[GH-ISSUE #6275] telegram: cannot open links in browser

gitea-mirror commented

2026-05-05 09:50:24 -06:00

Owner

Originally created by @reagentoo on GitHub (Mar 15, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6275

Hello :) fresh install of Gentoo with Firejail and noticed that clicking links in Telegram with Firejail does not open them in default browser.

Linux:

Gentoo Linux ~amd64

Configuration:

firejail-0.9.72
firefox-123.0.1
telegram-desktop-4.15.2

Console output on clicking links:

/usr/local/bin/xdg-open: line 665: grep: command not found
/usr/local/bin/xdg-open: line 659: grep: command not found
/usr/local/bin/xdg-open: line 688: grep: command not found
xdg-open: file 'https://some.link' does not exist

This is reopen https://github.com/netblue30/firejail/issues/3031

Originally created by @reagentoo on GitHub (Mar 15, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6275 Hello :) fresh install of Gentoo with Firejail and noticed that clicking links in Telegram with Firejail does not open them in default browser. Linux: ``` Gentoo Linux ~amd64 ``` Configuration: ``` firejail-0.9.72 firefox-123.0.1 telegram-desktop-4.15.2 ``` Console output on clicking links: ``` /usr/local/bin/xdg-open: line 665: grep: command not found /usr/local/bin/xdg-open: line 659: grep: command not found /usr/local/bin/xdg-open: line 688: grep: command not found xdg-open: file 'https://some.link' does not exist ``` This is reopen https://github.com/netblue30/firejail/issues/3031

gitea-mirror added the

sandbox-ipc

label 2026-05-05 09:50:24 -06:00

gitea-mirror commented

2026-05-05 09:50:25 -06:00

Author

Owner

@kmk3 commented on GitHub (Mar 15, 2024):

Hello :) fresh install of Gentoo with Firejail and noticed that clicking
links in Telegram with Firejail does not open them in default browser.

/usr/local/bin/xdg-open: line 665: grep: command not found
/usr/local/bin/xdg-open: line 659: grep: command not found
/usr/local/bin/xdg-open: line 688: grep: command not found
xdg-open: file 'https://some.link' does not exist

Hello, what happens with the following in ~/.config/firejail/telegram.local:

private-bin grep,sed,tr

If there are more similar errors try adding the commands to private-bin.

@kmk3 commented on GitHub (Mar 15, 2024): > Hello :) fresh install of Gentoo with Firejail and noticed that clicking > links in Telegram with Firejail does not open them in default browser. > ``` > /usr/local/bin/xdg-open: line 665: grep: command not found > /usr/local/bin/xdg-open: line 659: grep: command not found > /usr/local/bin/xdg-open: line 688: grep: command not found > xdg-open: file 'https://some.link' does not exist > ``` Hello, what happens with the following in ~/.config/firejail/telegram.local: ```sh private-bin grep,sed,tr ``` If there are more similar errors try adding the commands to `private-bin`.

gitea-mirror commented

2026-05-05 09:50:26 -06:00

Author

Owner

@reagentoo commented on GitHub (Mar 15, 2024):

Hello, what happens with the following in ~/.config/firejail/telegram.local:
private-bin grep,sed,tr
If there are more similar errors try adding the commands to private-bin.

xdg-open: no method available for opening 'https://link'

@reagentoo commented on GitHub (Mar 15, 2024): > Hello, what happens with the following in ~/.config/firejail/telegram.local: > > ```shell > private-bin grep,sed,tr > ``` > > If there are more similar errors try adding the commands to `private-bin`. ``` xdg-open: no method available for opening 'https://link' ```

gitea-mirror commented

2026-05-05 09:50:27 -06:00

Author

Owner

@kmk3 commented on GitHub (Mar 15, 2024):

If there are more similar errors try adding the commands to private-bin.
xdg-open: no method available for opening 'https://link'

What happens with just ignore private-bin?

