[GH-ISSUE #6310] keepassxc: failure to launch on Gentoo (private-etc)

gitea-mirror commented

2026-05-05 09:50:54 -06:00

Owner

Originally created by @elde-n on GitHub (Apr 12, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6310

Description

Keepassxc fails to launch with firejail

Steps to Reproduce

Run in bash LC_ALL=C firejail keepassxc

Expected behavior

Keepassxc to launch with a graphical window

Actual behavior

It didn't launch a graphical window

Behavior without a profile

The application started as expected.

Environment

Gentoo 2.15 x86_64 (default/linux/amd64/23.0/split-usr/musl/hardened)
firejail version 0.9.72

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /usr/bin/keepassxc

https://github.com/netblue30/firejail/files/14961690/log.txt

Output of LC_ALL=C firejail --debug /usr/bin/keepassxc

Originally created by @elde-n on GitHub (Apr 12, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6310  ### Description Keepassxc fails to launch with firejail ### Steps to Reproduce 1. Run in bash `LC_ALL=C firejail keepassxc` ### Expected behavior Keepassxc to launch with a graphical window ![prayhooves](https://github.com/netblue30/firejail/assets/69537751/e4cd6e76-4c41-4490-9dba-34d7ba733480) ### Actual behavior It didn't launch a graphical window ### Behavior without a profile The application started as expected. ### Environment - Gentoo 2.15 x86_64 (default/linux/amd64/23.0/split-usr/musl/hardened) - firejail version 0.9.72 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /usr/bin/keepassxc</code></summary> https://github.com/netblue30/firejail/files/14961690/log.txt </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /usr/bin/keepassxc</code></summary>  </details>

gitea-mirror

2026-05-05 09:50:54 -06:00

closed this issue
added the
needinfo
label

gitea-mirror commented

2026-05-05 09:50:57 -06:00

Author

Owner

@ghost commented on GitHub (Apr 12, 2024):

@ghost commented on GitHub (Apr 12, 2024): ![prayhooves](https://github.com/netblue30/firejail/assets/98683326/b42da20d-1ef4-4c9f-aeef-017c22136848)

gitea-mirror commented

2026-05-05 09:50:58 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 12, 2024):

Seccomp list in: !name_to_handle_at, check list: @default-keep, prelist: unknown,
[...]
Child process initialized in 386.34 ms
Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/bin/keepassxc)
Error loading shared library libgcc_s.so.1: No such file or directory (needed by /usr/bin/keepassxc)
Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/lib/libQt5Svg.so.5)
Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/lib/libQt5Concurrent.so.5)
Error loading shared library libgcc_s.so.1: No such file or directory (needed by /usr/lib/libQt5Concurrent.so.5)
Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/lib/libbotan-3.so.2)
Error loading shared library libgcc_s.so.1: No such file or directory (needed by /usr/lib/libbotan-3.so.2)
[...]

That's strange, do you use private-lib?

Where are those libraries (libgcc_s.so.1, etc) located?

Is there anything modified in firejail.config?

What is the keepassxc version?

Does it work with firejail-git?

@kmk3 commented on GitHub (Apr 12, 2024): > ``` > Seccomp list in: !name_to_handle_at, check list: @default-keep, prelist: unknown, > [...] > Child process initialized in 386.34 ms > Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/bin/keepassxc) > Error loading shared library libgcc_s.so.1: No such file or directory (needed by /usr/bin/keepassxc) > Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/lib/libQt5Svg.so.5) > Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/lib/libQt5Concurrent.so.5) > Error loading shared library libgcc_s.so.1: No such file or directory (needed by /usr/lib/libQt5Concurrent.so.5) > Error loading shared library libstdc++.so.6: No such file or directory (needed by /usr/lib/libbotan-3.so.2) > Error loading shared library libgcc_s.so.1: No such file or directory (needed by /usr/lib/libbotan-3.so.2) > [...] > ``` That's strange, do you use `private-lib`? Where are those libraries (`libgcc_s.so.1`, etc) located? Is there anything modified in firejail.config? What is the keepassxc version? Does it work with firejail-git?

gitea-mirror commented

2026-05-05 09:50:59 -06:00

Author

Owner

@elde-n commented on GitHub (Apr 12, 2024):

That's strange, do you use private-lib?

