[GH-ISSUE #6839] thunderbird: Failed to connect to Wayland display #3393

Closed
opened 2026-05-05 09:57:43 -06:00 by gitea-mirror · 6 comments
Owner

Originally created by @Gilrain on GitHub (Jul 26, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6839

Description

Thunderbird fails to launch with the default profile, stating it cannot find a WAYLAND_DISPLAY.

Commenting the following in thunderbird.profile allows the program to start normally:

ignore include whitelist-runuser-common.inc

Steps to Reproduce

$ Reading profile /etc/firejail/thunderbird.profile
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /home/user/.config/firejail/firefox-common.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-proc.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
firejail version 0.9.74

Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 9078, child pid 9082
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Private /etc installed in 50.04 ms
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 122.56 ms
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Warning: Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior.
Child process initialized in 246.16 ms
[39] Wayland Proxy [0x7f51a896e460] Error: CheckWaylandDisplay(): Failed to connect to Wayland display '/run/user/1000/wayland-1' error: No such file or directory
Error: we don't have any display, WAYLAND_DISPLAY='wayland-1' DISPLAY=':0'

Parent is shutting down, bye...

Behavior without a profile

$ LC=ALL firejail --noprofile /usr/bin/thunderbird
firejail version 0.9.74

Parent pid 20455, child pid 20456
Base filesystem installed in 0.03 ms
Child process initialized in 6.33 ms

Environment

  • Name/version/arch of the Linux kernel: Linux 6.15.8-1 x86_64
  • Name/version of the Linux distribution: Arch Linux
  • Name/version of the relevant program(s)/package(s): thunderbird 141.0-1
  • Version of Firejail: 0.9.74

Additional context

firefox-common.local:

noblacklist ${RUNUSER}/app
whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/kpxc_server
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

ignore disable-mnt
whitelist ${DOWNLOADS}

dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.ScreenSaver
dbus-user.talk org.kde.kdeconnect
dbus-user.talk org.freedesktop.portal.Desktop

Log

Output of LC_ALL=C firejail --debug /usr/bin/thunderbird

https://gist.github.com/Gilrain/e8d3dd62f562a5a450bd890299f829ad.js

Output of env | grep DISPLAY

WAYLAND_DISPLAY=wayland-1
DISPLAY=:0

Output of ls -l /run /run/user/1000

/run:
total 4
drwxr-xr-x  2 root    root     80 28 juil. 10:18 blkid
drwxr-xr-x  2 clamav  clamav  100 28 juil. 09:55 clamav
drwxr-xr-x  4 root    root     80 28 juil. 09:48 credentials
drwx------  2 root    root     40 28 juil. 09:33 cryptsetup
drwxr-xr-x  3 root    cups     80 28 juil. 09:33 cups
drwxr-xr-x  2 root    root     60 28 juil. 09:33 dbus
prw-------  1 root    root      0 28 juil. 09:33 dmeventd-client
prw-------  1 root    root      0 28 juil. 09:33 dmeventd-server
drwxr-xr-x  2 root    root     60 28 juil. 09:34 faillock
drwxr-xr-x 13 root    root    300 28 juil. 09:34 firejail
srwxr-xr-x  1 greeter greeter   0 28 juil. 09:33 greetd-893.sock
-rw-r--r--  1 root    root      0 28 juil. 09:33 greetd.run
drwxr-xr-x  2 root    root     40 28 juil. 09:33 initramfs
drwxr-xr-x  3 root    root    100 28 juil. 09:33 lock
drwxr-xr-x  3 root    root     60 28 juil. 09:33 log
drwxr-xr-x  2 root    root     40 28 juil. 09:33 media
drwxr-xr-x  2 root    root    100 28 juil. 09:34 mount
drwxr-x---  2 named   named    40 28 juil. 09:33 named
drwxrwx---  2 nut     nut      80 28 juil. 09:33 nut
srwxrwx---  1 root    seat      0 28 juil. 09:33 seatd.sock
drwxr-xr-x  2 root    root     60 28 juil. 09:33 ssh-unix-local
drwx--x--x  3 root    root     60 28 juil. 09:33 sudo
drwx------  2 root    root     40 28 juil. 09:33 svnserve
drwxr-xr-x 23 root    root    660 28 juil. 10:19 systemd
drwxr-xr-x  2 root    root     60 28 juil. 09:33 tmpfiles.d
drwxr-xr-x  3 root    root     60 28 juil. 09:33 tpm2-tss
drwxr-xr-x  8 root    root    180 28 juil. 09:34 udev
drwx------  2 root    root     40 28 juil. 09:34 udisks2
drwxr-xr-x  3 root    root     60 28 juil. 09:34 user
-rw-rw-r--  1 root    utmp    768 28 juil. 09:54 utmp
drwxrwsr-x  2 uuidd   uuidd    40 28 juil. 09:33 uuidd

