temporary
home with --private.

What is the output of the following?

firejail --name=edge --private /usr/bin/microsoft-edge-stable

# (in another shell)
firejail --join=edge sh -c \
  'find "$HOME" -maxdepth 2 | LC_ALL=C sort | grep microsoft'

@kmk3 commented on GitHub (Feb 28, 2023): @GreatBigWhiteWorld [on Feb 28](https://github.com/netblue30/firejail/issues/5696#issuecomment-1447565126): > Hi, thanks for the input. Well, I just happened to run into another issue: > the browser can't remember its last running session at all. It always > launches like I have just installed it: welcome screen, MS account sync > login. Everything is lost after closing the browser. I did recreate the > microsoft-edge-stable.profile using the content in your previous post since > it's more accurate than the microsoft-edge-dev.profile. > > Any idea? It could be that this version uses different names for its directories, such as `~/.config/microsoft-edge-stable` instead of `~/.config/microsoft-edge` or vice-versa. The directories that it creates can be checked by running it in a temporary home with `--private`. What is the output of the following? ```sh firejail --name=edge --private /usr/bin/microsoft-edge-stable # (in another shell) firejail --join=edge sh -c \ 'find "$HOME" -maxdepth 2 | LC_ALL=C sort | grep microsoft' ```

gitea-mirror commented

2026-05-05 09:42:43 -06:00

Author

Owner

@GreatBigWhiteWorld commented on GitHub (Feb 28, 2023):

@kmk3

firejail --join=edge sh -c \
>   'find "$HOME" -maxdepth 2 | LC_ALL=C sort | grep microsoft'
Switching to pid 18104, the first child process inside the sandbox
Changing root to /proc/18104/root
Child process initialized in 1.87 ms
~/.cache/microsoft-edge
~/.config/microsoft-edge
~/.config/microsoft-edge-stable

@glitsj16
If I copy your disable-common.local and microsoft-edge-stable to .config/firejail. The issue (not remebering previous session) persists. In my noobie opinion, your redirect to microsoft-edge.profile doesn't make sense because it redirects to microsoft-edge-dev.profile again, which doesn't whitelist

~/.cache/microsoft-edge
~/.config/microsoft-edge
~/.config/microsoft-edge-stable

So I added these whitelist in the .config/firejail/microsoft-edge-stable.profile, and I changed the redirect back to chromium-common.profile
What's the disable-common.profile do? It seems not included anywhere?

@GreatBigWhiteWorld commented on GitHub (Feb 28, 2023): @kmk3 ``` firejail --join=edge sh -c \ > 'find "$HOME" -maxdepth 2 | LC_ALL=C sort | grep microsoft' Switching to pid 18104, the first child process inside the sandbox Changing root to /proc/18104/root Child process initialized in 1.87 ms ~/.cache/microsoft-edge ~/.config/microsoft-edge ~/.config/microsoft-edge-stable ``` @glitsj16 If I copy your disable-common.local and microsoft-edge-stable to .config/firejail. The issue (not remebering previous session) persists. In my noobie opinion, your redirect to microsoft-edge.profile doesn't make sense because it redirects to microsoft-edge-dev.profile again, which doesn't whitelist ``` ~/.cache/microsoft-edge ~/.config/microsoft-edge ~/.config/microsoft-edge-stable ``` So I added these whitelist in the .config/firejail/microsoft-edge-stable.profile, and I changed the redirect back to **chromium-common.profile** What's the disable-common.profile do? It seems not included anywhere?

gitea-mirror commented

2026-05-05 09:42:43 -06:00

Author

Owner

@ghost commented on GitHub (Feb 28, 2023):

In my noobie opinion, your redirect to microsoft-edge.profile doesn't make sense because it redirects to microsoft-edge-dev.profile again, which doesn't whitelist

That's very odd. Nothing redirects to microsoft-edge-dev.profile. At least not for me. The relevant profiles all redirect to chromium-common.profile, as they should. Please double-check your setup.

What's the disable-common.profile do? It seems not included anywhere?

That's disable-common.inc, not disable-common.profile. It's a vital part of how Firejail works. All files referenced in there are blacklisted, meaning they won't be part of the resulting sandbox. A specific counterpart option (noblacklist foo) is included in a application-specific profile when something needs to be accessible inside the sandbox. Same goes for the other main disable-xxx.inc files.

@ghost commented on GitHub (Feb 28, 2023): > In my noobie opinion, your redirect to microsoft-edge.profile doesn't make sense because it redirects to microsoft-edge-dev.profile again, which doesn't whitelist That's very odd. `Nothing` redirects to `microsoft-edge-dev.profile`. At least not for me. The relevant profiles all redirect to `chromium-common.profile`, as they should. Please double-check your setup. > What's the disable-common.profile do? It seems not included anywhere? That's [disable-common.inc](https://github.com/netblue30/firejail/blob/master/etc/inc/disable-common.inc), not disable-common.profile. It's a vital part of how Firejail works. All files referenced in there are blacklisted, meaning they won't be part of the resulting sandbox. A specific counterpart option (noblacklist foo) is included in a application-specific profile when something needs to be accessible inside the sandbox. Same goes for the other main disable-xxx.inc files.

gitea-mirror commented

2026-05-05 09:42:44 -06:00

Author

Owner

@GreatBigWhiteWorld commented on GitHub (Feb 28, 2023):

That's very odd. Nothing redirects to microsoft-edge-dev.profile. At least not for me. The relevant profiles all redirect to chromium-common.profile, as they should. Please double-check your setup.

