[GH-ISSUE #6843] librewolf: UI has graphic corruption (NixOS, 3d + private-etc)

gitea-mirror commented

2026-05-05 09:57:50 -06:00

Owner

Originally created by @graham00 on GitHub (Jul 30, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6843

Description

Using librewolf via firejail, I have weird graphical corruption in the librewolf UI, which looks like this (garbled URLs, menu text, etc).

Steps to Reproduce

I'm launching it like this (net=none because I like my systemwide default browser to not directly hit the net - I copy URLs from it and use it to view local html/etc):

LC_ALL=C firejail \
    --profile=/nix/store/wgbf6q0qcrhhlg0m763d00h9ci9wj35n-firejail-0.9.74/etc/firejail/librewolf.profile \
    --net=none \
    -- \
    /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf --name=offline-librewolf --no-remote

With hardware acceleration enabled in librewolf settings I get this warning and the graphic corruption issue occurs:

libEGL warning: egl: failed to create dri2 screen

If I disable hardware acceleration in librewolf, the problem goes away (it works fine, though I do get this: Crash Annotation GraphicsCriticalError: |[0][GFX1-]: RenderCompositorSWGL failed mapping default framebuffer, no dt (t=5.32999) [GFX1-]: RenderCompositorSWGL failed mapping default framebuffer, no dt).

Expected behavior

Able to use hardware acceleration without the graphical corruption.

Actual behavior

Scrambled text that looks like this.

Behavior without a profile

With hardware acceleration enabled, in firejail, but with --profile=noprofile: no errors or issues

Also, with hardware acceleration enabled, not in firejail: no errors, text not corrupted

Additional context

I tried looking through the librewolf* and firefox* profiles, but I can't figure out what could be causing the issue. I tried a few things like adding -ignore=no3d , --ignore=novideo , but as expected that had no effect (I don't think that was being disabled in the first place via the profiles).

I found this issue which sounds similar but, bad attitude of the OP aside, I tried the fix ghost mentioned by copying all of "/nix/store/wgbf6q0qcrhhlg0m763d00h9ci9wj35n-firejail-0.9.74/etc/firejail/" into ~/.config/firejail/ and then editing firefox-common.profile and commenting out the two lines that were mentioned, and that didn't help in librewolf's case (and I confirmed when launching that all "Reading profile..." was then from ~/.config/firejail). I also commented out "whitelist /usr/share/librewolf" in librewolf.profile.

Environment

Name/version/arch of the Linux kernel (uname -srm): Linux 6.12.40 x86_64
Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): NixOS 25.05
Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1,
mesa 1:24.3.3-2"): librewolf-140.0.4-1
Version of Firejail (firejail --version): firejail 0.9.74
If you use a development version of firejail, also the commit from which it
was compiled (git rev-parse HEAD): n/a

I'm also using an Nvidia RTX 4060 Ti with the stable binary drivers.

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Is this a bug with the librewolf profile, some nvidia-specific issue, some quirk to nixos not being FHS-compliant, or just something dumb I'm doing? :) Thanks!

Relates to:

#6743

Originally created by @graham00 on GitHub (Jul 30, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6843 ### Description Using librewolf via firejail, I have weird graphical corruption in the librewolf UI, which [looks like this](https://imgur.com/a/Hor1XGx) (garbled URLs, menu text, etc). ### Steps to Reproduce I'm launching it like this (_net=none because I like my systemwide default browser to not directly hit the net - I copy URLs from it and use it to view local html/etc_): ``` LC_ALL=C firejail \ --profile=/nix/store/wgbf6q0qcrhhlg0m763d00h9ci9wj35n-firejail-0.9.74/etc/firejail/librewolf.profile \ --net=none \ -- \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf --name=offline-librewolf --no-remote ``` With hardware acceleration **enabled** in librewolf settings I get this warning and the graphic corruption issue occurs: `libEGL warning: egl: failed to create dri2 screen` If I disable hardware acceleration in librewolf, the problem goes away (it works fine, though I do get this: _Crash Annotation GraphicsCriticalError: |[0][GFX1-]: RenderCompositorSWGL failed mapping default framebuffer, no dt (t=5.32999) [GFX1-]: RenderCompositorSWGL failed mapping default framebuffer, no dt_). ### Expected behavior Able to use hardware acceleration without the graphical corruption. ### Actual behavior Scrambled text that [looks like this](https://imgur.com/a/Hor1XGx). ### Behavior without a profile With hardware acceleration enabled, in firejail, but with --profile=noprofile: no errors or issues Also, with hardware acceleration enabled, not in firejail: no errors, text not corrupted ### Additional context I tried looking through the librewolf* and firefox* profiles, but I can't figure out what could be causing the issue. I tried a few things like adding -ignore=no3d , --ignore=novideo , but as expected that had no effect (I don't think that was being disabled in the first place via the profiles). I found [this issue](https://github.com/netblue30/firejail/issues/6743) which sounds similar but, bad attitude of the OP aside, I tried the fix [ghost mentioned](https://github.com/netblue30/firejail/issues/6743#issuecomment-2879070022) by copying all of "/nix/store/wgbf6q0qcrhhlg0m763d00h9ci9wj35n-firejail-0.9.74/etc/firejail/" into ~/.config/firejail/ and then editing firefox-common.profile and commenting out the two lines that were mentioned, and that didn't help in librewolf's case (and I confirmed when launching that all "Reading profile..." was then from ~/.config/firejail). I also commented out "whitelist /usr/share/librewolf" in librewolf.profile. ### Environment - Name/version/arch of the Linux kernel (`uname -srm`): Linux 6.12.40 x86_64 - Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): NixOS 25.05 - Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1, mesa 1:24.3.3-2"): librewolf-140.0.4-1 - Version of Firejail (`firejail --version`): firejail 0.9.74 - If you use a development version of firejail, also the commit from which it was compiled (`git rev-parse HEAD`): n/a I'm also using an Nvidia RTX 4060 Ti with the stable binary drivers. ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) Is this a bug with the librewolf profile, some nvidia-specific issue, some quirk to nixos not being FHS-compliant, or just something dumb I'm doing? :) Thanks! Relates to: * #6743

gitea-mirror added the

graphics

needinfo

labels 2026-05-05 09:57:50 -06:00

gitea-mirror commented

2026-05-05 09:57:51 -06:00

Author

Owner

@graham00 commented on GitHub (Jul 30, 2025):

I've narrowed down the problematic portion of the profiles to "private-etc" - with that removed from both librewolf.profile and firefox-common.profile the issue is fixed. Or using --ignore works:

firejail \
    --ignore=private-etc \
    --profile=/nix/store/wgbf6q0qcrhhlg0m763d00h9ci9wj35n-firejail-0.9.74/etc/firejail/librewolf.profile \
    --net=none \
    -- \
    /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf --name=offline-librewolf --no-remote

@graham00 commented on GitHub (Jul 30, 2025): I've narrowed down the problematic portion of the profiles to "private-etc" - with that removed from both librewolf.profile and firefox-common.profile the issue is fixed. Or using --ignore works: ``` firejail \ --ignore=private-etc \ --profile=/nix/store/wgbf6q0qcrhhlg0m763d00h9ci9wj35n-firejail-0.9.74/etc/firejail/librewolf.profile \ --net=none \ -- \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf --name=offline-librewolf --no-remote ```

gitea-mirror commented

2026-05-05 09:57:52 -06:00

Author

Owner

@graham00 commented on GitHub (Jul 30, 2025):

Per the manual for --private-etc I did the following to try to narrow down what needs to be included from etc:

$ strace \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote 2>&1 | grep open | grep '"/etc' |
  grep -v "No such file or directory"
openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 19
openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 19
openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50
openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 134

...that all looks unlikely to be related, but I tried explicitly including them nonetheless:

firejail --profile=~/.config/firejail/librewolf.profile \
  --private-etc=host.conf,resolv.conf,os-release,localtime -- \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote

As expected, that didn't help - still graphical corruption.

I'm not sure what to do next to narrow down further what about --private-etc is causing problems.

@graham00 commented on GitHub (Jul 30, 2025): Per the manual for `--private-etc` I did the following to try to narrow down what needs to be included from etc: ``` $ strace \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote 2>&1 | grep open | grep '"/etc' | grep -v "No such file or directory" openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 19 openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 19 openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50 openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50 openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 134 ``` ...that all looks unlikely to be related, but I tried explicitly including them nonetheless: ```sh firejail --profile=~/.config/firejail/librewolf.profile \ --private-etc=host.conf,resolv.conf,os-release,localtime -- \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote ``` As expected, that didn't help - still graphical corruption. I'm not sure what to do next to narrow down further what about `--private-etc` is causing problems.