/run/user/1000:
total 4
drwxr-xr-x 3 user user  60 28 juil. 09:34 app
srw-rw-rw- 1 user user   0 28 juil. 09:34 bus
drwx------ 2 user user  60 28 juil. 10:19 dconf
dr-x------ 2 user user   0  1 janv.  1970 doc
drwx------ 2 user user  60 28 juil. 09:34 gcr
drwx------ 2 user user 160 28 juil. 09:34 gnupg
dr-x------ 2 user user   0 28 juil. 09:34 gvfs
drwx------ 2 user user  60 28 juil. 10:19 gvfsd
drwx------ 3 user user  60 28 juil. 09:34 hypr
drwx------ 2 user user  80 28 juil. 09:34 keyring
lrwxrwxrwx 1 user user  80 28 juil. 09:34 org.keepassxc.KeePassXC.BrowserServer -> /run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer
drwxr-xr-x 2 user user  60 28 juil. 09:34 p11-kit
srw-rw-rw- 1 user user   0 28 juil. 09:34 pipewire-0
-rw-r----- 1 user user   0 28 juil. 09:34 pipewire-0.lock
srw-rw-rw- 1 user user   0 28 juil. 09:34 pipewire-0-manager
-rw-r----- 1 user user   0 28 juil. 09:34 pipewire-0-manager.lock
drwx------ 2 user user  80 28 juil. 09:34 pulse
drwxr-xr-x 8 user user 200 28 juil. 09:34 systemd
drwxr-xr-x 2 user user  80 28 juil. 09:34 uwsm
srwxr-xr-x 1 user user   0 28 juil. 09:34 wayland-1
-rw-r----- 1 user user   0 28 juil. 09:34 wayland-1.lock

Output of firejail --profile=thunderbird ls -l /run /run/user/1000

/run:
total 0
drwxr-xr-x  2 nobody nobody  60 28 juil. 10:26 cups
drwxr-xr-x  2 nobody nobody  60 28 juil. 10:26 dbus
drwxr-xr-x 13 nobody nobody 300 28 juil. 09:34 firejail
drwxr-xr-x  2 nobody nobody  40 28 juil. 09:33 media
drwxr-xr-x  3 nobody nobody  60 28 juil. 10:26 systemd
drwxr-xr-x  3 nobody nobody  60 28 juil. 10:26 udev
drwxr-xr-x  3 nobody nobody  60 28 juil. 10:26 user

/run/user/1000:
total 0
drwxr-xr-x 3 user user 60 28 juil. 10:26 app
lrwxrwxrwx 1 user user 80 28 juil. 10:26 org.keepassxc.KeePassXC.BrowserServer -> /run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer

Originally created by @Gilrain on GitHub (Jul 26, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6839 ### Description Thunderbird fails to launch with the default profile, stating it cannot find a WAYLAND_DISPLAY. Commenting the following in thunderbird.profile allows the program to start normally: ``` ignore include whitelist-runuser-common.inc ``` ### Steps to Reproduce ``` $ Reading profile /etc/firejail/thunderbird.profile Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/firefox-common.profile Reading profile /home/user/.config/firejail/firefox-common.local Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-proc.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc firejail version 0.9.74 Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 9078, child pid 9082 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Private /etc installed in 50.04 ms Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Base filesystem installed in 122.56 ms Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Warning: Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior. Child process initialized in 246.16 ms [39] Wayland Proxy [0x7f51a896e460] Error: CheckWaylandDisplay(): Failed to connect to Wayland display '/run/user/1000/wayland-1' error: No such file or directory Error: we don't have any display, WAYLAND_DISPLAY='wayland-1' DISPLAY=':0' Parent is shutting down, bye... ``` ### Behavior without a profile ``` $ LC=ALL firejail --noprofile /usr/bin/thunderbird firejail version 0.9.74 Parent pid 20455, child pid 20456 Base filesystem installed in 0.03 ms Child process initialized in 6.33 ms ``` ### Environment - Name/version/arch of the Linux kernel: Linux 6.15.8-1 x86_64 - Name/version of the Linux distribution: Arch Linux - Name/version of the relevant program(s)/package(s): thunderbird 141.0-1 - Version of Firejail: 0.9.74 ### Additional context firefox-common.local: ``` noblacklist ${RUNUSER}/app whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC whitelist ${RUNUSER}/kpxc_server whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer ignore disable-mnt whitelist ${DOWNLOADS} dbus-user.talk org.freedesktop.Notifications dbus-user.talk org.freedesktop.ScreenSaver dbus-user.talk org.kde.kdeconnect dbus-user.talk org.freedesktop.portal.Desktop ``` ### Log <details> <summary>Output of <code>LC_ALL=C firejail --debug /usr/bin/thunderbird</code></summary> <p> <https://gist.github.com/Gilrain/e8d3dd62f562a5a450bd890299f829ad.js> </p> </details> <details> <summary>Output of <code>env | grep DISPLAY</code></summary> <p> ``` WAYLAND_DISPLAY=wayland-1 DISPLAY=:0 ``` </p> </details> <details> <summary>Output of <code>ls -l /run /run/user/1000</code></summary> <p> ``` /run: total 4 drwxr-xr-x 2 root root 80 28 juil. 10:18 blkid drwxr-xr-x 2 clamav clamav 100 28 juil. 09:55 clamav drwxr-xr-x 4 root root 80 28 juil. 09:48 credentials drwx------ 2 root root 40 28 juil. 09:33 cryptsetup drwxr-xr-x 3 root cups 80 28 juil. 09:33 cups drwxr-xr-x 2 root root 60 28 juil. 09:33 dbus prw------- 1 root root 0 28 juil. 09:33 dmeventd-client prw------- 1 root root 0 28 juil. 09:33 dmeventd-server