Here's the content of the default microsoft-edge.profile on my machine:

cat /etc/firejail/microsoft-edge.profile 
# Firejail profile for Microsoft Edge
# Description: Web browser from Microsoft
# This file is overwritten after every install/update
# Persistent local customizations
include microsoft-edge.local
# Persistent global definitions
# added by included profile
#include globals.local

# Redirect
include microsoft-edge-dev.profile

It has nothing but redirects to dev.profile, which by default has the content:

cat /etc/firejail/microsoft-edge-dev.profile 
# Firejail profile for Microsoft Edge Dev
# Description: Web browser from Microsoft,dev channel
# This file is overwritten after every install/update
# Persistent local customizations
include microsoft-edge-dev.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.cache/microsoft-edge-dev
noblacklist ${HOME}/.config/microsoft-edge-dev

mkdir ${HOME}/.cache/microsoft-edge-dev
mkdir ${HOME}/.config/microsoft-edge-dev
whitelist ${HOME}/.cache/microsoft-edge-dev
whitelist ${HOME}/.config/microsoft-edge-dev

private-opt microsoft

# Redirect
include chromium-common.profile

@GreatBigWhiteWorld commented on GitHub (Feb 28, 2023): > That's very odd. `Nothing` redirects to `microsoft-edge-dev.profile`. At least not for me. The relevant profiles all redirect to `chromium-common.profile`, as they should. Please double-check your setup. > Here's the content of the default microsoft-edge.profile on my machine: ``` cat /etc/firejail/microsoft-edge.profile # Firejail profile for Microsoft Edge # Description: Web browser from Microsoft # This file is overwritten after every install/update # Persistent local customizations include microsoft-edge.local # Persistent global definitions # added by included profile #include globals.local # Redirect include microsoft-edge-dev.profile ``` It has nothing but redirects to dev.profile, which by default has the content: ``` cat /etc/firejail/microsoft-edge-dev.profile # Firejail profile for Microsoft Edge Dev # Description: Web browser from Microsoft,dev channel # This file is overwritten after every install/update # Persistent local customizations include microsoft-edge-dev.local # Persistent global definitions include globals.local noblacklist ${HOME}/.cache/microsoft-edge-dev noblacklist ${HOME}/.config/microsoft-edge-dev mkdir ${HOME}/.cache/microsoft-edge-dev mkdir ${HOME}/.config/microsoft-edge-dev whitelist ${HOME}/.cache/microsoft-edge-dev whitelist ${HOME}/.config/microsoft-edge-dev private-opt microsoft # Redirect include chromium-common.profile ```

gitea-mirror commented

2026-05-05 09:42:45 -06:00

Author

Owner

@ghost commented on GitHub (Feb 28, 2023):

Wow, I didn't check the history of the msedge profiles. You're correct, 0.9.70 does have that unexpected include, as can be seen here. Upgrade your Firejail installation if you can, there might be other fixed bugs and important changes.

@ghost commented on GitHub (Feb 28, 2023): Wow, I didn't check the history of the msedge profiles. You're correct, 0.9.70 does have that unexpected include, as can be seen [here](https://github.com/netblue30/firejail/commits/master/etc/profile-m-z/microsoft-edge.profile). Upgrade your Firejail installation if you can, there might be other fixed bugs and important changes.

gitea-mirror commented

2026-05-05 09:42:45 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 5, 2023):

From what I understand #5697 should have fixed some of these issues.

@GreatBigWhiteWorld

Can you build/install firejail from master and see if you can still reproduce
the issues?

Also, what distribution are you using?

@kmk3 commented on GitHub (Apr 5, 2023): From what I understand #5697 should have fixed some of these issues. @GreatBigWhiteWorld Can you build/install firejail from master and see if you can still reproduce the issues? Also, what distribution are you using?

gitea-mirror commented

2026-05-05 09:42:46 -06:00

Author

Owner

@GreatBigWhiteWorld commented on GitHub (Apr 17, 2023):

From what I understand #5697 should have fixed some of these issues.

@GreatBigWhiteWorld

Can you build/install firejail from master and see if you can still reproduce the issues?

Also, what distribution are you using?

Sorry but I'm no longer in an environment to test that. I guess it was due to an older version of firejail and would not be an issue in newer versions.

@GreatBigWhiteWorld commented on GitHub (Apr 17, 2023): > From what I understand #5697 should have fixed some of these issues. > > @GreatBigWhiteWorld > > Can you build/install firejail from master and see if you can still reproduce the issues? > > Also, what distribution are you using? Sorry but I'm no longer in an environment to test that. I guess it was due to an older version of firejail and would not be an issue in newer versions.

Rows
Columns

[GH-ISSUE #5696] microsoft-edge-stable: cannot launch with default profile #3067