mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #6112] man: cannot use nvim as man pager #3185
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3185
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @ShellCode33 on GitHub (Nov 30, 2023).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6112
Description
I'm unable to use nvim as man pager.
Steps to Reproduce
Expected behavior
To show the man page.
Actual behavior
Behavior without a profile
Works fine.
Additional context
I tried to create a
man.localwith the following content with no luck (I'm not familiar at all with Firejail):(notice the
nvimat the end of theprivate-binstatement)Not sure it's relevant but just in case:
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/program@ghost commented on GitHub (Nov 30, 2023):
Lua is blacklisted in
disable-interpreters.inc(as are others):8f55f6c9ab/etc/inc/disable-interpreters.inc (L13-L20)You probably just need to allow it in the man sandbox. Try
include allow-lua.incin yourman.local.@ShellCode33 commented on GitHub (Nov 30, 2023):
It's better now, thanks a lot !
However I have new errors now, the man page opens, but is not displayed properly :
Here's the error I have:
In
man.localI tried toinclude nvim.profilebut it doesn't seem to work. Any idea ?@ghost commented on GitHub (Nov 30, 2023):
Yeah that won't work, but you're on the right track. You only need to cherrypick the nvim configuration paths and add those into man.local:
What does that do?
@ShellCode33 commented on GitHub (Nov 30, 2023):
Still no luck, the error is different and doesn't give much information unfortunately:
Here's what my
man.locallooks like:Is there a way to know exactly what is being denied ? I tried to use something like:
With no luck.
Here's the output of
MANPAGER='nvim +Man!' firejail --debug /usr/bin/man sendfile:Log
@ShellCode33 commented on GitHub (Nov 30, 2023):
I tried to copy the whole
nvim.profileintoman.localand tweak it a bit:Still the same error
@kmk3 commented on GitHub (Nov 30, 2023):
@glitsj16 on Nov 30:
I managed to get it working with the following in man.local:
Note: The
read-writeentry is only needed to avoid warnings.@ShellCode33 Does that work for you?
@ShellCode33 commented on GitHub (Nov 30, 2023):
Works like a charm, thanks a lot ! The key thing seems to be
ignore memory-deny-write-execute, I'd be glad to know why w+x memory is required though.Small additional note, I had errors you apparently didn't have which seem to be related to my/your nvim config.
The first one I had to solve was related to nvim swap mechanism, I don't want them anyway so instead of changing the firejail profile, I disabled it in my nvim config:
The second one I've been unable to solve for now is related to treesitter:
I'm not sure why the write permission is required for
~/.local/share/nvim/lazy/nvim-treesitter/parseras it only contains.sofiles.I tried to add
read-write ${HOME}/.local/share/nvim/lazy/nvim-treesitter/parsertoman.localbut it doesn't work. Still the same error.This is not an error that prevents me from reading the man page, but the warning is annoying:
@kmk3 commented on GitHub (Dec 1, 2023):
@ShellCode33 on Nov 30:
No problem.
Probably for executing Vimscript, Lua, etc.
With the default configuration, if the swapfile and shada file are disabled in
the command line, then it should work without any
read-writeentries:Note that there are multiple
read-onlynvim entries:In this case the
read-writecommand might need to match the existingread-onlycommand:@ShellCode33 commented on GitHub (Dec 1, 2023):
Thanks for your reply. I tried to add all these read-write statements but it doesn't seem to work. I think the issue might be that
man.profilefirstinclude man.localand THENinclude disable-common.inc. Therefore the read-write directive is overridden by the read-only one. Any advice on how to workaround that ?@kmk3 commented on GitHub (Dec 1, 2023):
Good catch; though the
read-writeentries did remove the warnings when I wastesting, so maybe something changed in 0.9.73.
How about the following?
@ShellCode33 commented on GitHub (Dec 2, 2023):
Nop still doesn't work :/
Here's what my
man.locallooks like so far:@kmk3 commented on GitHub (Dec 2, 2023):
Is the error still about treesitter read/write?
What is the neovim and treesitter plugin version?
How is treesitter configured in neovim?
Does it still happen with firejail-git?
If you join the sandbox, what are the permissions in the treesitter
directories?
Can you create files in them?
Example:
@ShellCode33 commented on GitHub (Dec 3, 2023):
Yes it is
Neovim up to date with ArchLinux repo
I don't know what is the version of Treesitter but it is built into Neovim, so for reproducibility purposes, having neovim
0.9.4would give the same Treesitter version.However I use the nvim-treesitter plugin which - from what I understand - is a common interface for other plugins to build onto. And I'm on b41bbcb (almost the head). I might be wrong but I don't think this plugin is relevant.
I use LazyVim which configures it for me, its Treesitter configuration can be found here ("Full spec" must be selected)
My whole neovim config can be found here.
Yes it does, the exact same error
No
Full logs of the commands you provided
Process tree in case that's useful:
Note: my
man.localhasn't changed between my last comment and this oneAgain, thanks a lot for your help