[GH-ISSUE #6771] Electron apps not launching when default shell is not bash #3365

New issue

Open

opened 2026-05-05 09:56:39 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:56:39 -06:00

Owner

Originally created by @pranaovs on GitHub (Jun 8, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6771

Description

(Some) Electron apps (example FreeTube) refuse to run when the default shell is not bash.

Steps to Reproduce

Change default shell: $ ln -sfT dash /usr/bin/sh
Run some electron application: $ freetube
Error: /usr/bin/freetube: 3: electron35: not found

Expected behavior

The app launches

Actual behavior

Error: /usr/bin/freetube: 3: electron35: not found

Behavior without a profile

The application opens

Additional context

The issue seems to occur because electron* in /usr/bin seem to be a bash script:

#!/usr/bin/bash

set -euo pipefail

name=electron35
flags_file="${XDG_CONFIG_HOME:-$HOME/.config}/${name}-flags.conf"
fallback_file="${XDG_CONFIG_HOME:-$HOME/.config}/electron-flags.conf"

lines=()
if [[ -f "${flags_file}" ]]; then
    mapfile -t lines < "${flags_file}"
elif [[ -f "${fallback_file}" ]]; then
    mapfile -t lines < "${fallback_file}"
fi

flags=()
for line in "${lines[@]}"; do
    if [[ ! "${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "${line}" ]]; then
        flags+=("${line}")
    fi
done

: ${ELECTRON_IS_DEV:=0}
export ELECTRON_IS_DEV
: ${ELECTRON_FORCE_IS_PACKAGED:=true}
export ELECTRON_FORCE_IS_PACKAGED

exec /usr/lib/${name}/electron "${flags[@]}" "$@"

Now when the default shell is changed, the particular app (Freetube), which depends on electron(35), does not have a to /usr/bin/bash, because it is not private-bin or whitelisted.
Instead /usr/bin/dash and /usr/bin/sh -> dash exist.

This issue can fixed when adding private-bin bash to electron-common.local.

Environment

Name/version/arch of the Linux kernel (uname -srm): Linux 6.14.10-arch1-1 x86_64
Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Arch Linux
Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1,
mesa 1:24.3.3-2"): FreeTube v0.23.5 Beta; electron35 v35.5.1
Version of Firejail (firejail --version): firejail version 0.9.74

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
~~[] I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)~~

Log

Output of LC_ALL=C firejail /path/to/program

Reading profile /etc/firejail/freetube.profile
Reading profile /home/personal/.config/firejail/globals.local
Reading profile /etc/firejail/allow-bin-sh.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/electron-common.profile
Reading profile /home/personal/.config/firejail/electron-common.local
Reading profile /etc/firejail/electron-common-hardened.inc.profile
Reading profile /etc/firejail/chromium-common-hardened.inc.profile
Reading profile /etc/firejail/blink-common-hardened.inc.profile
Reading profile /etc/firejail/blink-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /home/personal/.config/firejail/whitelist-common.local
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
firejail version 0.9.74

Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 50729, child pid 50733
15 programs installed in 31.59 ms
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Private /etc installed in 83.86 ms
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 121.14 ms
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 352.50 ms
/usr/bin/freetube: 3: electron35: not found

Parent is shutting down, bye...

Originally created by @pranaovs on GitHub (Jun 8, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6771  ### Description (Some) Electron apps (example FreeTube) refuse to run when the default shell is not bash. ### Steps to Reproduce 1. Change default shell: `$ ln -sfT dash /usr/bin/sh` 2. Run some electron application: `$ freetube` 3. Error: `/usr/bin/freetube: 3: electron35: not found` ### Expected behavior The app launches ### Actual behavior Error: `/usr/bin/freetube: 3: electron35: not found` ### Behavior without a profile The application opens ### Additional context The issue seems to occur because electron* in `/usr/bin` seem to be a **bash** script: ```bash #!/usr/bin/bash set -euo pipefail name=electron35 flags_file="${XDG_CONFIG_HOME:-$HOME/.config}/${name}-flags.conf" fallback_file="${XDG_CONFIG_HOME:-$HOME/.config}/electron-flags.conf" lines=() if [[ -f "${flags_file}" ]]; then mapfile -t lines < "${flags_file}" elif [[ -f "${fallback_file}" ]]; then mapfile -t lines < "${fallback_file}" fi flags=() for line in "${lines[@]}"; do if [[ ! "${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "${line}" ]]; then flags+=("${line}") fi done : ${ELECTRON_IS_DEV:=0} export ELECTRON_IS_DEV : ${ELECTRON_FORCE_IS_PACKAGED:=true} export ELECTRON_FORCE_IS_PACKAGED exec /usr/lib/${name}/electron "${flags[@]}" "$@" ``` Now when the default shell is changed, the particular app (Freetube), which depends on electron(35), does not have a to /usr/bin/bash, because it is not private-bin or whitelisted. Instead /usr/bin/dash and /usr/bin/sh -> dash exist. **This issue can fixed when adding `private-bin bash` to electron-common.local.** ### Environment - Name/version/arch of the Linux kernel (`uname -srm`): Linux 6.14.10-arch1-1 x86_64 - Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Arch Linux - Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1, mesa 1:24.3.3-2"): FreeTube v0.23.5 Beta; electron35 v35.5.1 - Version of Firejail (`firejail --version`): firejail version 0.9.74 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - ~~[] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)~~ ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` Reading profile /etc/firejail/freetube.profile Reading profile /home/personal/.config/firejail/globals.local Reading profile /etc/firejail/allow-bin-sh.inc Reading profile /etc/firejail/disable-shell.inc Reading profile /etc/firejail/electron-common.profile Reading profile /home/personal/.config/firejail/electron-common.local Reading profile /etc/firejail/electron-common-hardened.inc.profile Reading profile /etc/firejail/chromium-common-hardened.inc.profile Reading profile /etc/firejail/blink-common-hardened.inc.profile Reading profile /etc/firejail/blink-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /home/personal/.config/firejail/whitelist-common.local Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc firejail version 0.9.74 Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 50729, child pid 50733 15 programs installed in 31.59 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Private /etc installed in 83.86 ms Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Base filesystem installed in 121.14 ms Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Child process initialized in 352.50 ms /usr/bin/freetube: 3: electron35: not found Parent is shutting down, bye... ``` </p> </details>

gitea-mirror commented

2026-05-05 09:56:40 -06:00

Author

Owner

@pranaovs commented on GitHub (Jun 8, 2025):

I believe this is a non-issue. I'm opening this for documenting this or possible fixes by upstream.
Also im not sure if electron being a bash script is something arch linux does or it is a common case.

@pranaovs commented on GitHub (Jun 8, 2025): I believe this is a non-issue. I'm opening this for documenting this or possible fixes by upstream. Also im not sure if electron being a bash script is something arch linux does or it is a common case.