mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #6110] discord: Check failed: . : Permission denied (13) #3184
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3184
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @imgurbot12 on GitHub (Nov 28, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6110
Description
Hello, love the firejail project and I've used it for years! I've recently come across this error when trying to run discord's latest version
0.0.36on Ubuntu 22.04 within firejail which causes the entire program to crash:Steps to Reproduce
LC_ALL=C firejail discordBehavior without a profile
Additional context
Any other detail that may help to understand/debug the problem
Environment
firejail-version:
0.9.66firejail deb versions:
Checklist
/usr/bin/discord) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /usr/bin/discordOutput of
LC_ALL=C firejail --debug /path/to/programhttps://gist.github.com/imgurbot12/f54ba56ee1a2cb3bc2dc48122477fc37
Edit: I upgraded firejail using the apt-repository listed in the readme for a more recent version and got the same error.
Edit: I cloned master and did an install of
0.9.73following the instructions on firejail.wordpress.com and received the same error.@kmk3 commented on GitHub (Nov 29, 2023):
The error message appears to come from discord itself and is unfortunately not
very informative.
For debugging I'd suggest to stay on 0.9.73 and comment lines in
discord.profile (and in the .profile files that it includes) until it works to
try to narrow down which lines are causing issues.
@rusty-snake commented on GitHub (Nov 29, 2023):
You removed the behavior w/o a profile from the template. What was the result?
@imgurbot12 commented on GitHub (Nov 29, 2023):
whoops. I mean to remove the actual/expected behavior since i felt that was pretty obvious lol, but that one was cut by accident. Sorry about that. Original comment was edited to include the result. Surprisingly the same error still occurs even without a profile.
@imgurbot12 commented on GitHub (Nov 29, 2023):
@kmk3 I did try and play around with profiles a little bit with no success. I'm not much of an expert on how the whole profile config system works but half the time firejail claimed it couldn't find the binary after i had removed some include.
After a bit of tinkering I had commented out almost all of the actual discord portions of the profile and then it moves to electron so maybe this an electron related issue? I have no idea.
@rusty-snake commented on GitHub (Nov 29, 2023):
What I feared. The very short error from discord had a hint towards processes and even with
--noprofilea new pid-namespace is created. You can try withsudo unshare -p sudo -u $USER /usr/bin/discord. This unfortunately means there is no (easy) fix.@imgurbot12 commented on GitHub (Nov 29, 2023):
Ah, that's unfortunate. Running the command you recommended by itself and with
firejail --noprofilein front of it does work. trying to run it with profile enabled gives a likely intended sudo permissions errorError: execute permission denied for /usr/bin/sudoWhat's the process to fix something like this? You said it has to do with pid-namespaces. Is there a way for firejail to support that?
@rusty-snake commented on GitHub (Nov 29, 2023):
If something requires a shared pid-namespace, there is currently no solution. However it also does not make really sense to fix it as a sandbox with a shared pid-namespace is very very weak. And only give you a false feeling of security IMHO.
Which could mean it could be something else than the pid-namespace? Maybe try with
--profile=noprofile.Because it is blacklisted.
noblacklisting does not help as there might see be no root and nnp.
@imgurbot12 commented on GitHub (Nov 29, 2023):
Maybe I'm misunderstanding or I wasn't clear enough but that is what I did.
Both
sudo unshare -p sudo -u $USER /usr/bin/discordandfirejail --noprofile sudo unshare -p sudo -u $USER /usr/bin/discorddo work and discord boots up properly.
firejail --profile=noprofile sudo unshare -p sudo -u $USER /usr/bin/discordalso works.Wow, that sucks. I use firejail with discord because I don't really trust it as a program nor the company that operates it all that much, but its something I use to communicate with a lot of people. Does this mean the current design of discord essentially negates most of the value from putting it any sort of sandbox? So there's no way to secure it or lock it down?
@rusty-snake commented on GitHub (Nov 30, 2023):
Can you try just
firejail --profile=noprofile /usr/bin/discord@imgurbot12 commented on GitHub (Nov 30, 2023):
same error:
@imgurbot12 commented on GitHub (May 21, 2024):
After an upgrade to the OS from ubuntu 22.04 to 24.04 this is magically fixed so I'm just closing the issue seeing no work is being done on this. Thanks