[GH-ISSUE #440] Unexpected behavior with Steam #316

New issue

Closed

opened 2026-05-05 05:35:32 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:35:32 -06:00

Owner

Originally created by @alexbakker on GitHub (Apr 16, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/440

When I '--join' the Steam process and list what's in my home directory, it appears I have access to the entire thing instead of what would be expected: only the directories with a noblacklist directive in steam.profile. Firejail works fine for me with other software. Am I doing something wrong here?

The steam.profile I'm using is the same as the default, but I'll paste it here for the record:

# Steam profile (applies to games/apps launched from Steam as well)
noblacklist ${HOME}/.steam
noblacklist ${HOME}/.local/share/steam
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc

caps.drop all
netfilter
noroot
seccomp
protocol unix,inet,inet6

I launch Steam with the following command:
firejail --env=LD_PRELOAD='/usr/$LIB/libstdc++.so.6' --env=DISPLAY=:0 /usr/bin/steam

And here's the output I get:

Reading profile /etc/firejail/steam.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Warning: user namespaces not available in the current kernel.
Parent pid 17607, child pid 17608
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted

Child process initialized
Running Steam on arch rolling 64-bit
STEAM_RUNTIME is enabled automatically
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element
Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element
Fontconfig warning: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 80: saw unknown, expected number
[0416/114534:ERROR:main_delegate.cc(777)] Could not load cef_extensions.pak
[0416/114534:ERROR:browser_main_loop.cc(203)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on.
Installing breakpad exception handler for appid(steamwebhelper)/version(20160415003031)
Installing breakpad exception handler for appid(steamwebhelper)/version(1460680231)
[0416/114534:ERROR:main_delegate.cc(777)] Could not load cef_extensions.pak
Installing breakpad exception handler for appid(steamwebhelper)/version(20160415003031)
Installing breakpad exception handler for appid(steamwebhelper)/version(1460682547)
Installing breakpad exception handler for appid(steamwebhelper)/version(1460682547)
[0416/114534:ERROR:nss_util.cc(740)] Error initializing NSS with a persistent database (sql:/home/alex/.pki/nssdb): NSS error code: -8174
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
Created shared memory when not owner SteamController_Shared_mem
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)

** (steam:98): WARNING **: Could not initialize NMClient /org/freedesktop/NetworkManager: Unit dbus-org.freedesktop.NetworkManager.service not found.
Installing breakpad exception handler for appid(steam)/version(1460682547)
Generating new string page texture 2: 48x256, total string texture memory is 49.15 KB
Generating new string page texture 3: 256x256, total string texture memory is 311.30 KB
Installing breakpad exception handler for appid(steam)/version(1460682547)
Installing breakpad exception handler for appid(steam)/version(1460682547)
roaming config store loaded successfully - 2702 bytes.
migrating temporary roaming config store
Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element
Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element
Fontconfig warning: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 80: saw unknown, expected number
Installing breakpad exception handler for appid(steam)/version(1460682547)
Failed to init SteamVR because it isn't installed
ExecCommandLine: ""/home/alex/.local/share/Steam/ubuntu12_32/steam" "
Installing breakpad exception handler for appid(steam)/version(1460682547)
System startup time: 13.24 seconds
Running Steam on arch rolling 64-bit
STEAM_RUNTIME has been set by the user to: /home/alex/.local/share/Steam/ubuntu12_32/steam-runtime

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.

(steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent.
Generating new string page texture 77: 1024x256, total string texture memory is 1.36 MB
Generating new string page texture 78: 128x256, total string texture memory is 131.07 KB
Generating new string page texture 79: 128x256, total string texture memory is 1.49 MB
Generating new string page texture 80: 64x256, total string texture memory is 1.56 MB
Generating new string page texture 81: 8x256, total string texture memory is 1.56 MB
Generating new string page texture 82: 32x256, total string texture memory is 1.60 MB
ExecCommandLine: "/home/alex/.steam/root/ubuntu12_32/steam steam://open/driverhelperready"
ExecSteamURL: "steam://open/driverhelperready"
Generating new string page texture 86: 128x256, total string texture memory is 1.73 MB
Generating new string page texture 87: 128x256, total string texture memory is 1.86 MB
Generating new string page texture 90: 512x256, total string texture memory is 2.38 MB
Generating new string page texture 91: 16x256, total string texture memory is 2.40 MB
Generating new string page texture 208: 256x256, total string texture memory is 393.22 KB
Generating new string page texture 209: 256x256, total string texture memory is 2.66 MB
Generating new string page texture 210: 128x256, total string texture memory is 2.79 MB

