[GH-ISSUE #6034] nicotine: cannot start with fcitx dbus entries enabled

gitea-mirror commented

2026-05-05 09:47:23 -06:00

Owner

Originally created by @glu8716 on GitHub (Oct 5, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6034

Description

According to the FAQ page if the dbus policy of the profile is set to none, in order to have Fcitx working you need to add

dbus-user filter
dbus-user.talk org.freedesktop.portal.Fcitx
ignore dbus-user none

to the .local file. And that's what I did for Nicotine.

cat /home/debu/.config/firejail/nicotine.local 
dbus-user filter
dbus-user.talk org.freedesktop.portal.Fcitx
ignore dbus-user none

However by doing so the program doesn't start.

Steps to Reproduce

Add Fcitx rules to the nicotine.local file
Start Nicotine

Expected behavior

Program should start and Fcitx should work.

Actual behavior

Program doesn't start.

Behavior without a profile

The programs starts fine and Fcitx works too.

Additional context

I see that the program is complaining about the dbus socket location (see logs). My dbus socket file is located in the /tmp folder as I found out in another issue I've opened recently. This is how Artix deals with it, apparently. I don't know if this could be related.

Environment

Linux distribution and version: Artix
Firejail version: 0.9.72

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of firejail /usr/bin/nicotine

Reading profile /etc/firejail/nicotine.profile
Reading profile /home/debu/.config/firejail/nicotine.local
Reading profile /etc/firejail/allow-bin-sh.inc
Reading profile /etc/firejail/allow-python2.inc
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 30930, child pid 30934
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized in 90.16 ms

(nicotine:6): dbind-WARNING **: 15:54:14.069: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: No such file or directory
Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown

Parent is shutting down, bye...

Originally created by @glu8716 on GitHub (Oct 5, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6034  ### Description According to the [FAQ page](https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#how-can-i-enable-fcitx) if the dbus policy of the profile is set to none, in order to have Fcitx working you need to add ``` dbus-user filter dbus-user.talk org.freedesktop.portal.Fcitx ignore dbus-user none ``` to the .local file. And that's what I did for Nicotine. ``` cat /home/debu/.config/firejail/nicotine.local dbus-user filter dbus-user.talk org.freedesktop.portal.Fcitx ignore dbus-user none ``` However by doing so the program doesn't start. ### Steps to Reproduce 1. Add Fcitx rules to the `nicotine.local` file 2. Start Nicotine ### Expected behavior Program should start and Fcitx should work. ### Actual behavior Program doesn't start. ### Behavior without a profile The programs starts fine and Fcitx works too. ### Additional context I see that the program is complaining about the dbus socket location (see logs). My dbus socket file is located in the /tmp folder as I found out in [another issue](https://github.com/netblue30/firejail/issues/6031#issuecomment-1745644600) I've opened recently. This is how Artix deals with it, apparently. I don't know if this could be related. ### Environment - Linux distribution and version: Artix - Firejail version: 0.9.72 ### Checklist  - [X] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). - [X] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [X] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [X] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code> firejail /usr/bin/nicotine</code></summary> <p> ``` Reading profile /etc/firejail/nicotine.profile Reading profile /home/debu/.config/firejail/nicotine.local Reading profile /etc/firejail/allow-bin-sh.inc Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-shell.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 30930, child pid 30934 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Child process initialized in 90.16 ms (nicotine:6): dbind-WARNING **: 15:54:14.069: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: No such file or directory Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown Parent is shutting down, bye... ``` </p> </details>

gitea-mirror

2026-05-05 09:47:23 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 09:47:26 -06:00

Author

Owner

@ghost commented on GitHub (Oct 5, 2023):

Does the workaround from #6031 fixes this for you on Artix?