Note that you can probably debug this with xdg-open directly:

firejail --profile=telegram /usr/bin/xdg-open 'https://link'

@kmk3 commented on GitHub (Mar 15, 2024): > > If there are more similar errors try adding the commands to `private-bin`. > > ``` > xdg-open: no method available for opening 'https://link' > ``` What happens with just `ignore private-bin`? Note that you can probably debug this with xdg-open directly: ```sh firejail --profile=telegram /usr/bin/xdg-open 'https://link' ```

gitea-mirror commented

2026-05-05 09:50:28 -06:00

Author

Owner

@reagentoo commented on GitHub (Mar 15, 2024):

What happens with just ignore private-bin?

Note that you can probably debug this with xdg-open directly:
firejail --profile=telegram /usr/bin/xdg-open 'https://link'

I've added the next lines:

noblacklist ${HOME}/.mozilla
whitelist ${HOME}/.mozilla
ignore private-bin

And got the next result:

Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default
Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default
Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features

@reagentoo commented on GitHub (Mar 15, 2024): > What happens with just `ignore private-bin`? > > Note that you can probably debug this with xdg-open directly: > > ```shell > firejail --profile=telegram /usr/bin/xdg-open 'https://link' > ``` I've added the next lines: ``` noblacklist ${HOME}/.mozilla whitelist ${HOME}/.mozilla ignore private-bin ``` And got the next result: ``` Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features ``` ![изображение](https://github.com/netblue30/firejail/assets/7188586/9f7d1ac4-3626-485d-981d-adfe89841c35)

gitea-mirror commented

2026-05-05 09:50:30 -06:00

Author

Owner

@reagentoo commented on GitHub (Mar 15, 2024):

Fixed by adding dbus related lines and all xdg-open dependencies:

dbus-user.own org.chromium.*
dbus-user.own org.mozilla.firefox.*
private-bin awk,basename,cut,env,grep,head,realpath,sed,tr,uname,xdg-mime
private-bin chromium,chromium-browser,elinks,epiphany,firefox,google-chrome,iceweasel,konqueror,links,links2,lynx,mozilla,seamonkey,w3m,www-browser,x-www-browser

(not tested with chromium)

@reagentoo commented on GitHub (Mar 15, 2024): Fixed by adding dbus related lines and all xdg-open dependencies: ``` dbus-user.own org.chromium.* dbus-user.own org.mozilla.firefox.* private-bin awk,basename,cut,env,grep,head,realpath,sed,tr,uname,xdg-mime private-bin chromium,chromium-browser,elinks,epiphany,firefox,google-chrome,iceweasel,konqueror,links,links2,lynx,mozilla,seamonkey,w3m,www-browser,x-www-browser ``` (not tested with chromium) Related issues: https://github.com/netblue30/firejail/issues/3290

gitea-mirror commented

2026-05-05 09:50:30 -06:00

Author

Owner

@glu8716 commented on GitHub (Apr 2, 2024):

I just came across this thread and I have a similar problem. By using the default profile what I get is xdg-open: no method available for opening 'https://link'

Adding ignore private-bin opens a new Firefox instance and not the one that is already running:

Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default
Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default
Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features

@glu8716 commented on GitHub (Apr 2, 2024): I just came across this thread and I have a similar problem. By using the default profile what I get is `xdg-open: no method available for opening 'https://link'` Adding `ignore private-bin` opens a new Firefox instance and not the one that is already running: ``` Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features ```

gitea-mirror commented

2026-05-05 09:50:31 -06:00

Author

Owner

@reagentoo commented on GitHub (Apr 2, 2024):

I just came across this thread and I have a similar problem.

