[GH-ISSUE #6497] idea: UI freeze due to chromium + seccomp #3294

New issue

Open

opened 2026-05-05 09:53:46 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:53:46 -06:00

Owner

Originally created by @felixwiemuth on GitHub (Oct 1, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6497

Description

The profile for IntelliJ Idea includes seccomp, but this (at least recently) seems to cause problems with opening new projects (and potentially also running programs from the IDE).

This happened for IntelliJ Idea Ultimate 2024.2.3 (after updating to this version, could not run run configurations anymore (which worked just before) until disabling seccomp). A crash when opening projects (which one hadn't opened before) happened for this and versions 2024.2.1 and 2024.2.2. What is printed on the console as the last thing around the time when the program gets stuck and then closes is:

FATAL:zygote_host_impl_linux.cc(216)] Check failed: . : No such file or directory (2)

It seems that zygote is related to Chromium: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/linux/zygote.md
I noticed that after disabling seccomp, the Readme of the project is displayed after loading it - a guess would be that this is displayed via Chromium, which causes the crash when it wants to fork the process or so.

The profile used is based on the profile coming with firejail, but whitelisted, and with a few other restrictions removed.

Steps to Reproduce

Run IntelliJ Idea with the idea.sh firejail profile: firejail --profile=... intellij-idea-ultimate-edition
Open a new project (e.g. gradle project) that hadn't been opened before with IntelliJ Idea (it might be required that the project has a README.md if the issue is related to this)
Wait while the project is imported/scanned etc.
See the UI getting stuck after half a minute or so, see error FATAL:zygote_host_impl_linux.cc(216)] Check failed: . : No such file or directory (2) on the console

Expected behavior

The IDE does not crash

Actual behavior

The IDE crashes

Behavior without a profile

The IDE does not crash (when just removing seccomp from the profile)

Environment

Name/version/arch of the Linux kernel (uname -srm): Linux 6.6.47-1-MANJARO x86_64
Name/version of the Linux distribution: Manjaro/Arch Linux
Version of Firejail (firejail --version): 0.9.72

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it). (by the profile)
[most likely] I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Originally created by @felixwiemuth on GitHub (Oct 1, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6497 ### Description The [profile for IntelliJ Idea](https://github.com/netblue30/firejail/blob/master/etc/profile-a-l/idea.sh.profile) includes `seccomp`, but this (at least recently) seems to cause problems with opening new projects (and potentially also running programs from the IDE). This happened for IntelliJ Idea Ultimate 2024.2.3 (after updating to this version, could not run run configurations anymore (which worked just before) until disabling seccomp). A crash when opening projects (which one hadn't opened before) happened for this and versions 2024.2.1 and 2024.2.2. What is printed on the console as the last thing around the time when the program gets stuck and then closes is: ```FATAL:zygote_host_impl_linux.cc(216)] Check failed: . : No such file or directory (2)``` It seems that zygote is related to Chromium: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/linux/zygote.md I noticed that after disabling seccomp, the Readme of the project is displayed after loading it - a guess would be that this is displayed via Chromium, which causes the crash when it wants to fork the process or so. The profile used is based on the profile coming with firejail, but whitelisted, and with a few other restrictions removed. ### Steps to Reproduce 1. Run IntelliJ Idea with the `idea.sh` firejail profile: `firejail --profile=... intellij-idea-ultimate-edition` 2. Open a new project (e.g. gradle project) that hadn't been opened before with IntelliJ Idea (it might be required that the project has a README.md if the issue is related to this) 3. Wait while the project is imported/scanned etc. 4. See the UI getting stuck after half a minute or so, see error `FATAL:zygote_host_impl_linux.cc(216)] Check failed: . : No such file or directory (2)` on the console ### Expected behavior The IDE does not crash ### Actual behavior The IDE crashes ### Behavior without a profile The IDE does not crash (when just removing `seccomp` from the profile) ### Environment - Name/version/arch of the Linux kernel (`uname -srm`): Linux 6.6.47-1-MANJARO x86_64 - Name/version of the Linux distribution: Manjaro/Arch Linux - Version of Firejail (`firejail --version`): 0.9.72 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). _(by the profile)_ - [most likely] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)

gitea-mirror commented

2026-05-05 09:53:48 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 1, 2024):

So which syscall is blocked?

0e7296bef3/etc/templates/syscalls.txt (L89-L112)

If it is related to chromium, try seccomp !chroot assuming user namespaces are enabled.

@rusty-snake commented on GitHub (Oct 1, 2024): So which syscall is blocked? https://github.com/netblue30/firejail/blob/0e7296bef3388ea475ded293b5bd3a9967c98cc3/etc/templates/syscalls.txt#L89-L112 If it is related to chromium, try `seccomp !chroot` assuming user namespaces are enabled.