Not sure what private-lib is I assume no

Where are those libraries (libgcc_s.so.1, etc) located?

libstdc++.so.6 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libstdc++.so.6
libgcc_s.so.1 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libgcc_s.so.1

Is there anything modified in firejail.config?

No
firejail.config

What is the keepassxc version?

KeePassXC 2.7.7

Does it work with firejail-git?

No

@elde-n commented on GitHub (Apr 12, 2024): > That's strange, do you use `private-lib`? Not sure what private-lib is I assume no > Where are those libraries (`libgcc_s.so.1`, etc) located? ``` libstdc++.so.6 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libstdc++.so.6 libgcc_s.so.1 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libgcc_s.so.1 ``` > Is there anything modified in firejail.config? No [firejail.config](https://github.com/netblue30/firejail/files/14964452/firejail.txt) > What is the keepassxc version? KeePassXC 2.7.7 > Does it work with firejail-git? No

gitea-mirror commented

2026-05-05 09:50:59 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 14, 2024):

Does it work with firejail --noprofile /usr/bin/keepassxc or with
firejail --profile=noprofile /usr/bin/keepassxc?

Where are those libraries (libgcc_s.so.1, etc) located?

libstdc++.so.6 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libstdc++.so.6
libgcc_s.so.1 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libgcc_s.so.1

Can you access these paths with a shell using keepassxc.profile?

Example:

firejail --ignore='include disable-shell.inc' --ignore='private-bin' --tab \
  --profile=keepassxc /bin/bash

I'd try to comment lines in keepassxc.profile until it works to find which ones
are causing issues.

@kmk3 commented on GitHub (Apr 14, 2024): Does it work with `firejail --noprofile /usr/bin/keepassxc` or with `firejail --profile=noprofile /usr/bin/keepassxc`? > > Where are those libraries (`libgcc_s.so.1`, etc) located? > > ``` > libstdc++.so.6 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libstdc++.so.6 > libgcc_s.so.1 => /usr/lib/gcc/x86_64-pc-linux-musl/13/libgcc_s.so.1 > ``` Can you access these paths with a shell using keepassxc.profile? Example: ```sh firejail --ignore='include disable-shell.inc' --ignore='private-bin' --tab \ --profile=keepassxc /bin/bash ``` I'd try to comment lines in keepassxc.profile until it works to find which ones are causing issues.

gitea-mirror commented

2026-05-05 09:51:00 -06:00

Author

Owner

@elde-n commented on GitHub (Apr 14, 2024):

Does it work with firejail --noprofile /usr/bin/keepassxc or with firejail --profile=noprofile /usr/bin/keepassxc?

Yes

Can you access these paths with a shell using keepassxc.profile?

Yes

I'd try to comment lines in keepassxc.profile until it works to find which ones are causing issues.

Commenting out the line private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id fixes the issue, thank you

@elde-n commented on GitHub (Apr 14, 2024): > Does it work with `firejail --noprofile /usr/bin/keepassxc` or with `firejail --profile=noprofile /usr/bin/keepassxc`? Yes > > Can you access these paths with a shell using keepassxc.profile? Yes > I'd try to comment lines in keepassxc.profile until it works to find which ones are causing issues. Commenting out the line ```private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id``` fixes the issue, thank you

gitea-mirror commented

2026-05-05 09:51:00 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 14, 2024):

Can you access these paths with a shell using keepassxc.profile?

Yes

I'd try to comment lines in keepassxc.profile until it works to find which
ones are causing issues.

Commenting out the line private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id
fixes the issue, thank you

No problem.

It would be good to try to find which paths are needed in private-etc.

Do you know how those libraries are configured in /etc?

