github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6056] virt-manager: cannot initialize network (Debian 12) #3168

New issue

Open

opened 2026-05-05 09:47:37 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:47:37 -06:00

Owner

Originally created by @Alex-Farol on GitHub (Oct 20, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6056

Description

Virt Manager cannot initialize isolated network

Steps to Reproduce

Run firecfg as root
Open Virt Manager
Right click on QEMU/KVM -> Details -> Virtual Networks
Select default -> click the play button

Expected behavior

To initialize any virtual network inside Virt Manager

Actual behavior

Get an error message saying that PATH environment variable is not set

Behavior without a profile

What changed calling LC_ALL=C firejail --noprofile /path/to/program in a
terminal?

Sadly, get the same behavior.

Environment

Debian 12 (Bookworm)
Firejail 0.9.72

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

 virt-manager doesn't run with a profile

Output of LC_ALL=C firejail --debug /path/to/program

 virt-manager doesn't run with a profile

Originally created by @Alex-Farol on GitHub (Oct 20, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6056  ### Description Virt Manager cannot initialize isolated network ### Steps to Reproduce 1. Run firecfg as root 2. Open Virt Manager 3. Right click on QEMU/KVM -> Details -> Virtual Networks 4. Select default -> click the play button ### Expected behavior To initialize any virtual network inside Virt Manager ### Actual behavior Get an error message saying that PATH environment variable is not set ### Behavior without a profile _What changed calling `LC_ALL=C firejail --noprofile /path/to/program` in a terminal?_ Sadly, get the same behavior. ### Environment - Debian 12 (Bookworm) - Firejail 0.9.72 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` virt-manager doesn't run with a profile ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` virt-manager doesn't run with a profile ``` </p> </details>

gitea-mirror added the

networking

needinfo

labels 2026-05-05 09:47:37 -06:00

gitea-mirror commented

2026-05-05 09:47:39 -06:00

Author

Owner

@ghost commented on GitHub (Oct 20, 2023):

virt-manager doesn't run with a profile

That's correct. But qemu-launcher does apparently:

e5334dbe96/src/firecfg/firecfg.config (L712)

And qemu-launcher.profile has the restrict-namespaces option:

e5334dbe96/etc/profile-m-z/qemu-launcher.profile (L28)

Have you tried a qemu-launcher.local yet to ignore restrict-namespaces?

@ghost commented on GitHub (Oct 20, 2023): > virt-manager doesn't run with a profile That's correct. But `qemu-launcher` does apparently: https://github.com/netblue30/firejail/blob/e5334dbe96776491924b28bc2c48b07f7b842297/src/firecfg/firecfg.config#L712 And qemu-launcher.profile has the `restrict-namespaces` option: https://github.com/netblue30/firejail/blob/e5334dbe96776491924b28bc2c48b07f7b842297/etc/profile-m-z/qemu-launcher.profile#L28 Have you tried a `qemu-launcher.local` yet to `ignore restrict-namespaces`?

gitea-mirror commented

2026-05-05 09:47:41 -06:00

Author

Owner

@Alex-Farol commented on GitHub (Oct 28, 2023):

Have you tried a qemu-launcher.local yet to ignore restrict-namespaces?

@glitsj16, I doesn't work.

@Alex-Farol commented on GitHub (Oct 28, 2023): > Have you tried a qemu-launcher.local yet to ignore restrict-namespaces? @glitsj16, I doesn't work.

gitea-mirror commented

2026-05-05 09:47:42 -06:00

Author

Owner

@ghost commented on GitHub (Nov 1, 2023):

We still don't know which profile is causing this, do we? Run firecfg --clean, comment top half of firecfg.config, run firecfg. Rinse and repeat with commenting different parts of firecfg.config until we find the culprit. Ugly, but I don't see much else we can do right now.

@ghost commented on GitHub (Nov 1, 2023): We still don't know which profile is causing this, do we? Run firecfg --clean, comment top half of `firecfg.config`, run firecfg. Rinse and repeat with commenting different parts of firecfg.config until we find the culprit. Ugly, but I don't see much else we can do right now.

gitea-mirror commented

2026-05-05 09:47:43 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 1, 2023):

Or just watch firemon ...

@rusty-snake commented on GitHub (Nov 1, 2023): Or just watch firemon ...

gitea-mirror referenced this issue

2026-05-05 10:24:24 -06:00

[PR #3168] [MERGED] Fix typos in fs_bin.c #4669

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3168

No description provided.

Rows
Columns