github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6098] docs: conflicting information about whether to use apparmor with firejail #3178

New issue

Open

opened 2026-05-05 09:48:08 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:48:08 -06:00

Owner

Originally created by @svc88 on GitHub (Nov 21, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6098

https://firejail.wordpress.com/documentation-2/basic-usage/#apparmor
It says here:

Like Firejail, AppArmor restricts programs’ capabilities with per-program profiles. If you have an AppArmor profile for your application, use it! There is some overlap between the two technologies: both of them restrict the same filesystem. In case one of them misses something important, hopefully the other one picks it up.

If you don’t have an AppArmor profile for your specific application, we give you one. The profile is placed in /etc/apparmor.d/firejail-default when you install Firejail. You would need to load it into the kernel by running the following command:

sudo aa-enforce firejail-default

and here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#how-does-it-compare-with-apparmor
it says:

It is recommended to only use AppArmor OR Firejail but not both at the same time for the same app. If you set a tight AppArmor profile already then you may want to stick with that.

Firstly i dont have any special custom apparmor profiles that i use. From reading the wordpress link I thought that its better to compile firejail with --enable-apparmor so that apparmor does its own thing in the backround and as you stated "In case one of them misses something important, hopefully the other one picks it up".

So i compiled it with apparmor enabled, but when i run firefox i get:

Warning: Cannot confine the application using AppArmor.
Maybe firejail-default AppArmor profile is not loaded into the kernel.
As root, run "aa-enforce firejail-default" to load it.

So i tried to do sudo aa-enforce firejail-default but then i get an error saying:

Can't find firejail-default in the system path list. If the name of the application
is correct, please run 'which firejail-default' as a user with correct PATH
environment set up in order to find the fully-qualified path and
use the full path as parameter.

So i do which firejail-default and its nowhere to be found.

Please clarify why and what is one supposed to do in this case? Should i re-build with apparmor disabled? (i just thought it would be more secure with it enabled and apparmor doing its own thing)

Ubuntu 22.04
firejail version 0.9.72

Originally created by @svc88 on GitHub (Nov 21, 2023). Original GitHub issue: https://github.com/netblue30/firejail/issues/6098 https://firejail.wordpress.com/documentation-2/basic-usage/#apparmor It says here: > Like Firejail, AppArmor restricts programs’ capabilities with per-program profiles. If you have an AppArmor profile for your application, use it! There is some overlap between the two technologies: both of them restrict the same filesystem. In case one of them misses something important, hopefully the other one picks it up. > > If you don’t have an AppArmor profile for your specific application, we give you one. The profile is placed in /etc/apparmor.d/firejail-default when you install Firejail. You would need to load it into the kernel by running the following command: > > sudo aa-enforce firejail-default and here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#how-does-it-compare-with-apparmor it says: > It is recommended to only use AppArmor OR Firejail but not both at the same time for the same app. If you set a tight AppArmor profile already then you may want to stick with that. Firstly i dont have any special custom apparmor profiles that i use. From reading the wordpress link I thought that its better to compile firejail with `--enable-apparmor` so that apparmor does its own thing in the backround and as you stated "In case one of them misses something important, hopefully the other one picks it up". So i compiled it with apparmor enabled, but when i run firefox i get: ``` Warning: Cannot confine the application using AppArmor. Maybe firejail-default AppArmor profile is not loaded into the kernel. As root, run "aa-enforce firejail-default" to load it. ``` So i tried to do `sudo aa-enforce firejail-default` but then i get an error saying: ``` Can't find firejail-default in the system path list. If the name of the application is correct, please run 'which firejail-default' as a user with correct PATH environment set up in order to find the fully-qualified path and use the full path as parameter. ``` So i do `which firejail-default` and its nowhere to be found. Please clarify why and what is one supposed to do in this case? Should i re-build with apparmor disabled? (i just thought it would be more secure with it enabled and apparmor doing its own thing) Ubuntu 22.04 firejail version 0.9.72

gitea-mirror added the

bug

documentation

labels 2026-05-05 09:48:08 -06:00

gitea-mirror commented

2026-05-05 09:48:09 -06:00

Author

Owner

@ghost commented on GitHub (Nov 22, 2023):

Documentation indeed looks confusing on this topic. Our firejail-default is not an executable file, running which is pointless in this context. If you used the --enable-apparmor build flag, it should end up in /etc/apparmor.d/firejail-default.

Is AppArmor enabled correctly? You can check with:

$ aa-enabled

I'm sure Ubuntu has its own AppArmor docs, but the Arch Wiki page on AA might still be a good read to familiarize with AppArmor.

@ghost commented on GitHub (Nov 22, 2023): Documentation indeed looks confusing on this topic. Our [firejail-default](https://github.com/netblue30/firejail/blob/master/etc/apparmor/firejail-default) is not an executable file, running `which` is pointless in this context. If you used the `--enable-apparmor` build flag, it should end up in `/etc/apparmor.d/firejail-default`. Is AppArmor enabled correctly? You can check with: ```sh $ aa-enabled ``` I'm sure Ubuntu has its own AppArmor docs, but the [Arch Wiki page on AA](https://wiki.archlinux.org/title/AppArmor) might still be a good read to familiarize with AppArmor.

gitea-mirror referenced this issue

2026-05-05 10:24:30 -06:00

[PR #3178] [MERGED] Allow mbind syscall for GIMP #4673

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3178

No description provided.

Rows
Columns