@ghost commented on GitHub (Oct 5, 2023): Does the workaround from #6031 fixes this for you on Artix?

gitea-mirror commented

2026-05-05 09:47:27 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 5, 2023):

I forgot to mention that, but no, it doesn't. I've already tried

@glu8716 commented on GitHub (Oct 5, 2023): I forgot to mention that, but no, it doesn't. I've already tried

gitea-mirror commented

2026-05-05 09:47:28 -06:00

Author

Owner

@ghost commented on GitHub (Oct 5, 2023):

I forgot to mention that, but no, it doesn't. I've already tried

Thanks for clarifying. Never actually used nicotine, but it seems a bit odd for a music-sharing client to have nosound in its profile. This app doesn't actually play music? Also, I'm wondering if noroot could be involved. That's known to break portal D-Bus comms in some cases. Tried ignore noroot yet?

@ghost commented on GitHub (Oct 5, 2023): > I forgot to mention that, but no, it doesn't. I've already tried Thanks for clarifying. Never actually used nicotine, but it seems a bit odd for a music-sharing client to have `nosound` in its profile. This app doesn't actually play music? Also, I'm wondering if `noroot` could be involved. That's known to [break portal D-Bus comms](https://github.com/netblue30/firejail/issues/2506) in some cases. Tried `ignore noroot` yet?

gitea-mirror commented

2026-05-05 09:47:29 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 5, 2023):

This app doesn't actually play music?

It doesn't, but it can call an external player to open music files from it.

Tried ignore noroot yet?

Just tried. Doesn't work unfortunately.

@glu8716 commented on GitHub (Oct 5, 2023): > This app doesn't actually play music? It doesn't, but it can call an external player to open music files from it. > Tried `ignore noroot` yet? Just tried. Doesn't work unfortunately.

gitea-mirror commented

2026-05-05 09:47:31 -06:00

Author

Owner

@ghost commented on GitHub (Oct 6, 2023):

Like in #6031 I've installed nicotine+ and it works flawlessly on my Arch Linux machine. So I cannot reproduce. Apparently nicotine supports sound notifications so we'd better take out nosound. I've also determined

ignore dbus-user none
dbus-user filter
dbus-user.own org.nicotine_plus.Nicotine
dbus-user.talk ca.desrt.dconf

works. But we can make these changes to our nicotine profile later. Let's try to determine what's keeping it from working on Artix first.

Just tried. Doesn't work unfortunately.

In that case we'll have to go through similar testing like we did #6031. Start with --noprofile and pick it up from there. I suspect your Artix has trouble with the whitelist-runuser-common.inc include. Do you have the paths that get whitelisted in that file?

2a8621cd94/etc/inc/whitelist-runuser-common.inc (L1-L16)

@ghost commented on GitHub (Oct 6, 2023): Like in #6031 I've installed nicotine+ and it works flawlessly on my Arch Linux machine. So I cannot reproduce. Apparently nicotine supports sound notifications so we'd better take out nosound. I've also determined ``` ignore dbus-user none dbus-user filter dbus-user.own org.nicotine_plus.Nicotine dbus-user.talk ca.desrt.dconf ``` works. But we can make these changes to our nicotine profile later. Let's try to determine what's keeping it from working on Artix first. > Just tried. Doesn't work unfortunately. In that case we'll have to go through similar testing like we did #6031. Start with `--noprofile` and pick it up from there. I suspect your Artix has trouble with the `whitelist-runuser-common.inc` include. Do you have the paths that get whitelisted in that file? https://github.com/netblue30/firejail/blob/2a8621cd940262397b048881d7fc34e5ba9644aa/etc/inc/whitelist-runuser-common.inc#L1-L16

gitea-mirror commented

2026-05-05 09:47:32 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 6, 2023):

Yes, the paths are all there. I haven't touched anything in that file so it's the same as the one you posted right now.
The line that is problematic is dbus-user filter. If I take that out from the .local file the program starts (but the problem here is Fcitx not working, and from what I can understand it needs that line).

EDIT: adding the line dbus-user.own org.nicotine_plus.Nicotine like you did does the trick! The program starts and Fcitx works too.

