[GH-ISSUE #6973] vlc: icon in taskbar has black background instead of transparent

gitea-mirror commented

2026-05-05 10:00:11 -06:00

Owner

Originally created by @mYnDstrEAm on GitHub (Nov 26, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6973

Description

The first image shows how the icon looks like in Debian 13 with KDE any Wayland when I run vlc, the second image show how it looks like when I run firejail vlc.

Edit: in those small images it's not as visible because the background is gray but it looks ugly and eye-catching; all the other app icons display fine there except the VLC player.

I think something needs to be changed in the VLC profile (maybe also a profile that is used there or also other profiles). Until the fix is distributed to Debian 13 users, I'd like to know what to write into ~/.config/firejail/vlc.profile to fix this

Steps to Reproduce

Run in bash firejail vlc
See the Plasma taskbar

Expected behavior

Transparent background of VLC player

Actual behavior

Black background of VLC player

Behavior without a profile

What changed calling LC_ALL=C firejail --noprofile /path/to/program in a
terminal?
It shows the correct icon with transparent background.

Additional context

Environment

Name/version/arch of the Linux kernel (uname -srm): Linux 6.12.57+deb13-amd64 x86_64
Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Debian 13
Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1,
mesa 1:24.3.3-2"): 3.0.21
Version of Firejail (firejail --version): 0.9.74
If you use a development version of firejail, also the commit from which it
was compiled (git rev-parse HEAD):

Checklist

I am using a supported version of firejail
I am using the full program path (e.g. firejail /usr/bin/vlc instead of firejail vlc; see https://github.com/netblue30/firejail/issues/2877)
The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

Reading profile /etc/firejail/vlc.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-common.local
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-player-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /home/username/.config/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
firejail version 0.9.74

Parent pid 3713388, child pid 3713392
Warning: cannot find /var/run/utmp
6 programs installed in x.xx ms
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Base filesystem installed in xxx.xx ms
Child process initialized in xxx.xx ms
VLC media player 3.0.21 Vetinari (revision 3.0.21-0-gdd8bfdbabe8)
[00005602b74eb400] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
Qt: Session management error: None of the authentication protocols specified are supported

Output of LC_ALL=C firejail --debug /path/to/program

Looking for kernel processes
Found kthreadd process, we are not running in a sandbox
pid=3714283: locking /run/firejail/firejail-run.lock ...
pid=3714283: locked /run/firejail/firejail-run.lock
pid=3714283: unlocking /run/firejail/firejail-run.lock ...
pid=3714283: unlocked /run/firejail/firejail-run.lock
Building quoted command line: '/usr/bin/vlc' 
Command name #vlc#
Found vlc.profile profile in /etc/firejail directory
Reading profile /etc/firejail/vlc.profile
Cannot access .local file vlc.local: No such file or directory, skipping...
Cannot access .local file globals.local: No such file or directory, skipping...
Found disable-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-common.inc
Found disable-common.local profile in /etc/firejail directory
Reading profile /etc/firejail/disable-common.local
Found disable-devel.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-devel.inc
Cannot access .local file disable-devel.local: No such file or directory, skipping...
Found disable-exec.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-exec.inc
Cannot access .local file disable-exec.local: No such file or directory, skipping...
Found disable-interpreters.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-interpreters.inc
Cannot access .local file disable-interpreters.local: No such file or directory, skipping...
Found disable-programs.inc profile in /etc/firejail directory
Reading profile /etc/firejail/disable-programs.inc
Cannot access .local file disable-programs.local: No such file or directory, skipping...
Found whitelist-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/whitelist-common.inc
Cannot access .local file whitelist-common.local: No such file or directory, skipping...
Found whitelist-player-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/whitelist-player-common.inc
Cannot access .local file whitelist-player-common.local: No such file or directory, skipping...
Found whitelist-run-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/whitelist-run-common.inc
Cannot access .local file whitelist-run-common.local: No such file or directory, skipping...
Found whitelist-runuser-common.inc profile in /etc/firejail directory
Reading profile /etc/firejail/whitelist-runuser-common.inc
Cannot access .local file whitelist-runuser-common.local: No such file or directory, skipping...
Found whitelist-var-common.inc profile in /home/username/.config/firejail directory
Reading profile /home/username/.config/firejail/whitelist-var-common.inc
Cannot access .local file whitelist-var-common.local: No such file or directory, skipping...
Warning: networking feature is disabled in Firejail configuration file
[profile] combined protocol list: "unix,inet,inet6,netlink"
firejail version 0.9.74