drwxr-xr-x 2 root root 60 28 juil. 09:34 faillock drwxr-xr-x 13 root root 300 28 juil. 09:34 firejail srwxr-xr-x 1 greeter greeter 0 28 juil. 09:33 greetd-893.sock -rw-r--r-- 1 root root 0 28 juil. 09:33 greetd.run drwxr-xr-x 2 root root 40 28 juil. 09:33 initramfs drwxr-xr-x 3 root root 100 28 juil. 09:33 lock drwxr-xr-x 3 root root 60 28 juil. 09:33 log drwxr-xr-x 2 root root 40 28 juil. 09:33 media drwxr-xr-x 2 root root 100 28 juil. 09:34 mount drwxr-x--- 2 named named 40 28 juil. 09:33 named drwxrwx--- 2 nut nut 80 28 juil. 09:33 nut srwxrwx--- 1 root seat 0 28 juil. 09:33 seatd.sock drwxr-xr-x 2 root root 60 28 juil. 09:33 ssh-unix-local drwx--x--x 3 root root 60 28 juil. 09:33 sudo drwx------ 2 root root 40 28 juil. 09:33 svnserve drwxr-xr-x 23 root root 660 28 juil. 10:19 systemd drwxr-xr-x 2 root root 60 28 juil. 09:33 tmpfiles.d drwxr-xr-x 3 root root 60 28 juil. 09:33 tpm2-tss drwxr-xr-x 8 root root 180 28 juil. 09:34 udev drwx------ 2 root root 40 28 juil. 09:34 udisks2 drwxr-xr-x 3 root root 60 28 juil. 09:34 user -rw-rw-r-- 1 root utmp 768 28 juil. 09:54 utmp drwxrwsr-x 2 uuidd uuidd 40 28 juil. 09:33 uuidd /run/user/1000: total 4 drwxr-xr-x 3 user user 60 28 juil. 09:34 app srw-rw-rw- 1 user user 0 28 juil. 09:34 bus drwx------ 2 user user 60 28 juil. 10:19 dconf dr-x------ 2 user user 0 1 janv. 1970 doc drwx------ 2 user user 60 28 juil. 09:34 gcr drwx------ 2 user user 160 28 juil. 09:34 gnupg dr-x------ 2 user user 0 28 juil. 09:34 gvfs drwx------ 2 user user 60 28 juil. 10:19 gvfsd drwx------ 3 user user 60 28 juil. 09:34 hypr drwx------ 2 user user 80 28 juil. 09:34 keyring lrwxrwxrwx 1 user user 80 28 juil. 09:34 org.keepassxc.KeePassXC.BrowserServer -> /run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer drwxr-xr-x 2 user user 60 28 juil. 09:34 p11-kit srw-rw-rw- 1 user user 0 28 juil. 09:34 pipewire-0 -rw-r----- 1 user user 0 28 juil. 09:34 pipewire-0.lock srw-rw-rw- 1 user user 0 28 juil. 09:34 pipewire-0-manager -rw-r----- 1 user user 0 28 juil. 09:34 pipewire-0-manager.lock drwx------ 2 user user 80 28 juil. 09:34 pulse drwxr-xr-x 8 user user 200 28 juil. 09:34 systemd drwxr-xr-x 2 user user 80 28 juil. 09:34 uwsm srwxr-xr-x 1 user user 0 28 juil. 09:34 wayland-1 -rw-r----- 1 user user 0 28 juil. 09:34 wayland-1.lock ``` </p> </details> <details> <summary>Output of <code>firejail --profile=thunderbird ls -l /run /run/user/1000</code></summary> <p> ``` /run: total 0 drwxr-xr-x 2 nobody nobody 60 28 juil. 10:26 cups drwxr-xr-x 2 nobody nobody 60 28 juil. 10:26 dbus drwxr-xr-x 13 nobody nobody 300 28 juil. 09:34 firejail drwxr-xr-x 2 nobody nobody 40 28 juil. 09:33 media drwxr-xr-x 3 nobody nobody 60 28 juil. 10:26 systemd drwxr-xr-x 3 nobody nobody 60 28 juil. 10:26 udev drwxr-xr-x 3 nobody nobody 60 28 juil. 10:26 user /run/user/1000: total 0 drwxr-xr-x 3 user user 60 28 juil. 10:26 app lrwxrwxrwx 1 user user 80 28 juil. 10:26 org.keepassxc.KeePassXC.BrowserServer -> /run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer ``` </p> </details>
gitea-mirror 2026-05-05 09:57:43 -06:00
  • closed this issue
  • added the
    bug
    label
Author
Owner

