mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #6269] torbrowser: error: Tor exited during startup #3229
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3229
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @marek22k on GitHub (Mar 8, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6269
Description
I am on Arch Linux and have installed Tor via the "Tor Browser Launcher". When I start Tor without Firejail everything works, when I start Tor with Firejail an error message appears.
Steps to Reproduce
Steps to reproduce the behavior
Expected behavior
Tor Browser shows the error message:
Furthermore, it cannot connect to the network.
Actual behavior
No error message, successfully connection to the tor network.
Behavior without a profile
What changed calling
LC_ALL=C firejail --noprofile /path/to/programin aterminal?
Works
Additional context
Screenshot:
Environment
Arch Linux
firejail --version).Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.Log
Output of
LC_ALL=C firejail /path/to/programOutput of
LC_ALL=C firejail --debug /path/to/programhttps://gist.github.com/marek22k/6de941d4f8d644e1ee4736007a8ea577
@ghost commented on GitHub (Mar 9, 2024):
Apparently Tor Browser
13.0.11 (based on Mozilla Firefox 115.8.0esr)changed a few things. The former versions installed under ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser and now under ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser. This affects ourapparmoropt-in rule, although you don't seem to have that enabled AFAICT from your logs.Can you try adding the below and report back please?
HTH
@ghost commented on GitHub (Mar 9, 2024):
UPDATE: note for people that do enable apparmor in a local override
c16f7a2902/etc/apparmor/firejail-local (L27)Fixed rule:
#owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/Browser/** ix,
@marek22k commented on GitHub (Mar 9, 2024):
Mhh, somehow it doesn't work for me. (Log: https://gist.github.com/marek22k/763449af038fefe103cf8c57259eada1)
As I understand it, AppArmor offers additional protection. How can I activate it?
@ghost commented on GitHub (Mar 10, 2024):
From a diff between the 0.9.72 versus the one in git master I notice we also added
include whitelist-run-common.incandseccomp.block-secondary. Any improvement when you also add those to torbrowser-launcher.local?@marek22k commented on GitHub (Mar 10, 2024):
Unfortunately not.
Log:
log.txt
AppArmor: Thanks for the links! I might have a look at that later.
@kmk3 commented on GitHub (Mar 10, 2024):
Does it work with firejail-git?
I'd suggest to comment lines in torbrowser-launcher.profile until you find
which ones are causing issues.
@johkra commented on GitHub (Mar 16, 2024):
The path on my installation is:
$HOME/.local/share/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktopThe
Browserpath component in#owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser*/Browser/** ix,changed in #6270 makes the path not match.Changing this to
owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser*/** ix,worked for me.@ghost commented on GitHub (Mar 16, 2024):
@johkra Thanks for reporting! I changed it in git accordingly.
@powerjungle commented on GitHub (Mar 30, 2024):
@glitsj16 I tried this and I get:
Warning: file execdesktop not foundand it still didn't fix the tor browser error. I don't use the apparmor profile.I also tried adding these three lines:
This did nothing as well.
I commented the whole firejail torbrowser-launcher profile and started uncommenting lines one by one. These lines need to remain commented for the error to disappear:
@ghost commented on GitHub (Apr 1, 2024):
Thanks for testing. Outside of the sandbox, do you have
$HOME/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/execdesktop? it's a small bash script that checks theX-TorBrowser-ExecShell=line in$HOME/.local/share/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktop. Just asking to stay on the same page. Your Tor Browser Launcher installation should have that file on disk.Good to know.
nonewprivs
protocol unix,inet,inet6
seccomp !chroot
Hmmm, those are pretty vital parts of the sandbox. Personally I wouldn't use TB without those options. Still can't reproduce. I'd try putting aside the TB profile in
$HOME/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/TorBrowser/Dataand see if anything changes for the better...@powerjungle commented on GitHub (Apr 1, 2024):
I do have it, but how is firejail supposed to find it? I'm assuming it finds the other binaries using PATH, but
execdesktopisn't added to the env.Yeah I know, but I'm assuming the reason it fails with them is that the child requires some privileges which it doesn't get. I was looking at the tor profile, but couldn't find anything that seems to be causing it yet. I don't understand why
protocol unix,inet,inet6should interfere, but uncommenting it causes the error to appear even if the other 2 are commented.Are you using the current master version of firejail? Maybe something other than the profiles got fixed.
@ghost commented on GitHub (Apr 1, 2024):
execdesktopis a helper script, part of what get's installed by torbrowser-launcher in your ${HOME}. It isn't in your PATH, but it is the shebang of $HOME/.local/share/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktop:That's exactly why it now needs to be part of
private-bin, where this issue all started :-)Indeed I am, like most if not all collaborators here are. It's also why you were asked asked if it works with firejail-git.
Did you try that yet?
@ghost commented on GitHub (Apr 1, 2024):
@powerjungle
I just reverted to Firejail
0.9.72to further test this. My TB is at version 13.0.13 (based on Mozilla Firefox 115.9.1esr), which is the latest available. It just works fine for me here with firejail, only needing theprivate-bin execdesktop0.9.72's torbrowser-launcher.profile is missing.So I'm not any wiser as to what might be causing the issue at your end. Assuming you use firecfg I wonder what your
start-tor-browser.desktopactually looks like. For testing, please put aside any torbrowser.local you might have and run the below:$ firejail --profile=torbrowser-launcher ${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/start-tor-browserThat bypasses the .desktop file and the extra execdesktop isn't needed in this case.
@marek22k commented on GitHub (May 10, 2024):
Is there a workaround? The fix in
988e71de09does not solve the problem for me. (Maybe re-open the issue?) (Also same issue withfirejail-gitfrom AUR.)@ghost commented on GitHub (May 10, 2024):
Reopening...