pid=3714283: locking /run/firejail/firejail-run.lock ...
pid=3714283: locked /run/firejail/firejail-run.lock
DISPLAY=:1 parsed as 1
pid=3714283: unlocking /run/firejail/firejail-run.lock ...
pid=3714283: unlocked /run/firejail/firejail-run.lock
xdg-dbus-proxy arg: unix:path=/run/user/1000/bus
xdg-dbus-proxy arg: /run/firejail/dbus/1000/3714283-user
xdg-dbus-proxy arg: --filter
xdg-dbus-proxy arg: --own=org.mpris.MediaPlayer2.vlc
xdg-dbus-proxy arg: --talk=org.freedesktop.Notifications
xdg-dbus-proxy arg: --talk=org.freedesktop.ScreenSaver
xdg-dbus-proxy arg: --talk=org.mpris.MediaPlayer2.Player
starting xdg-dbus-proxy
sbox exec: /usr/bin/xdg-dbus-proxy --fd=4 --args=5 
Dropping all capabilities
Drop privileges: pid 3714284, uid 1000, gid 1000, force_nogroups 1
No supplementary groups
xdg-dbus-proxy initialized
Using the local network stack
Parent pid 3714283, child pid 3714287
Initializing child process
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file
Build protocol filter: unix,inet,inet6,netlink
sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6,netlink /run/firejail/mnt/seccomp/seccomp.protocol 
Dropping all capabilities
Drop privileges: pid 2, uid 1000, gid 1000, force_nogroups 1
No supplementary groups
Drop privileges: pid 3, uid 1000, gid 1000, force_nogroups 0
nogroups command not ignored
No supplementary groups
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
[.....]

