[GH-ISSUE #460] LD_PRELOAD and Firejail

gitea-mirror commented

2026-05-05 05:36:18 -06:00

Owner

Originally created by @ghost on GitHub (Apr 20, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/460

I'm trying to run Steam with a custom command and with Firejail, but I'm unable to do so.

Because Steam can't properly detect/load the Radeon libraries, you either need to delete a few libraries from Steam's runtime, or start it with the following command:

LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libasound.so.2 '${LD_PRELOAD} steam

However, I can't do that with Firejail.

I tried editing Steam's profile:

noblacklist /usr/$LIB/libstdc++.so.6
noblacklist /usr/$LIB/libgcc_s.so.1
noblacklist /usr/$LIB/libxcb.so.1
noblacklist /usr/$LIB/libasound.so.2

Also, I tried:

[amarildo@amarildo ~]$ LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libasound.so.2 '${LD_PRELOAD} firejail steam

With no luck:

[amarildo@amarildo ~]$ LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libasound.so.2 '${LD_PRELOAD} firejail steam
Reading profile /etc/firejail/steam.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Warning: user namespaces not available in the current kernel.
Parent pid 4609, child pid 4610
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized
/home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable
/home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable
Running Steam on arch 64-bit
/home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable
STEAM_RUNTIME is enabled automatically
Installing breakpad exception handler for appid(steam)/version(0)
libGL error: unable to load driver: radeonsi_dri.so
libGL error: driver pointer missing
libGL error: failed to load driver: radeonsi
libGL error: unable to load driver: radeonsi_dri.so
libGL error: driver pointer missing
libGL error: failed to load driver: radeonsi
libGL error: unable to load driver: swrast_dri.so
libGL error: failed to load driver: swrast

Does anyone have any idea how to do this?

Originally created by @ghost on GitHub (Apr 20, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/460 I'm trying to run Steam with a custom command and with Firejail, but I'm unable to do so. Because Steam can't properly detect/load the Radeon libraries, you either need to delete a few libraries from Steam's runtime, or start it with the following command: LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libasound.so.2 '${LD_PRELOAD} steam However, I can't do that with Firejail. I tried editing Steam's profile: > noblacklist /usr/$LIB/libstdc++.so.6 > noblacklist /usr/$LIB/libgcc_s.so.1 > noblacklist /usr/$LIB/libxcb.so.1 > noblacklist /usr/$LIB/libasound.so.2 Also, I tried: > [amarildo@amarildo ~]$ LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libasound.so.2 '${LD_PRELOAD} firejail steam With no luck: > [amarildo@amarildo ~]$ LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libasound.so.2 '${LD_PRELOAD} firejail steam > Reading profile /etc/firejail/steam.profile > Reading profile /etc/firejail/disable-mgmt.inc > Reading profile /etc/firejail/disable-secret.inc > Reading profile /etc/firejail/disable-common.inc > Reading profile /etc/firejail/disable-devel.inc > Warning: user namespaces not available in the current kernel. > Parent pid 4609, child pid 4610 > Warning: /sbin directory link was not blacklisted > Warning: /usr/sbin directory link was not blacklisted > Child process initialized > /home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable > /home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable > Running Steam on arch 64-bit > /home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable > STEAM_RUNTIME is enabled automatically > Installing breakpad exception handler for appid(steam)/version(0) > libGL error: unable to load driver: radeonsi_dri.so > libGL error: driver pointer missing > libGL error: failed to load driver: radeonsi > libGL error: unable to load driver: radeonsi_dri.so > libGL error: driver pointer missing > libGL error: failed to load driver: radeonsi > libGL error: unable to load driver: swrast_dri.so > libGL error: failed to load driver: swrast Does anyone have any idea how to do this?

gitea-mirror

2026-05-05 05:36:18 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:36:23 -06:00

Author

Owner

@ruany commented on GitHub (Apr 23, 2016):

This should work:
firejail sh -c "LD_PRELOAD='...' steam"

It would be a security risk if users could run SUID binaries with LD_PRELOAD, since they can inject whatever code they want into the (dynamically linked) binary which runs as root.

Though it would be possible for Firejail to pass on its own environment variable as LD_PRELOAD (e.g. $FIREJAIL_LD_PRELOAD), this is already possible by setting the variables in a subshell.