Originally created by @alexbakker on GitHub (Apr 16, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/440 When I '--join' the Steam process and list what's in my home directory, it appears I have access to the entire thing instead of what would be expected: only the directories with a noblacklist directive in steam.profile. Firejail works fine for me with other software. Am I doing something wrong here? The steam.profile I'm using is the same as the default, but I'll paste it here for the record: ``` # Steam profile (applies to games/apps launched from Steam as well) noblacklist ${HOME}/.steam noblacklist ${HOME}/.local/share/steam include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc caps.drop all netfilter noroot seccomp protocol unix,inet,inet6 ``` I launch Steam with the following command: `firejail --env=LD_PRELOAD='/usr/$LIB/libstdc++.so.6' --env=DISPLAY=:0 /usr/bin/steam` And here's the output I get: ``` Reading profile /etc/firejail/steam.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-passwdmgr.inc Warning: user namespaces not available in the current kernel. Parent pid 17607, child pid 17608 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Child process initialized Running Steam on arch rolling 64-bit STEAM_RUNTIME is enabled automatically Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element Fontconfig warning: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 80: saw unknown, expected number [0416/114534:ERROR:main_delegate.cc(777)] Could not load cef_extensions.pak [0416/114534:ERROR:browser_main_loop.cc(203)] Running without the SUID sandbox! See https://code.google.com/p/chromium/wiki/LinuxSUIDSandboxDevelopment for more information on developing with the sandbox on. Installing breakpad exception handler for appid(steamwebhelper)/version(20160415003031) Installing breakpad exception handler for appid(steamwebhelper)/version(1460680231) [0416/114534:ERROR:main_delegate.cc(777)] Could not load cef_extensions.pak Installing breakpad exception handler for appid(steamwebhelper)/version(20160415003031) Installing breakpad exception handler for appid(steamwebhelper)/version(1460682547) Installing breakpad exception handler for appid(steamwebhelper)/version(1460682547) [0416/114534:ERROR:nss_util.cc(740)] Error initializing NSS with a persistent database (sql:/home/alex/.pki/nssdb): NSS error code: -8174 Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) Created shared memory when not owner SteamController_Shared_mem Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) ** (steam:98): WARNING **: Could not initialize NMClient /org/freedesktop/NetworkManager: Unit dbus-org.freedesktop.NetworkManager.service not found. Installing breakpad exception handler for appid(steam)/version(1460682547) Generating new string page texture 2: 48x256, total string texture memory is 49.15 KB Generating new string page texture 3: 256x256, total string texture memory is 311.30 KB Installing breakpad exception handler for appid(steam)/version(1460682547) Installing breakpad exception handler for appid(steam)/version(1460682547) roaming config store loaded successfully - 2702 bytes. migrating temporary roaming config store Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element Fontconfig error: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 72: non-double matrix element Fontconfig warning: "/etc/fonts/conf.d/10-scale-bitmap-fonts.conf", line 80: saw unknown, expected number Installing breakpad exception handler for appid(steam)/version(1460682547) Failed to init SteamVR because it isn't installed ExecCommandLine: ""/home/alex/.local/share/Steam/ubuntu12_32/steam" " Installing breakpad exception handler for appid(steam)/version(1460682547) System startup time: 13.24 seconds Running Steam on arch rolling 64-bit STEAM_RUNTIME has been set by the user to: /home/alex/.local/share/Steam/ubuntu12_32/steam-runtime (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. (steam:98): LIBDBUSMENU-GLIB-WARNING **: Trying to remove a child that doesn't believe we're it's parent. Generating new string page texture 77: 1024x256, total string texture memory is 1.36 MB Generating new string page texture 78: 128x256, total string texture memory is 131.07 KB Generating new string page texture 79: 128x256, total string texture memory is 1.49 MB Generating new string page texture 80: 64x256, total string texture memory is 1.56 MB Generating new string page texture 81: 8x256, total string texture memory is 1.56 MB Generating new string page texture 82: 32x256, total string texture memory is 1.60 MB ExecCommandLine: "/home/alex/.steam/root/ubuntu12_32/steam steam://open/driverhelperready" ExecSteamURL: "steam://open/driverhelperready" Generating new string page texture 86: 128x256, total string texture memory is 1.73 MB Generating new string page texture 87: 128x256, total string texture memory is 1.86 MB Generating new string page texture 90: 512x256, total string texture memory is 2.38 MB Generating new string page texture 91: 16x256, total string texture memory is 2.40 MB Generating new string page texture 208: 256x256, total string texture memory is 393.22 KB Generating new string page texture 209: 256x256, total string texture memory is 2.66 MB Generating new string page texture 210: 128x256, total string texture memory is 2.79 MB ```

gitea-mirror

2026-05-05 05:35:32 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:35:37 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 16, 2016):

Steam uses a regular profile: all the files are available with the exception of blacklisted files, mainly password and encryption files. The blacklisted files and directories are replaced with empty files and directories, read-only and owned by root. So, in your --join session if you try to go to ~/.ssh directory, the sandbox wouldn't let you.

This is different than what we do for browsers, where the home directory is whitelisted, and only a few files are visible. We intend to do something similar for Steam.

@netblue30 commented on GitHub (Apr 16, 2016): Steam uses a regular profile: all the files are available with the exception of blacklisted files, mainly password and encryption files. The blacklisted files and directories are replaced with empty files and directories, read-only and owned by root. So, in your --join session if you try to go to ~/.ssh directory, the sandbox wouldn't let you. This is different than what we do for browsers, where the home directory is whitelisted, and only a few files are visible. We intend to do something similar for Steam.

gitea-mirror commented

2026-05-05 05:35:39 -06:00

Author

Owner

@alexbakker commented on GitHub (Apr 16, 2016):

Oh, I see. Misunderstanding on my part then.
Thanks!

@alexbakker commented on GitHub (Apr 16, 2016): Oh, I see. Misunderstanding on my part then. Thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#316

No description provided.

Rows
Columns