Originally created by @mYnDstrEAm on GitHub (Nov 26, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6973 ### Description The first image shows how the icon looks like in Debian 13 with KDE any Wayland when I run `vlc`, the second image show how it looks like when I run `firejail vlc`. <img width="26" height="31" alt="Image" src="https://github.com/user-attachments/assets/55eb88ee-e762-4927-bb71-255382d5bf7a" /> <img width="31" height="31" alt="Image" src="https://github.com/user-attachments/assets/ac18d0db-3229-4ded-8c87-0e4d05488519" /> Edit: in those small images it's not as visible because the background is gray but it looks ugly and eye-catching; all the other app icons display fine there except the VLC player. I think something needs to be changed in the VLC profile (maybe also a profile that is used there or also other profiles). Until the fix is distributed to Debian 13 users, I'd like to know what to write into `~/.config/firejail/vlc.profile` to fix this ### Steps to Reproduce 1. Run in bash `firejail vlc` 2. See the Plasma taskbar ### Expected behavior Transparent background of VLC player ### Actual behavior Black background of VLC player ### Behavior without a profile _What changed calling `LC_ALL=C firejail --noprofile /path/to/program` in a terminal?_ It shows the correct icon with transparent background. ### Additional context ### Environment - Name/version/arch of the Linux kernel (`uname -srm`): Linux 6.12.57+deb13-amd64 x86_64 - Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Debian 13 - Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1, mesa 1:24.3.3-2"): 3.0.21 - Version of Firejail (`firejail --version`): 0.9.74 - If you use a development version of firejail, also the commit from which it was compiled (`git rev-parse HEAD`): ### Checklist - [ ] I am using a [supported version](https://github.com/netblue30/firejail/tree/master/SECURITY.md) of firejail - [x] I am using the full program path (e.g. `firejail /usr/bin/vlc` instead of `firejail vlc`; see `https://github.com/netblue30/firejail/issues/2877`) - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` Reading profile /etc/firejail/vlc.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-common.local Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-player-common.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /home/username/.config/firejail/whitelist-var-common.inc Warning: networking feature is disabled in Firejail configuration file firejail version 0.9.74 Parent pid 3713388, child pid 3713392 Warning: cannot find /var/run/utmp 6 programs installed in x.xx ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Base filesystem installed in xxx.xx ms Child process initialized in xxx.xx ms VLC media player 3.0.21 Vetinari (revision 3.0.21-0-gdd8bfdbabe8) [00005602b74eb400] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface. Qt: Session management error: None of the authentication protocols specified are supported ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` Looking for kernel processes Found kthreadd process, we are not running in a sandbox pid=3714283: locking /run/firejail/firejail-run.lock ... pid=3714283: locked /run/firejail/firejail-run.lock pid=3714283: unlocking /run/firejail/firejail-run.lock ... pid=3714283: unlocked /run/firejail/firejail-run.lock Building quoted command line: '/usr/bin/vlc' Command name #vlc# Found vlc.profile profile in /etc/firejail directory Reading profile /etc/firejail/vlc.profile Cannot access .local file vlc.local: No such file or directory, skipping... Cannot access .local file globals.local: No such file or directory, skipping... Found disable-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-common.inc Found disable-common.local profile in /etc/firejail directory Reading profile /etc/firejail/disable-common.local Found disable-devel.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-devel.inc Cannot access .local file disable-devel.local: No such file or directory, skipping... Found disable-exec.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-exec.inc Cannot access .local file disable-exec.local: No such file or directory, skipping... Found disable-interpreters.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-interpreters.inc Cannot access .local file disable-interpreters.local: No such file or directory, skipping... Found disable-programs.inc profile in /etc/firejail directory Reading profile /etc/firejail/disable-programs.inc Cannot access .local file disable-programs.local: No such file or directory, skipping... Found whitelist-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/whitelist-common.inc Cannot access .local file whitelist-common.local: No such file or directory, skipping... Found whitelist-player-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/whitelist-player-common.inc Cannot access .local file whitelist-player-common.local: No such file or directory, skipping... Found whitelist-run-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/whitelist-run-common.inc Cannot access .local file whitelist-run-common.local: No such file or directory, skipping... Found whitelist-runuser-common.inc profile in /etc/firejail directory Reading profile /etc/firejail/whitelist-runuser-common.inc Cannot access .local file whitelist-runuser-common.local: No such file or directory, skipping... Found whitelist-var-common.inc profile in /home/username/.config/firejail directory Reading profile /home/username/.config/firejail/whitelist-var-common.inc Cannot access .local file whitelist-var-common.local: No such file or directory, skipping... Warning: networking feature is disabled in Firejail configuration file [profile] combined protocol list: "unix,inet,inet6,netlink" firejail version 0.9.74 pid=3714283: locking /run/firejail/firejail-run.lock ... pid=3714283: locked /run/firejail/firejail-run.lock DISPLAY=:1 parsed as 1 pid=3714283: unlocking /run/firejail/firejail-run.lock ... pid=3714283: unlocked /run/firejail/firejail-run.lock xdg-dbus-proxy arg: unix:path=/run/user/1000/bus xdg-dbus-proxy arg: /run/firejail/dbus/1000/3714283-user xdg-dbus-proxy arg: --filter xdg-dbus-proxy arg: --own=org.mpris.MediaPlayer2.vlc xdg-dbus-proxy arg: --talk=org.freedesktop.Notifications xdg-dbus-proxy arg: --talk=org.freedesktop.ScreenSaver xdg-dbus-proxy arg: --talk=org.mpris.MediaPlayer2.Player starting xdg-dbus-proxy sbox exec: /usr/bin/xdg-dbus-proxy --fd=4 --args=5 Dropping all capabilities Drop privileges: pid 3714284, uid 1000, gid 1000, force_nogroups 1 No supplementary groups xdg-dbus-proxy initialized Using the local network stack Parent pid 3714283, child pid 3714287 Initializing child process Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp directory Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file Build protocol filter: unix,inet,inet6,netlink sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6,netlink /run/firejail/mnt/seccomp/seccomp.protocol Dropping all capabilities Drop privileges: pid 2, uid 1000, gid 1000, force_nogroups 1 No supplementary groups Drop privileges: pid 3, uid 1000, gid 1000, force_nogroups 0 nogroups command not ignored No supplementary groups Mounting /proc filesystem representing the PID namespace Basic read-only filesystem: Mounting read-only /etc [.....] ``` </p> </details>