gitea-mirror commented

2026-05-05 09:57:52 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 31, 2025):

Basic debugging information is missing; please follow the bug report template:

https://github.com/netblue30/firejail/issues/new?template=bug_report.md

@kmk3 commented on GitHub (Jul 31, 2025): Basic debugging information is missing; please follow the bug report template: * <https://github.com/netblue30/firejail/issues/new?template=bug_report.md>

gitea-mirror commented

2026-05-05 09:57:52 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 31, 2025):

Is this a bug with the librewolf profile, some nvidia-specific issue, some
quirk to nixos not being FHS-compliant, or just something dumb I'm doing? :)

It might be related to the very different NixOS paths (as most profiles use
common distribution paths), though it's currently unclear.

weird graphical corruption in the librewolf UI

Does it work with no3d in ~/.config/firejail/librewolf.local?

Per the manual for --private-etc I did the following to try to narrow down
what needs to be included from etc:

$ strace \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote 2>&1 | grep open | grep '"/etc' |
  grep -v "No such file or directory"
openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 19
openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 19
openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50
openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 134

Instead of grep open, try using strace --trace=%file to match more
path-related syscalls.

Example:

$ strace --trace=%file \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote 2>&1 | grep '"/etc' |
  grep -v "No such file or directory"

Or if possible use firejail --trace=trace.txt.

Example:

$ firejail --trace=trace.txt \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote; grep /etc trace.txt

What is the output of grep /etc trace.txt?

@kmk3 commented on GitHub (Jul 31, 2025): > Is this a bug with the librewolf profile, some nvidia-specific issue, some > quirk to nixos not being FHS-compliant, or just something dumb I'm doing? :) It might be related to the very different NixOS paths (as most profiles use common distribution paths), though it's currently unclear. > weird graphical corruption in the librewolf UI Does it work with `no3d` in ~/.config/firejail/librewolf.local? > Per the manual for `--private-etc` I did the following to try to narrow down > what needs to be included from etc: > > ``` > $ strace \ > /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ > --name=offline-librewolf --no-remote 2>&1 | grep open | grep '"/etc' | > grep -v "No such file or directory" > openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 19 > openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 19 > openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50 > openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50 > openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 134 > ``` Instead of `grep open`, try using `strace --trace=%file` to match more path-related syscalls. Example: ``` $ strace --trace=%file \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote 2>&1 | grep '"/etc' | grep -v "No such file or directory" ``` Or if possible use `firejail --trace=trace.txt`. Example: ``` $ firejail --trace=trace.txt \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote; grep /etc trace.txt ``` What is the output of `grep /etc trace.txt`?

gitea-mirror commented

2026-05-05 09:57:53 -06:00

Author

Owner

@graham00 commented on GitHub (Jul 31, 2025):

Basic debugging information is missing; please follow the bug report template:
* https://github.com/netblue30/firejail/issues/new?template=bug_report.md

Sorry about that - I didn't know for sure if it should be considered a bug or not, so I thought maybe I shouldn't choose "bug" right from the outset and didn't know there would have been a template to follow. I haven't been active in github projects all that much in the past so I'm not that familiar with etiquette. I edited my post just now using the bug template.

weird graphical corruption in the librewolf UI

Does it work with no3d in ~/.config/firejail/librewolf.local?

Huh, yes, it does work like that. I guess that's still not allowing hardware acceleration, but maybe that would tell us something.

Instead of grep open, try using strace --trace=%file to match more path-related syscalls.

$ strace --trace=%file \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote 2>&1 | grep -E '/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc|"/etc' | 
  grep -v "No such file or directory"
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0664, st_size=60, ...}, 0) = 0
openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 19
openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 19
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0664, st_size=60, ...}, 0) = 0
openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50
openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50
newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0
access("/etc", R_OK|X_OK)               = 0
inotify_add_watch(116, "/etc", IN_MODIFY|IN_ATTRIB|IN_CLOSE_WRITE|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF|IN_UNMOUNT|IN_ONLYDIR) = 2
access("/etc", R_OK|X_OK)               = 0
access("/etc", R_OK|X_OK)               = 0
openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 134
newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0444, st_size=3552, ...}, 0) = 0
newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0444, st_size=3552, ...}, 0) = 0
readlink("/etc", 0x7ffe49e1df80, 1023)  = -1 EINVAL (Invalid argument)
readlink("/etc/localtime", "/etc/zoneinfo/America/New_York", 1023) = 30
readlink("/etc", 0x7ffe49e1df80, 1023)  = -1 EINVAL (Invalid argument)
readlink("/etc/zoneinfo", "/etc/static/zoneinfo", 1023) = 20
readlink("/etc", 0x7ffe49e1df80, 1023)  = -1 EINVAL (Invalid argument)
readlink("/etc/static", "/nix/store/6kl3d31pr7758zci66kzy"..., 1023) = 51
readlink("/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc", 0x7ffe49e1df80, 1023) = -1 EINVAL (Invalid argument)
readlink("/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc/etc", 0x7ffe49e1df80, 1023) = -1 EINVAL (Invalid argument)
readlink("/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc/etc/zoneinfo", "/nix/store/g9fkd8j29j0dmln6xinp3"..., 1023) = 71
newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0

