[GH-ISSUE #6031] lximage-qt: Could not create AF_NETLINK socket (private-tmp)

gitea-mirror commented

2026-05-05 09:47:12 -06:00

Owner

Originally created by @glu8716 on GitHub (Oct 3, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6031

Description

LXImage-Qt doesn't start if Firejail is on with a "Could not create AF_NETLINK socket" error.

Steps to Reproduce

Run firejail lximage-qt.

Expected behavior

Program should start.

Actual behavior

Program doesn't start.

Behavior without a profile

If I start the program without Firejail it works.

Additional context

I haven't touched anything in the Firejail configs, it's the standard installation.

Environment

Linux distribution and version: Artix
Firejail version 0.9.72

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Reading profile /etc/firejail/lximage-qt.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 23205, child pid 23206
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/1000/gvfs
Child process initialized in 79.94 ms
Could not create AF_NETLINK socket (Operation not supported)
propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"
Could not create AF_NETLINK socket (Operation not supported)
Could not create AF_NETLINK socket (Operation not supported)
Could not create AF_NETLINK socket (Operation not supported)
Could not create AF_NETLINK socket (Operation not supported)

Parent is shutting down, bye...

Originally created by @glu8716 on GitHub (Oct 3, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6031  ### Description LXImage-Qt doesn't start if Firejail is on with a "Could not create AF_NETLINK socket" error. ### Steps to Reproduce 1. Run `firejail lximage-qt`. ### Expected behavior 2. Program should start. ### Actual behavior 3. Program doesn't start. ### Behavior without a profile If I start the program without Firejail it works. ### Additional context I haven't touched anything in the Firejail configs, it's the standard installation. ### Environment - Linux distribution and version: Artix - Firejail version 0.9.72 ### Checklist  - [X] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [X] I can reproduce the issue without custom modifications (e.g. globals.local). - [X] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [X] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [X] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log ``` Reading profile /etc/firejail/lximage-qt.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 23205, child pid 23206 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: not remounting /run/user/1000/gvfs Child process initialized in 79.94 ms Could not create AF_NETLINK socket (Operation not supported) propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n" nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n" "Object path cannot be empty" Could not create AF_NETLINK socket (Operation not supported) Could not create AF_NETLINK socket (Operation not supported) Could not create AF_NETLINK socket (Operation not supported) Could not create AF_NETLINK socket (Operation not supported) Parent is shutting down, bye... ```

gitea-mirror commented

2026-05-05 09:47:14 -06:00

Author

Owner

@ghost commented on GitHub (Oct 3, 2023):

f3fc98499f/etc/profile-a-l/lximage-qt.profile (L31)

Please test with the following:

$ cat ~/.config/firejail/lximage-qt.local
protocol unix,netlink

@ghost commented on GitHub (Oct 3, 2023): https://github.com/netblue30/firejail/blob/f3fc98499f5f068680545427ca222b3238be4002/etc/profile-a-l/lximage-qt.profile#L31 Please test with the following: ```sh $ cat ~/.config/firejail/lximage-qt.local protocol unix,netlink ```

gitea-mirror commented

2026-05-05 09:47:15 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 3, 2023):

The error about AF_NETLINK is gone, but the program still doesn't run.

Reading profile /etc/firejail/lximage-qt.profile
Reading profile /home/lorenzo/.config/firejail/lximage-qt.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 23848, child pid 23849
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/1000/gvfs
Child process initialized in 87.46 ms
propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"

Parent is shutting down, bye...

@glu8716 commented on GitHub (Oct 3, 2023): The error about AF_NETLINK is gone, but the program still doesn't run. ``` Reading profile /etc/firejail/lximage-qt.profile Reading profile /home/lorenzo/.config/firejail/lximage-qt.local Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 23848, child pid 23849 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: not remounting /run/user/1000/gvfs Child process initialized in 87.46 ms propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n" nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n" "Object path cannot be empty" Parent is shutting down, bye... ```

gitea-mirror commented

2026-05-05 09:47:15 -06:00

Author

Owner

@ghost commented on GitHub (Oct 3, 2023):

The error about AF_NETLINK is gone, but the program still doesn't run.

