github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6776] Not clear why an app is being blocked by firejail #3368

New issue

Open

opened 2026-05-05 09:56:43 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:56:43 -06:00

Owner

Originally created by @aguaviva on GitHub (Jun 12, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6776

firejail should report a clear message explaining why it wont allow an app run.

I know about

"firejail --debug" but the output it is too verbose and unclear.
"strace -f -e trace=file firejail " but this is even worse

a more clear message would be:

Firejail killed app because it tried to attempt which is forbidden according to config file

Originally created by @aguaviva on GitHub (Jun 12, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6776 firejail should report a clear message explaining why it wont allow an app run. I know about - "firejail --debug" but the output it is too verbose and unclear. - "strace -f -e trace=file firejail <application>" but this is even worse a more clear message would be: Firejail killed app <app> because it tried to attempt <action> which is forbidden according to config file <file>

gitea-mirror added the

needinfo

label 2026-05-05 09:56:43 -06:00

gitea-mirror commented

2026-05-05 09:56:45 -06:00

Author

Owner

@kmk3 commented on GitHub (Jun 12, 2025):

Basic debugging information is missing; please follow the bug report template:

https://github.com/netblue30/firejail/issues/new?template=bug_report.md

@kmk3 commented on GitHub (Jun 12, 2025): Basic debugging information is missing; please follow the bug report template: * <https://github.com/netblue30/firejail/issues/new?template=bug_report.md>

gitea-mirror commented

2026-05-05 09:56:46 -06:00

Author

Owner

@kmk3 commented on GitHub (Jun 12, 2025):

firejail should report a clear message explaining why it wont allow an app
run.

I know about

"firejail --debug" but the output it is too verbose and unclear.

"strace -f -e trace=file firejail " but this is even worse

This complaint is rather broad and unclear without a specific example.

a more clear message would be:

Firejail killed app because it tried to attempt which is forbidden according
to config file

That's not how firejail works; firejail doesn't "kill" anything.

firejail does not do anything after it executes the app (other than perhaps
cleanup after the app exits).

As it pertains to firejail, either:

firejail tries to setup the sandbox but fails and aborts with an error
message before the app is started.
firejail sets up the sandbox, starts the app and then the app itself
exits/aborts (for example, because it cannot access something).
firejail sets up the sandbox, starts the app and then the Linux kernel kills
the app (due to a seccomp/landlock/apparmor/selinux/etc violation).

If it's the first case, which message is unclear?

If it's the second case, the app is the one responsible for its own error
messages, not firejail.

If you believe that a given app's error message is unclear, you could report it
as a bug to the app developers.

If it's the third case, the kill reason should be listed in the audit log (for
example, see dmesg -H).

@kmk3 commented on GitHub (Jun 12, 2025): > firejail should report a clear message explaining why it wont allow an app > run. > > I know about > > * "firejail --debug" but the output it is too verbose and unclear. > * "strace -f -e trace=file firejail " but this is even worse This complaint is rather broad and unclear without a specific example. > a more clear message would be: > > Firejail killed app because it tried to attempt which is forbidden according > to config file That's not how firejail works; firejail doesn't "kill" anything. firejail does not do anything after it executes the app (other than perhaps cleanup after the app exits). As it pertains to firejail, either: 1. firejail tries to setup the sandbox but fails and aborts with an error message before the app is started. 2. firejail sets up the sandbox, starts the app and then the app itself exits/aborts (for example, because it cannot access something). 3. firejail sets up the sandbox, starts the app and then the Linux kernel kills the app (due to a seccomp/landlock/apparmor/selinux/etc violation). If it's the first case, which message is unclear? If it's the second case, the app is the one responsible for its own error messages, not firejail. If you believe that a given app's error message is unclear, you could report it as a bug to the app developers. If it's the third case, the kill reason should be listed in the audit log (for example, see `dmesg -H`).

gitea-mirror commented

2026-05-05 09:56:46 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 12, 2025):

seccomp/landlock/apparmor/selinux/etc violation).

None ofthem should kill (except for seccomp when manually configured to kill instead of errno). All should return an EPERM or similar (unsure about x32).

@rusty-snake commented on GitHub (Jun 12, 2025): > seccomp/landlock/apparmor/selinux/etc violation). None ofthem should kill (except for seccomp when manually configured to kill instead of errno). All should return an EPERM or similar (unsure about x32).

gitea-mirror commented

2026-05-05 09:56:47 -06:00

Author

Owner

@aguaviva commented on GitHub (Jun 14, 2025):

Sorry for the lame bug, a number o things were not working (thumbnails were not getting created) and I found super hard to debug the issue. I was expecting some simple/actionable messages in the log but couldn't figure out anything. Uninstalling firejail solved the issue but is not the ideal solution as I rather help how to improve things (but I failed to figure out how).

@aguaviva commented on GitHub (Jun 14, 2025): Sorry for the lame bug, a number o things were not working (thumbnails were not getting created) and I found super hard to debug the issue. I was expecting some simple/actionable messages in the log but couldn't figure out anything. Uninstalling firejail solved the issue but is not the ideal solution as I rather help how to improve things (but I failed to figure out how).

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3368

No description provided.

Rows
Columns