Or if possible use firejail --trace=trace.txt.
Example:

$ firejail --trace=trace.txt \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote; grep /etc trace.txt

I ran..

firejail --trace=trace.txt \
    /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
    --name=offline-librewolf --no-remote; grep /etc trace.txt

$ ls -s trace.txt 
0 trace.txt

There was no output regarding /etc. I checked and trace.txt is a 0 byte file. I deleted it and reran to confirm it did in fact create the file, and it did - but 0 bytes output to it.

@graham00 commented on GitHub (Jul 31, 2025): > Basic debugging information is missing; please follow the bug report template: > > * https://github.com/netblue30/firejail/issues/new?template=bug_report.md Sorry about that - I didn't know for sure if it should be considered a bug or not, so I thought maybe I shouldn't choose "bug" right from the outset and didn't know there would have been a template to follow. I haven't been active in github projects all that much in the past so I'm not that familiar with etiquette. I edited my post just now using the bug template. > > weird graphical corruption in the librewolf UI > > Does it work with `no3d` in ~/.config/firejail/librewolf.local? Huh, yes, it does work like that. I guess that's still not allowing hardware acceleration, but maybe that would tell us something. > Instead of `grep open`, try using `strace --trace=%file` to match more path-related syscalls. > ``` $ strace --trace=%file \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote 2>&1 | grep -E '/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc|"/etc' | grep -v "No such file or directory" newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0664, st_size=60, ...}, 0) = 0 openat(AT_FDCWD, "/etc/host.conf", O_RDONLY|O_CLOEXEC) = 19 openat(AT_FDCWD, "/etc/resolv.conf", O_RDONLY|O_CLOEXEC) = 19 newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0664, st_size=60, ...}, 0) = 0 openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50 openat(AT_FDCWD, "/etc/os-release", O_RDONLY) = 50 newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0 newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0 newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0 access("/etc", R_OK|X_OK) = 0 inotify_add_watch(116, "/etc", IN_MODIFY|IN_ATTRIB|IN_CLOSE_WRITE|IN_MOVED_FROM|IN_MOVED_TO|IN_CREATE|IN_DELETE|IN_DELETE_SELF|IN_MOVE_SELF|IN_UNMOUNT|IN_ONLYDIR) = 2 access("/etc", R_OK|X_OK) = 0 access("/etc", R_OK|X_OK) = 0 openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 134 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0444, st_size=3552, ...}, 0) = 0 newfstatat(AT_FDCWD, "/etc/localtime", {st_mode=S_IFREG|0444, st_size=3552, ...}, 0) = 0 readlink("/etc", 0x7ffe49e1df80, 1023) = -1 EINVAL (Invalid argument) readlink("/etc/localtime", "/etc/zoneinfo/America/New_York", 1023) = 30 readlink("/etc", 0x7ffe49e1df80, 1023) = -1 EINVAL (Invalid argument) readlink("/etc/zoneinfo", "/etc/static/zoneinfo", 1023) = 20 readlink("/etc", 0x7ffe49e1df80, 1023) = -1 EINVAL (Invalid argument) readlink("/etc/static", "/nix/store/6kl3d31pr7758zci66kzy"..., 1023) = 51 readlink("/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc", 0x7ffe49e1df80, 1023) = -1 EINVAL (Invalid argument) readlink("/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc/etc", 0x7ffe49e1df80, 1023) = -1 EINVAL (Invalid argument) readlink("/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc/etc/zoneinfo", "/nix/store/g9fkd8j29j0dmln6xinp3"..., 1023) = 71 newfstatat(AT_FDCWD, "/etc", {st_mode=S_IFDIR|0755, st_size=1382, ...}, 0) = 0 ``` > Or if possible use `firejail --trace=trace.txt`. > Example: > ``` > $ firejail --trace=trace.txt \ > /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ > --name=offline-librewolf --no-remote; grep /etc trace.txt > ``` I ran.. ``` firejail --trace=trace.txt \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote; grep /etc trace.txt $ ls -s trace.txt 0 trace.txt ``` There was no output regarding /etc. I checked and trace.txt is a 0 byte file. I deleted it and reran to confirm it did in fact create the file, and it did - but 0 bytes output to it.