Try this (~/.config/firejail/telegram.local):

noblacklist ${HOME}/Documents
noblacklist ${HOME}/Pictures
noblacklist ${HOME}/Public
noblacklist ${HOME}/Videos

whitelist ${HOME}/Documents
whitelist ${HOME}/Pictures
whitelist ${HOME}/Public
whitelist ${HOME}/Videos

# Fix video calls
# https://github.com/netblue30/firejail/issues/3872
dbus-user.talk org.freedesktop.portal.Desktop
ignore noroot
whitelist /usr/share/pipewire/client.conf

# Fix xdg-open
# https://github.com/netblue30/firejail/issues/6275
dbus-user.own org.chromium.*
dbus-user.own org.mozilla.firefox.*
private-bin awk,basename,cut,env,grep,head,realpath,sed,tr,uname,xdg-mime
private-bin chromium,chromium-browser,elinks,epiphany,firefox,google-chrome,iceweasel,konqueror,links,links2,lynx,mozilla,seamonkey,w3m,www-browser,x-www-browser

@reagentoo commented on GitHub (Apr 2, 2024): > I just came across this thread and I have a similar problem. Try this (`~/.config/firejail/telegram.local`): ``` noblacklist ${HOME}/Documents noblacklist ${HOME}/Pictures noblacklist ${HOME}/Public noblacklist ${HOME}/Videos whitelist ${HOME}/Documents whitelist ${HOME}/Pictures whitelist ${HOME}/Public whitelist ${HOME}/Videos # Fix video calls # https://github.com/netblue30/firejail/issues/3872 dbus-user.talk org.freedesktop.portal.Desktop ignore noroot whitelist /usr/share/pipewire/client.conf # Fix xdg-open # https://github.com/netblue30/firejail/issues/6275 dbus-user.own org.chromium.* dbus-user.own org.mozilla.firefox.* private-bin awk,basename,cut,env,grep,head,realpath,sed,tr,uname,xdg-mime private-bin chromium,chromium-browser,elinks,epiphany,firefox,google-chrome,iceweasel,konqueror,links,links2,lynx,mozilla,seamonkey,w3m,www-browser,x-www-browser ```

gitea-mirror commented

2026-05-05 09:50:32 -06:00

Author

Owner

@glu8716 commented on GitHub (Apr 2, 2024):

@reagentoo I've already tried the options in your last post, but unfortunately it doesn't work

@glu8716 commented on GitHub (Apr 2, 2024): @reagentoo I've already tried the options in your last post, but unfortunately it doesn't work

gitea-mirror commented

2026-05-05 09:50:32 -06:00

Author

Owner

@ghost commented on GitHub (Apr 2, 2024):

Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default

@glu8716
This is fixed in git and will be in the next release. /etc/login.defs is now part of the default group in private-etc refactoring. For 0.9.72 you can add login.defs to private-etc in a telegram.local override. Unlikely this fixes your issue (unless your user != 1000), so just a FYI.

@ghost commented on GitHub (Apr 2, 2024): > Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default @glu8716 This is fixed in git and will be in the next release. /etc/login.defs is now part of the default group in `private-etc` [refactoring](https://github.com/netblue30/firejail/discussions/5610). For 0.9.72 you can add `login.defs` to private-etc in a telegram.local override. Unlikely this fixes your issue (unless your user != 1000), so just a FYI.

gitea-mirror commented

2026-05-05 09:50:33 -06:00

Author

Owner

@reagentoo commented on GitHub (Apr 2, 2024):

Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default

@glu8716 This is fixed in git and will be in the next release. /etc/login.defs is now part of the default group in private-etc refactoring. For 0.9.72 you can add login.defs to private-etc in a telegram.local override. Unlikely this fixes your issue (unless your user != 1000), so just a FYI.

@glitsj16 Hi. Can you please give some comment for the telegram.local in https://github.com/netblue30/firejail/issues/6275#issuecomment-2031661702 (in the context of the refactoring)? Are there any extra or missing rules to fix xdg-open? This config works for me with 0.9.72.