What is the output of the following commands?

firejail --private --trace=trace.txt /usr/bin/keepassxc
# (manually close keepassxc)
cut -f 2 -d ' ' trace.txt | grep /etc/ | LC_ALL=C sort | uniq -c

sudo grep -R libgcc_s libstdc++ /etc 2>/dev/null | LC_ALL=C sort

@kmk3 commented on GitHub (Apr 14, 2024): > > Can you access these paths with a shell using keepassxc.profile? > > Yes > > > I'd try to comment lines in keepassxc.profile until it works to find which > > ones are causing issues. > > Commenting out the line `private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id` > fixes the issue, thank you No problem. It would be good to try to find which paths are needed in private-etc. Do you know how those libraries are configured in /etc? What is the output of the following commands? ```sh firejail --private --trace=trace.txt /usr/bin/keepassxc # (manually close keepassxc) cut -f 2 -d ' ' trace.txt | grep /etc/ | LC_ALL=C sort | uniq -c ``` ```sh sudo grep -R libgcc_s libstdc++ /etc 2>/dev/null | LC_ALL=C sort ```

gitea-mirror commented

2026-05-05 09:51:01 -06:00

Author

Owner

@ghost commented on GitHub (Apr 14, 2024):

Probably missing ld.so.conf,ld.so.conf.d in private-etc. The new group refactoring in git 0.9.73 added those to the @default group:

27cd032bed/src/include/etc_groups.h (L27-L49)

@ghost commented on GitHub (Apr 14, 2024): Probably missing `ld.so.conf,ld.so.conf.d` in private-etc. The new group refactoring in git 0.9.73 added those to the @default group: https://github.com/netblue30/firejail/blob/27cd032bed923d01edd859bcebe79b33c3ee18fd/src/include/etc_groups.h#L27-L49

gitea-mirror commented

2026-05-05 09:51:01 -06:00

Author

Owner

@elde-n commented on GitHub (Apr 15, 2024):

Do you know how those libraries are configured in /etc?

No

What is the output of the following commands?

firejail --private --trace=trace.txt /usr/bin/keepassxc
# (manually close keepassxc)
cut -f 2 -d ' ' trace.txt | grep /etc/ | LC_ALL=C sort | uniq -c

The trace.txt file is empty

sudo grep -R libgcc_s libstdc++ /etc 2>/dev/null | LC_ALL=C sort

/etc/firejail/display.local:private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libgomp.so.*,libMagickWand-*.so.*,libfreetype.so.*,libXext.so.*,libltdl.so.*,ImageMagick*
/etc/firejail/display.profile:private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libgomp.so.*,ImageMagick*,libfreetype.so.*,libltdl.so.*,libMagickWand-*.so.*,libXext.so.*
/etc/firejail/evince.profile:private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.*
/etc/firejail/pdftotext.local:private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*
/etc/firejail/unf.profile:private-lib gcc/*/*/libgcc_s.so.*
/etc/firejail/zathura.profile:#private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura

Noticing that pdftotext also fails and also a lot of 'gcc' related stuff I thought I should maybe mention that _{^{I use clang as my system compiler}}

@elde-n commented on GitHub (Apr 15, 2024): > Do you know how those libraries are configured in /etc? No > What is the output of the following commands? >```shell >firejail --private --trace=trace.txt /usr/bin/keepassxc ># (manually close keepassxc) >cut -f 2 -d ' ' trace.txt | grep /etc/ | LC_ALL=C sort | uniq -c >``` The trace.txt file is empty > ```shell > sudo grep -R libgcc_s libstdc++ /etc 2>/dev/null | LC_ALL=C sort > ``` ``` /etc/firejail/display.local:private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libgomp.so.*,libMagickWand-*.so.*,libfreetype.so.*,libXext.so.*,libltdl.so.*,ImageMagick* /etc/firejail/display.profile:private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libgomp.so.*,ImageMagick*,libfreetype.so.*,libltdl.so.*,libMagickWand-*.so.*,libXext.so.* /etc/firejail/evince.profile:private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* /etc/firejail/pdftotext.local:private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.* /etc/firejail/unf.profile:private-lib gcc/*/*/libgcc_s.so.* /etc/firejail/zathura.profile:#private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura ``` Noticing that pdftotext also fails and also a lot of 'gcc' related stuff I thought I should maybe mention that I use clang as my system compiler

gitea-mirror commented

2026-05-05 09:51:02 -06:00

Author

Owner

@ghost commented on GitHub (Apr 15, 2024):

Noticing that pdftotext also fails ...