@glu8716 commented on GitHub (Oct 6, 2023): Yes, the paths are all there. I haven't touched anything in that file so it's the same as the one you posted right now. The line that is problematic is `dbus-user filter`. If I take that out from the .local file the program starts (but the problem here is Fcitx not working, and from what I can understand it needs that line). EDIT: adding the line `dbus-user.own org.nicotine_plus.Nicotine` like you did does the trick! The program starts and Fcitx works too.

gitea-mirror commented

2026-05-05 09:47:33 -06:00

Author

Owner

@ghost commented on GitHub (Oct 6, 2023):

Yes, I forgot to add dbus-user.talk org.freedesktop.portal.Fcitx to the mix. But --noprofile does work correct?

@ghost commented on GitHub (Oct 6, 2023): Yes, I forgot to add `dbus-user.talk org.freedesktop.portal.Fcitx` to the mix. But `--noprofile` does work correct?

gitea-mirror commented

2026-05-05 09:47:34 -06:00

Author

Owner

@ghost commented on GitHub (Oct 6, 2023):

@kmk3 Any ideas why Artix seems to have issues like #6031 and this one?

@ghost commented on GitHub (Oct 6, 2023): @kmk3 Any ideas why `Artix` seems to have issues like #6031 and this one?

gitea-mirror commented

2026-05-05 09:47:34 -06:00

Author

Owner

@glu8716 commented on GitHub (Oct 6, 2023):

But --noprofile does work correct?

Yes! As I said only the dbus-user filter line needed for Fcitx was causing the program to fail. Starting the program without any profile works.

dbus-user.talk ca.desrt.dconf

Also, what is this needed to?

@glu8716 commented on GitHub (Oct 6, 2023): > But --noprofile does work correct? Yes! As I said only the `dbus-user filter` line needed for Fcitx was causing the program to fail. Starting the program without any profile works. > dbus-user.talk ca.desrt.dconf Also, what is this needed to?

gitea-mirror commented

2026-05-05 09:47:35 -06:00

Author

Owner

@ghost commented on GitHub (Oct 6, 2023):

dbus-user.talk ca.desrt.dconf

It allows nicotine to talk to dconf. Impacts fonts, theme settings etcetera. Nicotine has quite a number of preferences. During configuration you'd sometimes ee several lines in CLI like

(org.nicotine_plus.Nicotine:8): dconf-WARNING **: 14:11:09.945: failed to commit changes to dconf: Could not connect: Permission denied

These are not fatal. Just a nuissance if you have to redo the settings to your liking without allowing comms with dconf over D-Bus.

@ghost commented on GitHub (Oct 6, 2023): > dbus-user.talk ca.desrt.dconf It allows nicotine to talk to dconf. Impacts fonts, theme settings etcetera. Nicotine has quite a number of preferences. During configuration you'd sometimes ee several lines in CLI like ``` (org.nicotine_plus.Nicotine:8): dconf-WARNING **: 14:11:09.945: failed to commit changes to dconf: Could not connect: Permission denied ``` These are not fatal. Just a nuissance if you have to redo the settings to your liking without allowing comms with dconf over D-Bus.

gitea-mirror commented

2026-05-05 09:47:36 -06:00

Author

Owner

@ghost commented on GitHub (Oct 6, 2023):

EDIT: adding the line dbus-user.own org.nicotine_plus.Nicotine like you did does the trick! The program starts and Fcitx works too.

Great! I made a note we should add these lines to the dbus section of nicotine.profile. Can you open a PR for this?

@ghost commented on GitHub (Oct 6, 2023): > EDIT: adding the line dbus-user.own org.nicotine_plus.Nicotine like you did does the trick! The program starts and Fcitx works too. Great! I made a note we should add these lines to the dbus section of nicotine.profile. Can you open a PR for this?

gitea-mirror commented

2026-05-05 09:47:36 -06:00

Author

Owner

@ghost commented on GitHub (Oct 7, 2023):

Fixed by #6036.

@ghost commented on GitHub (Oct 7, 2023): Fixed by #6036.

gitea-mirror referenced this issue

2026-05-05 10:24:19 -06:00

[PR #3163] [MERGED] make devilspie2 redircet to devilspie #4666

Rows
Columns

[GH-ISSUE #6034] nicotine: cannot start with fcitx dbus entries enabled #3163

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Additional context

Environment

Checklist

Log