So we don't need netlink in the protocol, which is a good thing for a sandbox.

While you were testing I installed lximage-xt on my Arch Linux box. Here it starts and seems to work as expected. I also get those AF_NETLINK warnings but not the D-Bus related last lines from your output:

propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"

The lximage-qt profile doesn't restrict dbus (not even the system bus) so I'm not sure what's that about. What happens when you run firejail --noprofile /usr/bin/lximage-qt?

@ghost commented on GitHub (Oct 3, 2023): > The error about AF_NETLINK is gone, but the program still doesn't run. So we don't need netlink in the protocol, which is a good thing for a sandbox. While you were testing I installed lximage-xt on my Arch Linux box. Here it starts and seems to work as expected. I also get those AF_NETLINK warnings but not the D-Bus related last lines from your output: ``` propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n" nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n" "Object path cannot be empty" ``` The lximage-qt profile doesn't restrict dbus (not even the system bus) so I'm not sure what's that about. What happens when you run `firejail --noprofile /usr/bin/lximage-qt`?

gitea-mirror commented

2026-05-05 09:47:16 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 3, 2023):

If I run firejail --noprofile /usr/bin/lximage-qt the program starts fine. Those two error messages are still present, but the program works.

Parent pid 1981, child pid 1982
Child process initialized in 5.37 ms
propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"

@glu8716 commented on GitHub (Oct 3, 2023): If I run `firejail --noprofile /usr/bin/lximage-qt` the program starts fine. Those two error messages are still present, but the program works. ``` Parent pid 1981, child pid 1982 Child process initialized in 5.37 ms propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n" nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n" "Object path cannot be empty" ```

gitea-mirror commented

2026-05-05 09:47:17 -06:00

Author

Owner

@ghost commented on GitHub (Oct 3, 2023):

Odd. But I'm not familiar with Artix, especially not regarding its D-Bus functionality. Perhaps @kmk3 can assist, IIRC they're on Artix too. Is DBUS_SESSION_BUS_ADDRESS exported correctly? Is the user socket actually created on your system? Apologies for not being more helpfull, but for now I just cannot reproduce.

@ghost commented on GitHub (Oct 3, 2023): Odd. But I'm not familiar with Artix, especially not regarding its D-Bus functionality. Perhaps @kmk3 can assist, IIRC they're on Artix too. Is DBUS_SESSION_BUS_ADDRESS exported correctly? Is the user socket actually created on your system? Apologies for not being more helpfull, but for now I just cannot reproduce.

gitea-mirror commented

2026-05-05 09:47:17 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 3, 2023):

Don't worry, thanks for the help!

The env output shows the following:
DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-JiaSDiRKLG,guid=5d2afdf9a5c32fa92f9c8cb8651ae04e
The file is actually there. Don't know if this is normal as I'm not an expert user.

@glu8716 commented on GitHub (Oct 3, 2023): Don't worry, thanks for the help! The `env` output shows the following: `DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-JiaSDiRKLG,guid=5d2afdf9a5c32fa92f9c8cb8651ae04e` The file is actually there. Don't know if this is normal as I'm not an expert user.

gitea-mirror commented

2026-05-05 09:47:18 -06:00

Author

Owner

@ghost commented on GitHub (Oct 3, 2023):

DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-JiaSDiRKLG,guid=5d2afdf9a5c32fa92f9c8cb8651ae04e

That might explain things. There's a private-tmp in lximage-xt.profile. Usually the DBUS_SESSION_BUS_ADDRESS points to /run/user/1000/bus. Well, usually might be to strong, but it is what Firejail assumes AFAICT, in ${RUNUSER}. So try ignore private-tmp to confirm that does fix it. If so I'd suggest trying to change whatever Artix uses to set DBUS_SESSION_BUS_ADDRESS to a path under /tmp. There's probably more profiles that could break similarly.