@reagentoo commented on GitHub (Apr 2, 2024): > > Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default > > @glu8716 This is fixed in git and will be in the next release. /etc/login.defs is now part of the default group in `private-etc` [refactoring](https://github.com/netblue30/firejail/discussions/5610). For 0.9.72 you can add `login.defs` to private-etc in a telegram.local override. Unlikely this fixes your issue (unless your user != 1000), so just a FYI. @glitsj16 Hi. Can you please give some comment for the `telegram.local` in https://github.com/netblue30/firejail/issues/6275#issuecomment-2031661702 (in the context of the refactoring)? Are there any extra or missing rules to fix xdg-open? This config works for me with 0.9.72.

gitea-mirror commented

2026-05-05 09:50:34 -06:00

Author

Owner

@ghost commented on GitHub (Apr 2, 2024):

@reagentoo Hi. Your fix from https://github.com/netblue30/firejail/issues/6275#issuecomment-2031661702 looks fine. The mentioned private-etc refactoring doesn't affect it. That being said, there are (socket) alternatives being considered for using D-Bus to support URL handling. See #5364 and #5582 for context.

HTH

@ghost commented on GitHub (Apr 2, 2024): @reagentoo Hi. Your fix from https://github.com/netblue30/firejail/issues/6275#issuecomment-2031661702 looks fine. The mentioned private-etc refactoring doesn't affect it. That being said, there are (socket) alternatives being considered for using D-Bus to support URL handling. See #5364 and #5582 for context. HTH

gitea-mirror commented

2026-05-05 09:50:35 -06:00

Author

Owner

@glu8716 commented on GitHub (Apr 2, 2024):

Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default

@glu8716 This is fixed in git and will be in the next release. /etc/login.defs is now part of the default group in private-etc refactoring. For 0.9.72 you can add login.defs to private-etc in a telegram.local override. Unlikely this fixes your issue (unless your user != 1000), so just a FYI.

Can confirm that the error is fixed with the git version. However I'm still getting Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features and the link is opened in a new instance of Firefox instead of the already running one.

@glu8716 commented on GitHub (Apr 2, 2024): > > Error: cannot read UID_MIN and/or GID_MIN from /etc/login.defs, using 1000 by default > > @glu8716 This is fixed in git and will be in the next release. /etc/login.defs is now part of the default group in `private-etc` [refactoring](https://github.com/netblue30/firejail/discussions/5610). For 0.9.72 you can add `login.defs` to private-etc in a telegram.local override. Unlikely this fixes your issue (unless your user != 1000), so just a FYI. Can confirm that the error is fixed with the git version. However I'm still getting `Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features` and the link is opened in a new instance of Firefox instead of the already running one.

gitea-mirror commented

2026-05-05 09:50:36 -06:00

Author

Owner

@ghost commented on GitHub (Apr 3, 2024):

However I'm still getting Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features and the link is opened in a new instance of Firefox instead of the already running one.

@glu8716
Have you tried exporting MOZ_DBUS_REMOTE=1 in your ~/.bashrc (or similar if you happen to use a different shell)? It's a known environment variable that avoids the infamous Firefox is already running dialog and should force opening the link in a running Firefox instance. You've got to close all running FF instances, export the env var and start using FF again afterwards.

@ghost commented on GitHub (Apr 3, 2024): > However I'm still getting Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features and the link is opened in a new instance of Firefox instead of the already running one. @glu8716 Have you tried exporting `MOZ_DBUS_REMOTE=1` in your `~/.bashrc` (or similar if you happen to use a different shell)? It's a known environment variable that avoids the infamous `Firefox is already running` dialog and should force opening the link in a running Firefox instance. You've got to close all running FF instances, export the env var and start using FF again afterwards.

gitea-mirror commented

2026-05-05 09:50:36 -06:00

Author

Owner

@glu8716 commented on GitHub (Apr 3, 2024):

@glitsj16 It doesn't work, unfortunately

@glu8716 commented on GitHub (Apr 3, 2024): @glitsj16 It doesn't work, unfortunately

gitea-mirror referenced this issue

2026-05-05 10:24:46 -06:00

[PR #3231] [MERGED] Add support for SELinux labeling #4689

Rows
Columns

[GH-ISSUE #6275] telegram: cannot open links in browser #3231