@kmk3 commented on GitHub (Jul 27, 2025):

Basic debugging information is missing; please follow the bug report template:

<!-- gh-comment-id:3124099564 --> @kmk3 commented on GitHub (Jul 27, 2025): Basic debugging information is missing; please follow the bug report template: * <https://github.com/netblue30/firejail/issues/new?template=bug_report.md>
Author
Owner

@kmk3 commented on GitHub (Jul 27, 2025):

Commenting the following in thunderbird.profile allows the program to start
normally:

ignore include whitelist-runuser-common.inc

Cannot reproduce.

This looks like it's due to local modifications.

Is there anything in any globals.local?

$ LC=ALL firejail /usr/bin/thunderbird

This should be:

$ LC_ALL=C firejail /usr/bin/thunderbird
$ LC=ALL firejail /usr/bin/thunderbird
[...]
Child process initialized in 246.71 ms
[39] Wayland Proxy [0x7f997886e790] Error: CheckWaylandDisplay(): Failed to connect to Wayland display '/run/user/1000/wayland-1' error: Aucun fichier ou dossier de ce nom
Error: we don't have any display, WAYLAND_DISPLAY='wayland-1' DISPLAY=':0'

Parent is shutting down, bye...

What is the output of the following?

env | grep DISPLAY
ls -l /run /run/user/1000
firejail --profile=thunderbird ls -l /run /run/user/1000
<!-- gh-comment-id:3124101506 --> @kmk3 commented on GitHub (Jul 27, 2025): > Commenting the following in thunderbird.profile allows the program to start > normally: > > ``` > ignore include whitelist-runuser-common.inc > ``` Cannot reproduce. This looks like it's due to local modifications. Is there anything in any globals.local? > ``` > $ LC=ALL firejail /usr/bin/thunderbird > ``` This should be: ``` $ LC_ALL=C firejail /usr/bin/thunderbird ``` > ``` > $ LC=ALL firejail /usr/bin/thunderbird > [...] > Child process initialized in 246.71 ms > [39] Wayland Proxy [0x7f997886e790] Error: CheckWaylandDisplay(): Failed to connect to Wayland display '/run/user/1000/wayland-1' error: Aucun fichier ou dossier de ce nom > Error: we don't have any display, WAYLAND_DISPLAY='wayland-1' DISPLAY=':0' > > Parent is shutting down, bye... > ``` What is the output of the following? ``` env | grep DISPLAY ls -l /run /run/user/1000 firejail --profile=thunderbird ls -l /run /run/user/1000 ```
Author
Owner

@Gilrain commented on GitHub (Jul 28, 2025):

Sorry, the report was not complete: I had modified firefox-common.profile to enable some dbus functionalities. These cause thunderbird to fail. Of course, Firefox 141 works.
I amended the report.

<!-- gh-comment-id:3126125118 --> @Gilrain commented on GitHub (Jul 28, 2025): Sorry, the report was not complete: I had modified firefox-common.profile to enable some dbus functionalities. These cause thunderbird to fail. Of course, Firefox 141 works. I amended the report.
Author
Owner

@rusty-snake commented on GitHub (Aug 2, 2025):

whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/kpxc_server
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

If you add one of them to your firefox-common.local, you revoke access to x11/wayland/pulseaudio/ .... for thunderbird.

Either don't add them to firefox-common but firefox.local instead or make sure thunderbird includes whitelist-runuser-common.inc if it does not break things (gpg) for you.


@kmk3 b787548b1d moved these three lines from the browser profiles to firefox-common, leading users into a wrong direction.

<!-- gh-comment-id:3146592359 --> @rusty-snake commented on GitHub (Aug 2, 2025): > ``` > whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC > whitelist ${RUNUSER}/kpxc_server > whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer > ``` If you add one of them to your `firefox-common.local`, you revoke access to x11/wayland/pulseaudio/ .... for thunderbird. Either don't add them to firefox-common but firefox.local instead or make sure thunderbird includes `whitelist-runuser-common.inc` if it does not break things (gpg) for you. --- @kmk3 https://github.com/netblue30/firejail/commit/b787548b1d004e1e055e4c9c5033687ccd9c3754 moved these three lines from the browser profiles to firefox-common, leading users into a wrong direction.
Author
Owner

@kmk3 commented on GitHub (Aug 3, 2025):

whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/kpxc_server
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

If you add one of them to your firefox-common.local, you revoke access to
x11/wayland/pulseaudio/ .... for thunderbird.

Good catch, should be fixed in:

<!-- gh-comment-id:3148301348 --> @kmk3 commented on GitHub (Aug 3, 2025): > > ``` > > whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC > > whitelist ${RUNUSER}/kpxc_server > > whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer > > ``` > > If you add one of them to your `firefox-common.local`, you revoke access to > x11/wayland/pulseaudio/ .... for thunderbird. Good catch, should be fixed in: * #6852
Author
Owner

@Gilrain commented on GitHub (Aug 5, 2025):

I can confirm that it works now.

<!-- gh-comment-id:3153910216 --> @Gilrain commented on GitHub (Aug 5, 2025): I can confirm that it works now.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3393
No description provided.