@ghost commented on GitHub (Oct 3, 2023): > DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-JiaSDiRKLG,guid=5d2afdf9a5c32fa92f9c8cb8651ae04e That might explain things. There's a `private-tmp` in lximage-xt.profile. Usually the DBUS_SESSION_BUS_ADDRESS points to /run/user/1000/bus. Well, usually might be to strong, but it is what Firejail assumes AFAICT, in ${RUNUSER}. So try `ignore private-tmp` to confirm that does fix it. If so I'd suggest trying to change whatever Artix uses to set DBUS_SESSION_BUS_ADDRESS to a path under /tmp. There's probably more profiles that could break similarly.

gitea-mirror commented

2026-05-05 09:47:19 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 3, 2023):

You are right, adding ignore private-tmp works! Thanks a lot =)
As for the dbus path I honestly have no idea as I've never dealt with it. It might not be Artix but the init system (I use s6) or SDDM (I know SDDM uses the /tmp folder for the XAUTHORITY file too for example).
Anyway I've only had this problem with the lximage-qt profile so far, so if I only have to add an exception for it it's not a big deal I guess.

@glu8716 commented on GitHub (Oct 3, 2023): You are right, adding `ignore private-tmp` works! Thanks a lot =) As for the dbus path I honestly have no idea as I've never dealt with it. It might not be Artix but the init system (I use s6) or SDDM (I know SDDM uses the /tmp folder for the XAUTHORITY file too for example). Anyway I've only had this problem with the lximage-qt profile so far, so if I only have to add an exception for it it's not a big deal I guess.

gitea-mirror commented

2026-05-05 09:47:20 -06:00

Author

Owner

@kmk3 commented on GitHub (Oct 4, 2023):

As for the dbus path I honestly have no idea as I've never dealt with it. It
might not be Artix but the init system (I use s6) or SDDM (I know SDDM uses
the /tmp folder for the XAUTHORITY file too for example).

The socket also appears on /tmp for me with dwm on Artix.

My guess: dbus is started before whatever it is that sets up
$XDG_RUNTIME_DIR, so it falls back to /tmp.

I think that (e)logind is supposed to do this.

The dbus package appears to depend on (e)logind while the elogind service
depends on (/starts before) dbus, which could explain the issue.

Though I'm not sure and I don't really use dbus.

If anyone finds out more details about this, feel free to post here.

@kmk3 commented on GitHub (Oct 4, 2023): > As for the dbus path I honestly have no idea as I've never dealt with it. It > might not be Artix but the init system (I use s6) or SDDM (I know SDDM uses > the /tmp folder for the XAUTHORITY file too for example). The socket also appears on /tmp for me with dwm on Artix. My guess: dbus is started before whatever it is that sets up `$XDG_RUNTIME_DIR`, so it falls back to /tmp. I think that (e)logind is supposed to do this. The dbus package appears to depend on (e)logind while the elogind service depends on (/starts before) dbus, which could explain the issue. Though I'm not sure and I don't really use dbus. If anyone finds out more details about this, feel free to post here.

gitea-mirror commented

2026-05-05 09:47:20 -06:00

Author

Owner

@ghost commented on GitHub (Oct 4, 2023):

Anyway I've only had this problem with the lximage-qt profile so far, so if I only have to add an exception for it it's not a big deal I guess.

That's nice. At least you're aware of this now. Thanks a lot for bringing all this to our attention!

@ghost commented on GitHub (Oct 4, 2023): > Anyway I've only had this problem with the lximage-qt profile so far, so if I only have to add an exception for it it's not a big deal I guess. That's nice. At least you're aware of this now. Thanks a lot for bringing all this to our attention!