gitea-mirror commented

2026-05-05 09:57:53 -06:00

Author

Owner

@kmk3 commented on GitHub (Aug 10, 2025):

$ strace --trace=%file \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote 2>&1 | grep -E '/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc|"/etc' | 
  grep -v "No such file or directory"
newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0664, st_size=60, ...}, 0) = 0
[...]

Nothing stands out to me from the output.

I ran..
firejail --trace=trace.txt \
    /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
    --name=offline-librewolf --no-remote; grep /etc trace.txt

$ ls -s trace.txt 
0 trace.txt
There was no output regarding /etc. I checked and trace.txt is a 0 byte file.
I deleted it and reran to confirm it did in fact create the file, and it did

but 0 bytes output to it.

It could be due to needing --allow-debuggers or --profile or due to
whitelisting in ${HOME}, in which case it might be needed to write it
somewhere else (like /tmp).

Also, -f might be needed for strace (see #6851).

Can you retry with the following?

strace -f --trace=%file -o /tmp/strace.txt \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote
echo
grep etc /tmp/strace.txt

firejail --allow-debuggers --trace=/tmp/fjtrace.txt --ignore=private-tmp \
  --profile=/etc/firejail/librewolf.profile \
  /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \
  --name=offline-librewolf --no-remote
echo
grep etc /tmp/fjtrace.txt

@kmk3 commented on GitHub (Aug 10, 2025): > ``` > $ strace --trace=%file \ > /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ > --name=offline-librewolf --no-remote 2>&1 | grep -E '/nix/store/6kl3d31pr7758zci66kzy2kszqr3fhrq-etc|"/etc' | > grep -v "No such file or directory" > newfstatat(AT_FDCWD, "/etc/resolv.conf", {st_mode=S_IFREG|0664, st_size=60, ...}, 0) = 0 > [...] > ``` Nothing stands out to me from the output. > I ran.. > > ``` > firejail --trace=trace.txt \ > /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ > --name=offline-librewolf --no-remote; grep /etc trace.txt > > $ ls -s trace.txt > 0 trace.txt > ``` > > There was no output regarding /etc. I checked and trace.txt is a 0 byte file. > I deleted it and reran to confirm it did in fact create the file, and it did > - but 0 bytes output to it. It could be due to needing `--allow-debuggers` or `--profile` or due to whitelisting in `${HOME}`, in which case it might be needed to write it somewhere else (like /tmp). Also, `-f` might be needed for strace (see #6851). Can you retry with the following? ```sh strace -f --trace=%file -o /tmp/strace.txt \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote echo grep etc /tmp/strace.txt ``` ```sh firejail --allow-debuggers --trace=/tmp/fjtrace.txt --ignore=private-tmp \ --profile=/etc/firejail/librewolf.profile \ /nix/store/yfa5zcwg8xgpp0icm478kf2k9axpmcx7-librewolf-140.0.4-1/bin/librewolf \ --name=offline-librewolf --no-remote echo grep etc /tmp/fjtrace.txt ```

gitea-mirror commented

2026-05-05 09:57:54 -06:00

Author

Owner

@graham00 commented on GitHub (Aug 10, 2025):

Thanks. Here is the grep'd strace output.

The fjtrace.txt is unfortunately still a 0 byte file.

@graham00 commented on GitHub (Aug 10, 2025): Thanks. [Here](https://pastebin.com/r5jGeb8d) is the grep'd strace output. The fjtrace.txt is unfortunately still a 0 byte file.

Rows
Columns

[GH-ISSUE #6843] librewolf: UI has graphic corruption (NixOS, 3d + private-etc) #3396

Description

Steps to Reproduce

Expected behavior

Actual behavior

Behavior without a profile

Additional context

Environment

Checklist