Any logs and/or context description to try to understand what's going wrong on your end?
@marek22k commented on GitHub (May 10, 2024):
The same symptoms occur as before.
firejail.log
And with
firejail-git:firejail-git.log
@ghost commented on GitHub (May 14, 2024):
I've looked and re-looked, but, alas, I can't get a meaningful grip on your issue. Let's hope someone else can join in with a fresh pair of eyes and be more helpful.
@schrotthaufen commented on GitHub (Nov 1, 2024):
Another Arch user here.
Just adding this didn't help, but also adding
apparmorto~/.config/firejail/torbrowser-launcher.local, and uncommentingowner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/Browser/** ix,, as well as addingowner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/start-tor-browser.desktop ix,in/etc/apparmor.d/local/firejail-defaultfixed it for me. I did not try to completely disable apparmor on the system.@kmk3 commented on GitHub (Nov 4, 2024):
For clarity, does it work for you with firejail-git and no modifications?
@schrotthaufen commented on GitHub (Nov 4, 2024):
With
d763fb73caI no longer needowner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/start-tor-browser.desktop ix,, but it still won't work withoutapparmorin~/.config/firejail/torbrowser-launcher.local, and uncommentingowner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser/Browser/** ix,in/etc/apparmor.d/local/firejail-default.@powerjungle commented on GitHub (Jan 6, 2025):
Okay, I found the cause in my case. Since I installed the package
torbrowser-launcherusing the Debian package managerapt, it installed an Apparmor profile and it's set inenforcemode. If you download the "Tor browser bundle" from the Tor project website, you don't have the Apparmor profile, so you won't have this issue. I tried running themasterversion of Firejail before setting the Tor browser profile tocomplainin Apparmor and the issue was still present. Thetorbrowser-launcherpackage is the latest stable upstream version in this case, because I'm running Debian testing.I did:
and running the Tor browser with Firejail now works. Note, on Debian this requires the
apparmor-utilspackage.I don't know how Apparmor and Firejail conflict in this case, cause I haven't looked into it deeply.
With this I meant I don't use the Firejail apparmor profile. I don't have the
apparmorkeyword in thetorbrowser-launcher.localfile.@cobratbq commented on GitHub (Jan 13, 2025):
It looks like I recently ran into the same issue. I think the issue is caused by the fact that
apparmorsetting is commented out intorbrowser-launcherbut is also enabled by default in/etc/firejail/firejail.config. However, the firejail-profile at/etc/apparmor.d/local/firejail-defaultstill has the "Uncomment to opt-in to apparmor for torbrowser-launcher" config line commented out. I think the commented-outapparmorentry intorbrowser-launcheris meaningless when it's enabled by default.So, my (otherwise very limited) experience:
IF
apparmorenabled by default in/etc/firejail/firejail.config:torbrowser-launcher.profilecontains or notapparmor/etc/apparmor.d/local/firejail-defaultwould need to have its dedicatedtorbrowser-launcherline uncommented, otherwise enforcement is too strict and breaks torbrowser.Note: if my understanding is correct,
apparmorapplies a program's apparmor-profile within the confines of itsfirejail-defaultrestrictions.@cobratbq commented on GitHub (Jan 16, 2025):
Some additional comments:
start-tor-browser.profile ---includes-> start-tor-browser.desktop.profile ---includes-> torbrowser-launcher.profile. (torbrowser-launcher currently executesstart-tor-browser.desktop,start-tor-browser.desktopexecutesBrowser/start-tor-browser(script). I would logically expect different dependence on includes.I made similar corrections, though I find that running tor-browser through
torbrowser-launcherdoesn't yet work. Is this a local problem on my side or does anyone else have the same issue?Note that running
Browser/start-tor-browserdirectly withfirejailhas no issues, even with apparmor active, given comments on corrections for my case.2025-01-28 update:
apparmoris false, but with unexpected result: ifapparmorin profile is not enabled, both Browser and Tor load withtorbrowser_firefoxapparmor-profile, according toaa-status. (At least in my case.) This causestorto fail to execute.etc/apparmor/firejail-localis incomplete, becausetorbrowser-launcherexecutes~/.local/share/torbrowser/tbb/x86_64/tor-browser/start-tor-browser.desktop./etc/apparmor.d/local/firejail-default(only) marks./Browser/**executable but not./start-tor-browser.desktop. Now, withapparmorin profile enabled, this mapping of processes to profiles is correctly made. (This would imply that PR #6270 is indeed incomplete. See also comment above.)aa-execto explicitly apply profiles to/usr/bin/torbrowser-launcher(without involving firejail), processes are also correctly mapped to profiles. So the mapping of bothtorandfirefox.realprocesses totorbrowser_firefoxhappens only when executed throughfirejailwithapparmorin profile disabled. Bug in firejail?etc/apparmor/firejail-localto markstart-tor-browser.desktopexecutable.)execdesktoptoprivate-bindid not make a difference for me. (See comments above)~/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/start-tor-browserwithfirejaildirectly, as opposed to going through/usr/bin/torbrowser-launcher. Although that only works untiltorbrowser-launcheror the packaging changes, i.e. paths or scripts change.torbrowser-launcherexecutingstart-tor-browser.desktopis smart, i.e. too much unnecessary indirection. Though this is out of your control.@glitsj16 @rusty-snake @netblue30 I think these findings shed light on this and another issue. I may be able to get other information if necessary.
@ddd75a650fee04c0ce576c877521c6bd commented on GitHub (Apr 15, 2025):
It started to happen to me recently, and it just didn't used to happen days ago.
It's blocking not just Tor Browser connection, but it's also blocking Brave's Tor connection.
Even if you use the AUR Tor Browser binary version, that is based on the Tor Project's site package, it's also blocked, so I think the problem is worse now.
I'm on Arch Linux.