gitea-mirror added the

needinfo

old-version

labels 2026-05-05 10:00:11 -06:00

2026-05-05 10:00:13 -06:00

Author

@kmk3 commented on GitHub (Nov 27, 2025):

Missing information.

Logs

Run in bash firejail vlc

Version of Firejail (firejail --version): 0.9.74

Checklist

I am using a supported version of firejail

I am using the full program path (e.g. firejail /usr/bin/vlc instead of firejail vlc; see https://github.com/netblue30/firejail/issues/2877)

Both are incorrect.

What happens with a supported version and the correct commands?

@kmk3 commented on GitHub (Nov 27, 2025): > Behavior without a profile Missing information. > Logs Missing information. > 1. Run in bash `firejail vlc` > * Version of Firejail (`firejail --version`): 0.9.74 > ### Checklist > > * [x] I am using a [supported version](https://github.com/netblue30/firejail/tree/master/SECURITY.md) of firejail > * [x] I am using the full program path (e.g. `firejail /usr/bin/vlc` instead of `firejail vlc`; see `https://github.com/netblue30/firejail/issues/2877`) Both are incorrect. What happens with a supported version and the correct commands?

2026-05-05 10:00:14 -06:00

@mYnDstrEAm commented on GitHub (Nov 27, 2025):

Added.

Fixed. This is the latest version available in Debian 13 with no newer version in backports. I did run firejail /usr/bin/vlc but just didn't put it into the description.

I can't get a newer version of firejail. I used the correct commands (firejail /usr/bin/vlc). How is this similar to the other issue or were just saying I should also add the info there. I'll edit the other issue too but I don't run firefox without a profile and it would be better to check if this problem of not opening links also occurs for other computers/users...it doesn't have to be the same app but I suspect it also doesn't work for other users with the latest version and the same default Web browser configuration.

@mYnDstrEAm commented on GitHub (Nov 27, 2025): >Missing information. Added. >Missing information. Added. >Both are incorrect. Fixed. This is the latest version available in Debian 13 with [no newer version in backports](https://packages.debian.org/search?mode=filename&suite=trixie-backports&section=all&arch=amd64&searchon=contents&keywords=firejail). I did run firejail /usr/bin/vlc but just didn't put it into the description. >What happens with a supported version and the correct commands? I can't get a newer version of firejail. I used the correct commands (`firejail /usr/bin/vlc`). How is this similar to the other issue or were just saying I should also add the info there. I'll edit the other issue too but I don't run firefox without a profile and it would be better to check if this problem of not opening links also occurs for other computers/users...it doesn't have to be the same app but I suspect it also doesn't work for other users with the latest version and the same default Web browser configuration.

gitea-mirror referenced this issue

2026-05-05 10:26:09 -06:00

[PR #3442] [MERGED] prioritize installing via OS #4762

[PR #3440] [MERGED] Man pages: were missing info about .profile .local resolution #4764

2026-05-05 10:51:17 -06:00

[PR #6706] [MERGED] docs: improve URL formatting in man pages #6129