github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6967] librewolf: program does not load system fonts properly #3437

New issue

Closed

opened 2026-05-05 09:59:59 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:59:59 -06:00

Owner

Originally created by @aschwarzusp on GitHub (Nov 12, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6967

Description

Firejailed apps cannot load system font configs properly, load the first in alphabetical order from the fonts folders.

This affects at least Librewolf and Telegram-Desktop. Highly likely to affect Firefox as well, because fj profiles for LW and FF are similar.

I tried copying librewolf profile to my home dir and whitelisting (and noblacklisting) /etc/fonts (and /etc/fonts/fonts.d and /etc/fonts/fonts.avail), but this does not make any difference.

Steps to Reproduce

Use Gentoo or any other distribution that stores font configs on the /etc/fonts/fonts.conf file and on the /etc/fonts/fonts.{d,avail} directories.
Install firejail, then media-fonts/fontawesome (a js font whose name comes first in an ordered list)
run firejail librewolf (this also affects open file dialog on Librewolf and Telegram-Desktop)
Behold the messed fonts on menus, toolbars and

Expected behavior

Librewolf using usual system fonts for menus, toolbars and plainly configured websites instead of that js font.

Everything is displayed fine if LW/Telegram-desktop are launched without firejail.

Actual behavior

Messed fonts in menus, toolbars, etc.

Behavior without a profile

Haven't tested without profile, but everything works fine without firejail.

Linux Gentoo 6.17.7
Gentoo Linux,
Librewolf and Telegram-Desktop
0.9.76

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.

Log

Output of LC_ALL=C firejail /path/to/program

Will add this later. Cannot log into github from home right now where I can run those commands.

Output of LC_ALL=C firejail --debug /path/to/program

output goes here

Originally created by @aschwarzusp on GitHub (Nov 12, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6967  ### Description Firejailed apps cannot load system font configs properly, load the first in alphabetical order from the fonts folders. This affects at least Librewolf and Telegram-Desktop. Highly likely to affect Firefox as well, because fj profiles for LW and FF are similar. I tried copying librewolf profile to my home dir and whitelisting (and noblacklisting) /etc/fonts (and /etc/fonts/fonts.d and /etc/fonts/fonts.avail), but this does not make any difference. ### Steps to Reproduce 1. Use Gentoo or any other distribution that stores font configs on the /etc/fonts/fonts.conf file and on the /etc/fonts/fonts.{d,avail} directories. 2. Install firejail, then media-fonts/fontawesome (a js font whose name comes first in an ordered list) 3. run `firejail librewolf` (this also affects open file dialog on Librewolf and Telegram-Desktop) 4. Behold the messed fonts on menus, toolbars and ### Expected behavior Librewolf using usual system fonts for menus, toolbars and plainly configured websites instead of that js font. Everything is displayed fine if LW/Telegram-desktop are launched without firejail. ### Actual behavior Messed fonts in menus, toolbars, etc. ### Behavior without a profile Haven't tested without profile, but everything works fine without firejail. - Linux Gentoo 6.17.7 - Gentoo Linux, - Librewolf and Telegram-Desktop - 0.9.76 ### Checklist  - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> Will add this later. Cannot log into github from home right now where I can run those commands. </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` output goes here ``` </p> </details>

gitea-mirror

2026-05-05 09:59:59 -06:00

closed this issue
added the
notabug
label

gitea-mirror commented

2026-05-05 10:00:01 -06:00

Author

Owner

@aschwarzusp commented on GitHub (Nov 13, 2025):

Solved by changing private-etc librewolf to private-etc librewolf,fonts/conf.d,fonts/conf.avail on the Librewolf profile.

@aschwarzusp commented on GitHub (Nov 13, 2025): Solved by changing `private-etc librewolf` to `private-etc librewolf,fonts/conf.d,fonts/conf.avail` on the Librewolf profile.

gitea-mirror commented

2026-05-05 10:00:02 -06:00

Author

Owner

@kmk3 commented on GitHub (Nov 14, 2025):

Solved by changing private-etc librewolf to private-etc librewolf,fonts/conf.d,fonts/conf.avail on the Librewolf profile.

This should not be necessary as fonts is already part of the @default
private-etc group (and thus included automatically).

So unless you are manually whitelisting something inside of fonts (like
private-etc fonts/foo), this should not be necessary.

@kmk3 commented on GitHub (Nov 14, 2025): > Solved by changing `private-etc librewolf` to `private-etc > librewolf,fonts/conf.d,fonts/conf.avail` on the Librewolf profile. This should not be necessary as `fonts` is already part of the `@default` `private-etc` group (and thus included automatically). So unless you are manually whitelisting something inside of `fonts` (like `private-etc fonts/foo`), this should not be necessary.

gitea-mirror commented

2026-05-05 10:00:03 -06:00

Author

Owner

@aschwarzusp commented on GitHub (Nov 14, 2025):

Solved by changing private-etc librewolf to private-etc librewolf,fonts/conf.d,fonts/conf.avail on the Librewolf profile.

This should not be necessary as fonts is already part of the @default private-etc group (and thus included automatically).

So unless you are manually whitelisting something inside of fonts (like private-etc fonts/foo), this should not be necessary.

That is indeed the case. conf.avail and conf.d are subdirectories of /etc/fonts, and the /etc/fonts.conf file include/import files inside them. If those subdirectories are not included in the private environment, this error occurs.

@aschwarzusp commented on GitHub (Nov 14, 2025): > > Solved by changing `private-etc librewolf` to `private-etc librewolf,fonts/conf.d,fonts/conf.avail` on the Librewolf profile. > > This should not be necessary as `fonts` is already part of the `@default` `private-etc` group (and thus included automatically). > > So unless you are manually whitelisting something inside of `fonts` (like `private-etc fonts/foo`), this should not be necessary. That is indeed the case. `conf.avail` and `conf.d` are subdirectories of /etc/fonts, and the `/etc/fonts.conf` file include/import files inside them. If those subdirectories are not included in the private environment, this error occurs.

gitea-mirror referenced this issue

2026-05-05 10:26:05 -06:00

[PR #3437] [MERGED] new profile: mocp #4760

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3437

No description provided.

Rows
Columns