@ruany commented on GitHub (Apr 23, 2016): This should work: `firejail sh -c "LD_PRELOAD='...' steam"` It would be a security risk if users could run SUID binaries with LD_PRELOAD, since they can inject whatever code they want into the (dynamically linked) binary which runs as root. Though it would be possible for Firejail to pass on its own environment variable as LD_PRELOAD (e.g. $FIREJAIL_LD_PRELOAD), this is already possible by setting the variables in a subshell.

gitea-mirror commented

2026-05-05 05:36:24 -06:00

Author

Owner

@alexbakker commented on GitHub (Apr 25, 2016):

I use the following script that I put it /usr/local/bin/:

#!/bin/bash

firejail --env=LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libgpg-error.so.0' /usr/bin/steam

@alexbakker commented on GitHub (Apr 25, 2016): I use the following script that I put it /usr/local/bin/: ``` bash #!/bin/bash firejail --env=LD_PRELOAD='/usr/$LIB/libstdc++.so.6 /usr/$LIB/libgcc_s.so.1 /usr/$LIB/libxcb.so.1 /usr/$LIB/libgpg-error.so.0' /usr/bin/steam ```

gitea-mirror commented

2026-05-05 05:36:26 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 25, 2016):

@Impyy: does it work with ---env=LD_PRELOAD[...]?

@netblue30 commented on GitHub (Apr 25, 2016): @Impyy: does it work with ---env=LD_PRELOAD[...]?

gitea-mirror commented

2026-05-05 05:36:28 -06:00

Author

Owner

@alexbakker commented on GitHub (Apr 25, 2016):

@netblue30 It does for me.

@alexbakker commented on GitHub (Apr 25, 2016): @netblue30 It does for me.

gitea-mirror commented

2026-05-05 05:36:29 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 25, 2016):

thanks!

@netblue30 commented on GitHub (Apr 25, 2016): thanks!

gitea-mirror commented

2026-05-05 05:36:31 -06:00

Author

Owner

@ghost commented on GitHub (Apr 26, 2016):

@netblue30 Would you consider using LD_PRELOAD an actually security risk?

@ghost commented on GitHub (Apr 26, 2016): @netblue30 Would you consider using LD_PRELOAD an actually security risk?

gitea-mirror commented

2026-05-05 05:36:33 -06:00

Author

Owner

@ruany commented on GitHub (Apr 27, 2016):

@amarildojr It's not a security risk, it's just prevented on SUID binaries because it would be a security risk in that case. Very few binaries are setuid root (including firejail), and regular users cannot use LD_PRELOAD on setuid binaries because it would allow them to execute arbitrary code as root.
I'd suggest using the --env option, didn't know it existed, looks cleaner than my solution.

@ruany commented on GitHub (Apr 27, 2016): @amarildojr It's not a security risk, it's just prevented on SUID binaries because it would be a security risk in that case. Very few binaries are setuid root (including firejail), and regular users cannot use LD_PRELOAD on setuid binaries because it would allow them to execute arbitrary code as root. I'd suggest using the --env option, didn't know it existed, looks cleaner than my solution.

gitea-mirror commented

2026-05-05 05:36:34 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 27, 2016):

If you start as a regular user, LD_PRELOAD is disabled automatically by the kernel on SUID binaries, so firejail runs without LD_PRELOAD. It will install LD_PRELOAD inside the sandbox as requested, and monitor it with a seccomp filter. The level of risk is higher, hopefully seccomp does its job to mitigate it - that's the theory. Don't use LD_PRELOAD unless you have a good reason to do it.

@netblue30 commented on GitHub (Apr 27, 2016): If you start as a regular user, LD_PRELOAD is disabled automatically by the kernel on SUID binaries, so firejail runs without LD_PRELOAD. It will install LD_PRELOAD inside the sandbox as requested, and monitor it with a seccomp filter. The level of risk is higher, hopefully seccomp does its job to mitigate it - that's the theory. Don't use LD_PRELOAD unless you have a good reason to do it.

gitea-mirror commented

2026-05-05 05:36:36 -06:00

Author

Owner

@ghost commented on GitHub (Apr 27, 2016):

Thanks, I'm not using LD_PRELOAD anymore, I simply decided to delete some libraries from Steam's runtime, this way it will load these libraries from the OS.

@ghost commented on GitHub (Apr 27, 2016): Thanks, I'm not using LD_PRELOAD anymore, I simply decided to delete some libraries from Steam's runtime, this way it will load these libraries from the OS.

gitea-mirror commented

2026-05-05 05:36:37 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 28, 2016):

Cool!

@netblue30 commented on GitHub (Apr 28, 2016): Cool!

Rows
Columns

[GH-ISSUE #460] LD_PRELOAD and Firejail #326