github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6047] keepassxc: tray icon does not appear (KDE/Plasma Wayland) #3167

New issue

Closed

opened 2026-05-05 09:47:37 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:47:37 -06:00

Owner

Originally created by @variasdesign on GitHub (Oct 10, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6047

Description

When running KeepassXC inside firejail, tray icon disappears

Steps to Reproduce

Run in bash LC_ALL=C firejail keepassxc (LC_ALL=C to get a consistent
output in English that can be understood by everybody)
Tray icon doesn't appear

Expected behavior

Tray icon appears

Actual behavior

Tray icon doesn't appear

Behavior without a profile

Tray icon appears

Environment

Arch Linux
Firejail 0.9.72
Plasma 5.27.8

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

Reading profile /etc/firejail/keepassxc.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Seccomp list in: !name_to_handle_at, check list: @default-keep, prelist: unknown,
Parent pid 79045, child pid 79049
3 programs installed in 20.27 ms
Warning: skipping alternatives for private /etc
Warning: skipping ld.so.preload for private /etc
Private /etc installed in 5.40 ms
Private /usr/etc installed in 0.00 ms
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/1000/doc
Seccomp list in: !name_to_handle_at, check list: @default-keep, prelist: unknown,
Warning: cleaning all supplementary groups
Child process initialized in 202.77 ms
libEGL warning: wayland-egl: could not open /dev/dri/renderD128 (No such file or directory)
kf.notifications: env says KDE is running but SNI unavailable -- check KDE_FULL_SESSION and XDG_CURRENT_DESKTOP
qt.qpa.wayland: Wayland does not support QWindow::requestActivate()
qt.qpa.wayland: Wayland does not support QWindow::requestActivate()

Output of LC_ALL=C firejail --debug /path/to/program

Secret gist

Originally created by @variasdesign on GitHub (Oct 10, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6047  ### Description When running KeepassXC inside firejail, tray icon disappears ### Steps to Reproduce 1. Run in bash `LC_ALL=C firejail keepassxc` (`LC_ALL=C` to get a consistent output in English that can be understood by everybody) 2. Tray icon doesn't appear ### Expected behavior Tray icon appears ### Actual behavior Tray icon doesn't appear ### Behavior without a profile Tray icon appears ### Environment - Arch Linux - Firejail 0.9.72 - Plasma 5.27.8 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` Reading profile /etc/firejail/keepassxc.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-shell.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Seccomp list in: !name_to_handle_at, check list: @default-keep, prelist: unknown, Parent pid 79045, child pid 79049 3 programs installed in 20.27 ms Warning: skipping alternatives for private /etc Warning: skipping ld.so.preload for private /etc Private /etc installed in 5.40 ms Private /usr/etc installed in 0.00 ms Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: not remounting /run/user/1000/doc Seccomp list in: !name_to_handle_at, check list: @default-keep, prelist: unknown, Warning: cleaning all supplementary groups Child process initialized in 202.77 ms libEGL warning: wayland-egl: could not open /dev/dri/renderD128 (No such file or directory) kf.notifications: env says KDE is running but SNI unavailable -- check KDE_FULL_SESSION and XDG_CURRENT_DESKTOP qt.qpa.wayland: Wayland does not support QWindow::requestActivate() qt.qpa.wayland: Wayland does not support QWindow::requestActivate() ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  [Secret gist](https://gist.github.com/variasdesign/dab5af5d23cf1b606bf553f1b819faf0) </p> </details>

gitea-mirror

2026-05-05 09:47:37 -06:00

closed this issue
added the
notabug
label

gitea-mirror commented

2026-05-05 09:47:41 -06:00

Author

Owner

@ghost commented on GitHub (Oct 10, 2023):

The keepassxc profile uses a conditional ?ALLOW_TRAY to add the necessary dbus-user filter rules:

84ade11cbe/etc/profile-a-l/keepassxc.profile (L103-L104)

By default support for this conditional is disabled in /etc/firejail/firejail.config:

84ade11cbe/etc/firejail.config (L5-L7)

So you have 2 options here. Either change that default (will enable tray support for all apps that have it in their profile) OR add the same 2 filter rules without the conditional in a keepassxc.local. Use whatever supports your use cases/workflow.

@ghost commented on GitHub (Oct 10, 2023): The keepassxc profile uses a conditional `?ALLOW_TRAY` to add the necessary dbus-user filter rules: https://github.com/netblue30/firejail/blob/84ade11cbe6885932356ed20982e1b4c940d314c/etc/profile-a-l/keepassxc.profile#L103-L104 By default support for this conditional is disabled in /etc/firejail/firejail.config: https://github.com/netblue30/firejail/blob/84ade11cbe6885932356ed20982e1b4c940d314c/etc/firejail.config#L5-L7 So you have 2 options here. Either change that default (will enable tray support for all apps that have it in their profile) OR add the same 2 filter rules `without` the conditional in a keepassxc.local. Use whatever supports your use cases/workflow.

gitea-mirror commented

2026-05-05 09:47:42 -06:00

Author

Owner

@variasdesign commented on GitHub (Oct 10, 2023):

I see. Thanks for your promptness in replying and giving me a solution.

@variasdesign commented on GitHub (Oct 10, 2023): I see. Thanks for your promptness in replying and giving me a solution.

gitea-mirror referenced this issue

2026-05-05 10:24:23 -06:00

[PR #3167] [MERGED] clarify dropping python2 support in meld.profile #4667

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3167

No description provided.

Rows
Columns