mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #6857] chromium: ERR_INTERNET_DISCONNECTED: cannot connect to the Internet #3399
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3399
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @nva1 on GitHub (Aug 9, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6857
Description
Chromium browsers do not connect to the Internet when sandboxed. I have all applications sandboxed, and until recently I was not having any problems. This occurs with Chromium, Brave, and Edge. It occurred randomly, perhaps after an update, a few weeks ago. Restoring to a previous Timeshift restore point did not resolve the issue. I reverted my local chromium-common.profile back to the original in /etc/firejail and ran
sudo firecfg --cleanandsudo firecfg, but this did not resolve the issue. I also tried purging and reinstalling Firejail, but this did not help.Steps to Reproduce
Expected behavior
Expected behavior is that Chromium based browsers would connect to the Internet while sandboxed.
Actual behavior
When opening a Chromium based browser, the error message appears for all sites:
Behavior without a profile
Chromium based browser works as expected, but it is not sandboxed.
Additional context
This is my chromium-common.profile in ~/.config/firejail. The only change from the default in /etc/firejail is I previously uncommented the line
dbus-user none. I did a while back when I suddenly could not enter any keyboard input on Chromium based browsers. This resolved that issue and was long before the Internet connectivity issue this issue is about.The issue at hand occurs using the default profile or with the edited local one. I made sure to run
sudo firecfg --cleanandsudo firecfgafter making any changes to the local one.~/.config/firejail/chromium-common.profile
Environment
uname -srm):mesa 1:24.3.3-2"):
firejail --version):was compiled (
git rev-parse HEAD):Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)mkdir ${HOME}/.pkion line 35 anddbus-user noneuncommented on line 55. The issue occurs with or without commenting this out.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail chromium@kmk3 commented on GitHub (Aug 10, 2025):
Thanks for the details.
My guess would be that it's due to
private-devorprivate-etc, but they donot seem to be used by chromium.profile.
You can try commenting lines in the relevant profile(s) to see which lines are
causing issues and post them here.
Relevant profiles:
@nva1 commented on GitHub (Aug 12, 2025):
So I do not have a blink.profile. I do have blink-common.profile in /etc. I copied that and chromium.profile to ~/.config/firejail/. The only relevant lines I commented out are
#private-tmp # issues when using multiple browser sessionsin chromium-common.profile and#private-cachein blink-common.profile.#private-bin chromium,chromium-browser,chromedriverwas already commented out in chromium.profile. Unfortunately, no difference.@kmk3 commented on GitHub (Aug 12, 2025):
Yes sorry, I meant blink-common.profile.
You can try for example commenting all whitelist commands, then the
disable-*includes, then whatever else is left.
Alternatively, you can comment everything and then uncomment lines until it
breaks.
@nva1 commented on GitHub (Aug 14, 2025):
Thanks. I tried commenting out all of the below in
chromium-common.profile. Unfortunately still doesn't connect.Separately, I tried commenting out this. No difference.
@nva1 commented on GitHub (Aug 27, 2025):
In my local
blink-common.profileI've tried commenting out:Separately, I tried commenting out in it:
Nothing changed. Since then I removed all symlinks with
sudo firecfg --clean. I then uninstalled and purged firejail and firejail-profiles. I reinstalled it using the PPA this time. Before was the deb from Sourceforge. Before installing with the PPA, I underscored all my local profiles to hide them and deleted /etc/firejail.I'm still having the same problem. I'm not sure what else to try at this point.
Edit:
I'm curious if someone could explain this item in the checklist if there's a possibility it would make any difference.
I am looking in /etc/firejail/firecfg.config, and I do not see either of these lines.
Edit:
I did find those two lines in
firejail.config. I was mistakenly looking infirecfg.config. I made the changes mentioned in the checklist, but no change.@nva1 commented on GitHub (Oct 7, 2025):
I uninstalled and then reinstalled with firejail-0.9.76.tar.xz. Everything is now working.
This was my first time installing Firejail as a binary application. The latest version is currently only available as such. The Chromium Internet connectivity problem occurred with 0.9.74 using both the PPA and the deb package.
I still had to make just one change after sandboxing everything (besides commenting out certain applications in firecfg.config). Chromium based browsers would connect without issue, but I could not enter any keyboard input, something that started several weeks before they stopped connecting to the Internet. To fix this I just uncomment this line in chromium-common.profile:
dbus-user none.@kmk3 commented on GitHub (Oct 7, 2025):
Glad it works now; closing.
If you're using ibus, see:
If not (or if that does not fix it), please open a new bug.
You can use something like d-feet to check which dbus commands it uses.
@lunesar commented on GitHub (Dec 13, 2025):
Since this is already closed I'm not sure if I should just open a new issue as I think this is a bug that can be fixed. I'll post first here for now to prevent opening a duplicate bug. I was able to make a custom profile that allowed it to work. I think that there is something in the default Chromium profile that is the issue and can be resolved.
Description
This is very similar to issue #6857 in that after updating the kernel to 6.14 Chromium based web browsers such as brave could no longer connect to the Internet. This issue is specific to changes in the kernel, as I could boot with a 6.8 kernel and it would once again be able to connect to the internet, but then be unable to with kernel 6.14.
With some effort I have confirmed that there is something in the default profiles that is causing the issue. If I run with
--noprofileor a custom profile it is able to connect to the internet.Steps to Reproduce
Steps to reproduce the behavior
Expected behavior
I expect the web browser to be able to connect to the Internet and load web pages normally.
Actual behavior
When opening web browser the following message appears for all sites:
Behavior without a profile
The web browser works as expected, but without a sandbox.
Additional context
Here is a custom profile that I am usable to use successfully and connect to the internet.
Since this custom sandboxing works there must be something in the stock brave/chromium profiles that makes it no work with kernel 6.14.
Environment
uname -srm):mesa 1:24.3.3-2"):
firejail --version):was compiled (
git rev-parse HEAD):Checklist
firejail /usr/bin/vlcinstead offirejail vlc; seehttps://github.com/netblue30/firejail/issues/2877)/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)@lunesar commented on GitHub (Dec 13, 2025):
Here's debug log files for the output of both the default and custom profiles.
fj-custom-working.log
fj-default-failing.log
@kmk3 commented on GitHub (Dec 14, 2025):
@lunesar
Please open a new bug and make sure to include the command used to open the
program (such as
firejail /usr/bin/foo).That is not the case; see the link.
You can try commenting lines in the profile (and in any redirect profiles)
until it works to find out which lines are causing issues.