mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #6966] Error: Firejail configuration file /etc/firejail/firejail.config not found (private-etc) #3436
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3436
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Antiz96 on GitHub (Nov 12, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6966
Description
Since
d1aeeb4fa1, programs (or specific actions in said program) running from aprivate-etcenvironment fail becausefirejail.configis not accessible from said environment.I'm guessing this is because
checkcfg(0)is now called early in the process in main.c.Steps to Reproduce
Steps to reproduce the behavior
From a firejail build including
d1aeeb4fa1(thunderbird is just an example).LC_ALL=C firejail /usr/local/bin/thunderbird(where/usr/local/bin/thunderbirdis the symlink create byfirecfg)Different scenario
Expected behavior
Program to starts (or actions within this program to work reliably)
Actual behavior
Program fails to start (or specific actions triggering something outside of the sandboxed environment fail).
Behavior without a profile
Both
LC_ALL=C firejail --noprofile /usr/local/bin/thunderbirdandLC_ALL=C firejail --noprofile /usr/bin/thunderbirdwork as expected (where/usr/local/bin/thunderbirdis the symlink create byfirecfg).Additional context
Adding
private-etc firejail/firejail.configto e.g.~/.config/firejail/thunderbird.localfixes (or "works around") the issue.I reported this issue a few days in the related MR at https://github.com/netblue30/firejail/pull/6878#discussion_r2490670980
Environment
uname -srm): Linux 6.17.7-arch1-1 x86_64mesa 1:24.3.3-2"): Mozilla Thunderbird 144.0.1
firejail --version): Tried both withfirejail version 0.9.76with thed1aeeb4fa1commit backported or with a build from the master branch directly.was compiled (
git rev-parse HEAD):7e26e940c2Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)Log
Output of
LC_ALL=C firejail /usr/local/bin/thunderbird(where `/usr/local/bin/thunderbird` is the symlink create by `firecfg`)Output of
LC_ALL=C firejail --debug /path/to/program@kmk3 commented on GitHub (Nov 13, 2025):
Yes, I also think that this line is likely what causes it.
But from a brief look at it I don't really understand why.
The issue seems to be the same as in:
Does it work with the following?
@Antiz96 commented on GitHub (Nov 13, 2025):
Definitely the same as in #6959.
We have backported
d1aeeb4fa1into the Arch Linux package (see https://gitlab.archlinux.org/archlinux/packaging/packages/firejail/-/issues/1#note_347916), which explains why this user is suffering from this issue with it.Just in case, as said in my report, I've reproduced this issue from a development version too. So the backport itself is not the culprit, the issue is also present when building from the master branch / HEAD.
I've also covered this case in my report, see below:
@kmk3 commented on GitHub (Nov 19, 2025):
I remember seeing this message when I was working on #6878 and testing some
unrelated thing, but the firejail commands being executed weren't related to
thunderbird and I'm not sure if
private-etcwas involved.After I switched branches (or rebased to master or whatever) and rebuilt
firejail, running the same exact commands stopped causing the error message
(and I'm fairly sure I had at least the
arg-maxcode and maybe also theenv-maxcode in the checked out branch, though it's been a while).Which makes me think that there may be a race condition or something similar
involved (in such a way that changing something unrelated in the code and
recompiling could trigger it).
See also the commits that caused/fixed #2877 (the latter commit mentions an
"an early [checkcfg] check").
8bff773d6ad32509945fI see, my bad.
I don't use email in thunderbird ("clicking a link from an email"); is there a
simple way to reproduce it from something like firefox?
Does it only happen when dbus is used?
For the time being I'm thinking of just commenting the
checkcfg(0)line andleaving the rest of the code as is until someone feels like debugging and
finding out why it actually happens, as there is already enough breakage in the
current version:
@Antiz96 commented on GitHub (Nov 19, 2025):
Simply running
firejail /usr/local/bin/firefox(where/usr/local/bin/firefoxis the symlink created byfirecfg) is enough to reproduce the issue:@kmk3 commented on GitHub (Nov 20, 2025):
This seems to be equivalent to running
firejail firefox(instead of therecommended
firejail /usr/bin/firefoxor justfirefox).Running firejail-in-firejail is known to cause this (among other) issues; see:
How can the issue be reproduced without firejail-in-firejail?