Same as https://github.com/netblue30/firejail/issues/6310#issuecomment-2054211270.

$ cat ~/.config/firejail/keepassxc.local
private-etc ld.so.conf,ld.so.conf.d

$ cat ~/.config/firejail/pdftotext.local
private-etc ld.so.conf,ld.so.conf.d

@ghost commented on GitHub (Apr 15, 2024): Noticing that pdftotext also fails ... Same as https://github.com/netblue30/firejail/issues/6310#issuecomment-2054211270. ```sh $ cat ~/.config/firejail/keepassxc.local private-etc ld.so.conf,ld.so.conf.d $ cat ~/.config/firejail/pdftotext.local private-etc ld.so.conf,ld.so.conf.d ```

gitea-mirror commented

2026-05-05 09:51:02 -06:00

Author

Owner

@elde-n commented on GitHub (May 11, 2024):

I have fixed my issue by ripping gcc out of my system and recompiling everything with the llvm toolchain although I do seem to have a fonts issue for example librewolf:

@elde-n commented on GitHub (May 11, 2024): I have fixed my issue by ripping gcc out of my system and recompiling everything with the llvm toolchain although I do seem to have a fonts issue for example librewolf: ![image](https://github.com/netblue30/firejail/assets/69537751/b50f411e-91c3-4e43-a403-f22857f2d4e7)

gitea-mirror commented

2026-05-05 09:51:02 -06:00

Author

Owner

@ghost commented on GitHub (May 11, 2024):

@elde-n

... although I do seem to have a fonts issue for example librewolf

Here are all font-related files that I could track in our *.inc files. Perhaps we are missing something for gentoo or gentoo uses different paths. You could check and compare with:

disable-programs.inc

blacklist ${HOME}/.cache/font-manager
blacklist ${HOME}/.config/font-manager

whitelist-common.inc

whitelist ${HOME}/.cache/fontconfig
whitelist ${HOME}/.config/fontconfig
whitelist ${HOME}/.fontconfig
whitelist ${HOME}/.fonts
whitelist ${HOME}/.fonts.conf
whitelist ${HOME}/.fonts.conf.d
whitelist ${HOME}/.fonts.d
whitelist ${HOME}/.local/share/fonts
whitelist ${HOME}/.pangorc

whitelist-usr-share-common.inc

whitelist /usr/share/fontconfig
whitelist /usr/share/fonts
whitelist /usr/share/fonts-config

whitelist-var-common.inc

whitelist /var/cache/fontconfig

HTH

@ghost commented on GitHub (May 11, 2024): @elde-n > ... although I do seem to have a fonts issue for example librewolf Here are all font-related files that I could track in our *.inc files. Perhaps we are missing something for gentoo or gentoo uses different paths. You could check and compare with: `disable-programs.inc` - blacklist ${HOME}/.cache/font-manager - blacklist ${HOME}/.config/font-manager `whitelist-common.inc` - whitelist ${HOME}/.cache/fontconfig - whitelist ${HOME}/.config/fontconfig - whitelist ${HOME}/.fontconfig - whitelist ${HOME}/.fonts - whitelist ${HOME}/.fonts.conf - whitelist ${HOME}/.fonts.conf.d - whitelist ${HOME}/.fonts.d - whitelist ${HOME}/.local/share/fonts - whitelist ${HOME}/.pangorc `whitelist-usr-share-common.inc` - whitelist /usr/share/fontconfig - whitelist /usr/share/fonts - whitelist /usr/share/fonts-config `whitelist-var-common.inc` - whitelist /var/cache/fontconfig HTH

Rows
Columns

[GH-ISSUE #6310] keepassxc: failure to launch on Gentoo (private-etc) #3238

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Environment

Checklist

Log