github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6644] foliate: program does not work due to private-bin and bwrap #3319

New issue

Closed

opened 2026-05-05 09:54:31 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:54:31 -06:00

Owner

Originally created by @disposableone on GitHub (Feb 9, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6644

On Fedora 40, I launch Foliate ebook reader in firejail with its own profile, and it just won't load.

The only way I was able to launch Foliate was to launch it with --noprofile option AND under root, which is obviously undesired.

If I launch Foliate under regular user with:

firejail --noprofile foliate

It opens list of books, but then when you try to open any book it crashes saying:

bwrap: Can't mount proc on /newroot/proc: Operation not permitted

This is what it says if you try to open Foliate with its own profile (the foliate executible is obviously existing in that folder):

$ firejail --profile=/etc/firejail/com.github.johnfactotum.Foliate.profile \
  /usr/bin/foliate
Reading profile /etc/firejail/com.github.johnfactotum.Foliate.profile
Reading profile /etc/firejail/allow-gjs.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 1324685, child pid 1324686
2 programs installed in 20.76 ms
Warning: skipping gconf for private /etc
Warning: skipping gtk-3.0 for private /etc
Warning: skipping ld.so.preload for private /etc
Private /etc installed in 17.02 ms
Private /usr/etc installed in 0.02 ms
Warning: not remounting /run/user/1000/doc
Child process initialized in 196.59 ms
Error: no suitable /usr/bin/foliate executable found

Parent is shutting down, bye...

Originally created by @disposableone on GitHub (Feb 9, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6644 On Fedora 40, I launch Foliate ebook reader in firejail with its own profile, and it just won't load. The only way I was able to launch Foliate was to launch it with `--noprofile` option AND under root, which is obviously undesired. If I launch Foliate under regular user with: ```sh firejail --noprofile foliate ``` It opens list of books, but then when you try to open any book it crashes saying: ``` bwrap: Can't mount proc on /newroot/proc: Operation not permitted ``` This is what it says if you try to open Foliate with its own profile (the foliate executible is obviously existing in that folder): ```console $ firejail --profile=/etc/firejail/com.github.johnfactotum.Foliate.profile \ /usr/bin/foliate Reading profile /etc/firejail/com.github.johnfactotum.Foliate.profile Reading profile /etc/firejail/allow-gjs.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-shell.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 1324685, child pid 1324686 2 programs installed in 20.76 ms Warning: skipping gconf for private /etc Warning: skipping gtk-3.0 for private /etc Warning: skipping ld.so.preload for private /etc Private /etc installed in 17.02 ms Private /usr/etc installed in 0.02 ms Warning: not remounting /run/user/1000/doc Child process initialized in 196.59 ms Error: no suitable /usr/bin/foliate executable found Parent is shutting down, bye... ```

gitea-mirror

2026-05-05 09:54:31 -06:00

closed this issue
added the
duplicate

notabug
labels

gitea-mirror commented

2026-05-05 09:54:34 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 9, 2025):

9aaf505431

@rusty-snake commented on GitHub (Feb 9, 2025): https://github.com/netblue30/firejail/commit/9aaf505431e478c24a2ea078c3366f77913da6d5

gitea-mirror commented

2026-05-05 09:54:35 -06:00

Author

Owner

@disposableone commented on GitHub (Feb 9, 2025):

@rusty-snake No, this is not exactly a duplicate. The commit you referened 9aaf505 doesn't work on Fedora. Our private-bin should be "foliate", not "com.github.johnfactotum.Foliate". When I fix that, I am able to launch foliate half way. It loads the book list, when I try to open any book, it errors out. The warnings I'm getting are Permission Denieds for /run/user/1000/.flatpak/webkit-13-18 and 13-0, and the error I'm getting is "Failed to start bus proxy: failed to spawn child process "usr/bin/bwrap No such file or directory".

@disposableone commented on GitHub (Feb 9, 2025): @rusty-snake No, this is not exactly a duplicate. The commit you referened 9aaf505 doesn't work on Fedora. Our private-bin should be "foliate", not "com.github.johnfactotum.Foliate". When I fix that, I am able to launch foliate half way. It loads the book list, when I try to open any book, it errors out. The warnings I'm getting are Permission Denieds for /run/user/1000/.flatpak/webkit-13-18 and 13-0, and the error I'm getting is "Failed to start bus proxy: failed to spawn child process "usr/bin/bwrap No such file or directory".

gitea-mirror commented

2026-05-05 09:54:36 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 9, 2025):

All known problems to private-bin are solved with 9aaf505431.
webkit2gtk/bwrap sandbox is tracked in #3647

@rusty-snake commented on GitHub (Feb 9, 2025): - All known problems to `private-bin` are solved with 9aaf505431e478c24a2ea078c3366f77913da6d5. - webkit2gtk/bwrap sandbox is tracked in #3647

gitea-mirror referenced this issue

2026-05-05 10:25:20 -06:00

[PR #3319] [MERGED] Simple sanity checks for arguments and environment #4720

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3319

No description provided.

Rows
Columns