@Antiz96 commented on GitHub (Nov 20, 2025):
Indeed, that's right. Although it was working fine before.
Well, does the first reproducer I gave with thunderbird count as "firejail-in-firejail"? This issue occurs when running thunderbird in firejail and then try to open a link from there in firefox (also running in firejail). In that case it's not really "firejail-in-firejail" but more like "firejail-to-firejail" (which used to work fine before
d1aeeb4fa1).I understand if you say that the exposed issue and reproducer scenario falls under the above, it's indeed pretty likely that this is cause by some "firejail in firejail (or firejail to firejail)" interaction. But one thing I can reliably say is that every scenarios I exposed in this issue used to work fine before
d1aeeb4fa1so there's definitely a regression somewhere in there.I remain available if there's any additional information /test I can provide and I'll let you know if I can find other reproducer! 🙂
@kmk3 commented on GitHub (Nov 21, 2025):
I see, thanks.
In the thunderbird -> firefox scenario, the error happens in firefox right?
Could it be that firefox is being invoked as firejail-in-firejail by
thunderbird?
What is the exact command that thunderbird calls?
Does it work after
sudo rm /usr/local/bin/firefox?Yes, from what is being reported it appears that the commit has made the issue
worse/more apparent, though firejail-in-firejail has been (sometimes subtly)
broken (and not recommended) for a long time.
Though arguably it might be better to outright crash with firejail-in-firejail
than for it to randomly break things (and especially with it not being obvious
to the user that the breakage is due to firejail-in-firejail).
Maybe for the time being we could intentionally abort early and clarify the
situation by showing an error saying that firejail-in-firejail is not
supported.
@Antiz96 commented on GitHub (Nov 21, 2025):
No, it's shown in firejail's thunderbird logs.
1 - Run
thunderbird(from thefirecfgsymlink) orfirejail /usr/bin/thunderbird2 - Click a link from a mail
3 - See "Error: Firejail configuration file /etc/firejail/firejail.config not found" appearing in the logs of the command executed in step 1.
Well, I ran
firecfgso both thunderbird and firefox runs under firejail by default. So thunderbird indeed tries to contact firefox while they are both being sandboxed (which is definitely part of the culprit, as it works if Isudo rm /usr/local/bin/firefox, as said later in this comment).However, I'm not sure if it necessary tries to "invoke" it per say though. It is supposed to open the link in my currently running (and sandboxed) firefox instance, not invoke a new instance. Hence why I said it's unclear to me if it's really a "firejail-in-firejail" case or more of a "firejail-to-firejail" case (if that matters). Basically, I have both thunderbird and firefox respectively started under a firejail sandbox and the former cannot communicate to the latter anymore (e.g. when it comes to opening a link) without being hit by the "Error: Firejail configuration file /etc/firejail/firejail.config not found" issue.
That I do not now I'm afraid. I guess either something like
xdg-open [url]or directlyfirefox [url]basically (probably the latter)?Yes it does, so that confirms that the issue is when a sandboxed "program A" tries to "communicate" with an also sandboxed "program B", which is definitely expected in some cases, but it's unclear if it is for this one particularly (see the last paragraph of my comment).
I totally get your point.
Although, does that mean that opening links from a "firejailed" thunderbird instance to a "firejailed" firefox instance is expected not to work by default for example?
As it used to work fine before
d1aeeb4fa1and as there are dedicated parameters in the default thunderbird profile on that front (see here, unless it assumes a "non-firejailed" firefox ?), it's a bit confusing from a user point of view.All and all, I would understand if such cases would be considered unsupported upstream wise. But if that's the case, I guess it would indeed be relevant to clarify it (e.g. from the logs / default behavior). Given the above, it's unclear if it's a regression or the intended behavior (even though that was luckily working before, somehow). As I said in the issue description, adding
private-etc firejail/firejail.configto~/.config/firejail/thunderbird.localworks as a workaround, I can live that 🙂I will give https://github.com/netblue30/firejail/pull/6970 a test soon to see if it helps. I'll report back shortly!
EDIT: It doesn't help unfortunately 😕
@kmk3 commented on GitHub (Nov 22, 2025):
Do you mean in the same terminal output as thunderbird?
If so, thunderbird might be trying to open the firefox executable inside of its
own sandbox instead of using something like dbus.
