github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5891] libreoffice: cannot open a second document alsongside with the first one ("shell none") #3122

New issue

Open

opened 2026-05-05 09:45:30 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:45:30 -06:00

Owner

Originally created by @Kalle72 on GitHub (Jul 10, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5891

Libreoffice does not open a second document alongside with a first one.

Steps to reprocude:
Dubble-click a document --> document opens --> dubbleclick a second document --> second document does not open (nothing happens except the mouse-arrow shows the clock for some seconds).

Workaround until now: set "noroot" and "shell none" in the libreoffice.profile.
Unfortunately "shell none" is now set by default and cannot be disabled anymore. Therefore the workaround does also not work anymore.

If I use the terminal I get for the first file the following output:
~/Desktop$ libreoffice test1.odt Reading profile /etc/firejail/libreoffice.profile Reading profile /etc/firejail/allow-java.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 15635, child pid 15636 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: not remounting /run/user/1000/gvfs Child process initialized in 137.85 ms
then the document is open.

When opening the second document I get:
~/Desktop$ libreoffice test2.odt Reading profile /etc/firejail/libreoffice.profile Reading profile /etc/firejail/allow-java.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Switching to pid 15636, the first child process inside the sandbox Changing root to /proc/15636/root Error: --shell=none configured, but no program specified
(I use usr/local/bin/libreoffice to invoke firejail libreoffice. I do this with all firejailed programs in use.)

Kind regards
Kalle

PS: I am on Gentoo and use the current firejail release: 0.9.72.
PPS: Other firejailed "writing-software" works (i.e. softmaker-freeoffice)
PPPS: The libreoffice-probelm occurs since I stated to use firejail (over 5 years ago.), but the workaround solved I until now.

Originally created by @Kalle72 on GitHub (Jul 10, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/5891 Libreoffice does not open a second document alongside with a first one. Steps to reprocude: Dubble-click a document --> document opens --> dubbleclick a second document --> second document does not open (nothing happens except the mouse-arrow shows the clock for some seconds). Workaround until now: set "noroot" and "shell none" in the libreoffice.profile. Unfortunately "shell none" is now set by default and cannot be disabled anymore. Therefore the workaround does also not work anymore. If I use the terminal I get for the first file the following output: `~/Desktop$ libreoffice test1.odt Reading profile /etc/firejail/libreoffice.profile Reading profile /etc/firejail/allow-java.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 15635, child pid 15636 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: not remounting /run/user/1000/gvfs Child process initialized in 137.85 ms ` then the document is open. When opening the second document I get: `~/Desktop$ libreoffice test2.odt Reading profile /etc/firejail/libreoffice.profile Reading profile /etc/firejail/allow-java.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Switching to pid 15636, the first child process inside the sandbox Changing root to /proc/15636/root Error: --shell=none configured, but no program specified ` (I use usr/local/bin/libreoffice to invoke firejail libreoffice. I do this with all firejailed programs in use.) Kind regards Kalle PS: I am on Gentoo and use the current firejail release: 0.9.72. PPS: Other firejailed "writing-software" works (i.e. softmaker-freeoffice) PPPS: The libreoffice-probelm occurs since I stated to use firejail (over 5 years ago.), but the workaround solved I until now.

gitea-mirror added the

bug

label 2026-05-05 09:45:30 -06:00

gitea-mirror commented

2026-05-05 09:45:32 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 10, 2023):

Maybe a bug with join-or-start.

Maybe a duplicated of #5598.

@rusty-snake commented on GitHub (Jul 10, 2023): Maybe a bug with join-or-start. Maybe a duplicated of #5598.

gitea-mirror commented

2026-05-05 09:45:33 -06:00

Author

Owner

@ghost commented on GitHub (Jul 10, 2023):

Workaround until now: set "noroot" and "shell none" in the libreoffice.profile.
Unfortunately "shell none" is now set by default and cannot be disabled anymore. Therefore the workaround does also not work anymore.

Off-topic

7462580810/src/firejail/profile.c (L374-L377)

We still have a few files referencing shell none. Maybe it's a good idea to clean those up before cutting a new release.

@ghost commented on GitHub (Jul 10, 2023): > Workaround until now: set "noroot" and "shell none" in the libreoffice.profile. Unfortunately "shell none" is now set by default and cannot be disabled anymore. Therefore the workaround does also not work anymore. Off-topic https://github.com/netblue30/firejail/blob/746258081030a23c9a1e44db576819f5756c5f2c/src/firejail/profile.c#L374-L377 We still have a few files referencing `shell none`. Maybe it's a good idea to clean those up before cutting a new release.

gitea-mirror commented

2026-05-05 09:45:34 -06:00

Author

Owner

@Kalle72 commented on GitHub (Jul 13, 2023):

@rusty-snake: True story: the profile has a "join-or-start libreoffice" line. Additionally I share the Error:--shell=none configured, but no program specified with the bug "5598" mentioned.

@Kalle72 commented on GitHub (Jul 13, 2023): @rusty-snake: True story: the profile has a "join-or-start libreoffice" line. Additionally I share the `Error:--shell=none configured, but no program specified` with the bug "5598" mentioned.

gitea-mirror commented

2026-05-05 09:45:35 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 13, 2023):

Marking it as a bug, thanks @Kalle72

Question: why do you need to disable noroot?

noroot is used to prevent the program from rising privileges. For example ping:

$ firejail --noroot ping 1.1.1.1
/usr/bin/ping: socktype: SOCK_RAW
/usr/bin/ping: socket: Operation not permitted
/usr/bin/ping: => missing cap_net_raw+p capability or setuid?

ping tries to open a raw socket, which is a privileged operation; noroot prevents the escalation; ping complains suggesting the program should be installed with cap_net_raw capability or SUID.

Do you have some SUID program being called by libreoffice?

@netblue30 commented on GitHub (Jul 13, 2023): Marking it as a bug, thanks @Kalle72 Question: why do you need to disable noroot? noroot is used to prevent the program from rising privileges. For example ping: ````` $ firejail --noroot ping 1.1.1.1 /usr/bin/ping: socktype: SOCK_RAW /usr/bin/ping: socket: Operation not permitted /usr/bin/ping: => missing cap_net_raw+p capability or setuid? ````` ping tries to open a raw socket, which is a privileged operation; noroot prevents the escalation; ping complains suggesting the program should be installed with cap_net_raw capability or SUID. Do you have some SUID program being called by libreoffice?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3122

No description provided.

Rows
Columns