Does anything change if only thunderbird is running (and not firefox) before
opening the link?
So maybe it's as simple as firejailed thunderbird calling just
firefox, whichcalls
/usr/local/bin/firefox->firejail->firejail /usr/bin/firefox(which is supported) and firefox breaks when looking for
/etc/firejail/firejail.config because thunderbird has
private-etc.Edit: I can reproduce it easily by using just firejail-in-firejail +
private-etc:It's expected to work if the caller uses some form of IPC like dbus (which
bypasses the sandbox).
If not, it's more likely to break in general, as in this scenario firefox would
be running under the same sandbox as thunderbird (which was configured by
thunderbird.profile rather than firefox.profile).
Without IPC it can be made to work, but it's difficult to keep the right
balance in the caller profile to allow running other programs (especially big
and complex ones like a web browser).
I wasn't too sure, but maybe adding
firejail/firejail.configto the defaultprivate-etcgroup would indeed be a good enough solution.Edit: It seems that the proper fix would be doing the sandbox check before
calling
checkcfg, so that firejail does not even try to read firejail.configif an existing sandbox is detected:
@Antiz96 commented on GitHub (Nov 22, 2025):
Yes.
Maybe yeah 🤔
Nop, nothing happens visually and same error in the terminal output:
Error: Firejail configuration file /etc/firejail/firejail.config not foundThat's also my understanding.
Well, the caller should use dbus in that case I assume, not sure if there was recent changes on that front.
Fair enough. Hopefully, I'm not asking for such complex cases to be supported here 👼 😛
That's one possible solution I though of at first, but I wasn't sure if this was a good approach or more of a workaround (as it wasn't completely clear what actually caused this issue in the first place).
Oh, sounds like a promising solution indeed!
I'm happy to give it a go once you consider it ready for a test (I see it's still a draft for now).
@kmk3 commented on GitHub (Nov 22, 2025):
Note: After the push I saw that it broke some things, so I'll merge just the
original commit and open a new PR for the new change.
@Antiz96 commented on GitHub (Nov 22, 2025):
Alright, don't hesitate to ping me if you need tests for the new PR.
I'll be AFK for the rest of the day but I can do some tests tomorrow :)
@ipaqmaster commented on GitHub (Nov 26, 2025):
It would be nice if clicking a link in firejailed thunderbird opened the link in my also firejailed firefox (Different jails). I haven't found a working combination of changes yet.I also caught, today, thunderbird trying to launch firefox via its firejail symlink and making the same complaint as seen in the title. It doesn't seem to acknowledge its already in one and just run it, it tries to run firejail inside firejail. Difficult when both thunderbird and firefox's $PATH entries are firejail symlinks.Addressed/worked around in https://github.com/netblue30/firejail/issues/6981
@netblue30 commented on GitHub (Dec 4, 2025):
@Antiz96 give it a try, it should be fixed now. Thanks tor the report.
@Antiz96 commented on GitHub (Dec 4, 2025):
@netblue30 I built firejail against master but I'm still facing the issue where it looks for whatever link I click as an executable rather than firefox:
@netblue30 commented on GitHub (Dec 5, 2025):
Thanks @Antiz96, give it a try again when you get a chance. I've just put a new fix in. We seem to be fixing it in one place and break it in another. Currently it seems to be running fine on Debian stable.
Also, do you have firefox set up as a symbolic link in /usr/local/bin? For example by running "sudo firecfg"
@Antiz96 commented on GitHub (Dec 5, 2025):
@netblue30 Seems like it's working fine now! 🥳
For what it's worth, I'm still getting warnings that the firejail config isn't found though (unless I add
private-etc firejail/firejail.configin my thunderbird.local conf) but I guess that's expected?:Anyway, regardless of the above warnings, opening links from firejailed thunderbird into firejailed firefox works again now! Thanks 🙂
Yes I do (via
firecfg).@Antiz96 commented on GitHub (Dec 5, 2025):
@kmk3 If that helps, it seems like
ee879a2f26is the fixing commit. Backporting this one (in addition ofd1aeeb4fa1) on top of 0.9.76 seems to work as expected (both regarding the MAX_ARGS feature and the issue exposed here).@netblue30 commented on GitHub (Dec 12, 2025):
@Antiz96 thanks again. I'll close it for now. If it comes back open a new bug!