github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

gvfs type:fuse.gvfsd-fuse - invalid whitelist mount #3460

New issue

Open

opened 2026-05-05 10:00:44 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 10:00:44 -06:00

Owner

Originally created by @Dieterbe on GitHub (Jan 19, 2026).
Original GitHub issue: https://github.com/netblue30/firejail/issues/7035

Description

Hello, this is a continuation from #7006
Flameshot seems to run fine overall, except i see errors in the journal
(and also this seems to cause a restart)

-- Boot ce1514553a00486d8821d5a9aae04dea --
Jan 19 08:18:00 xps systemd[2242]: Started Flameshot.
Jan 19 08:18:01 xps firejail[2481]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount
Jan 19 08:18:03 xps flameshot[2481]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount
Jan 19 08:18:03 xps flameshot[2446]: Error: proc 2446 cannot sync with peer: unexpected EOF
Jan 19 08:18:03 xps flameshot[2446]: Peer 2481 unexpectedly exited with status 1
Jan 19 08:18:03 xps systemd[2242]: flameshot.service: Main process exited, code=exited, status=1/FAILURE
Jan 19 08:18:03 xps systemd[2242]: flameshot.service: Failed with result 'exit-code'.
Jan 19 08:18:03 xps systemd[2242]: flameshot.service: Scheduled restart job, restart counter is at 1.
Jan 19 08:18:03 xps systemd[2242]: Started Flameshot.

Steps to Reproduce

when i run it manually, it seems to work fine. see below. perhaps because the system was up for a while and the issue only occurs earlier on during the startup?

LC_ALL=C firejail /usr/bin/flameshot
Detected locale "C" with character encoding "ANSI_X3.4-1968", which is not UTF-8.
Qt depends on a UTF-8 locale, and has switched to "C.UTF-8" instead.
If this causes problems, reconfigure your locale. See the locale(1) manual
for more information.
"No Flameshot translation found for C"
"No Qt translation found for C"
"No Flameshot translation found for C"
"No Qt translation found for C"

this is how it is launched during startup:

~ ❯❯❯ cat /home/dieter/.config/systemd/user/flameshot.service
[Unit]
Description=Flameshot
PartOf=wl-session.target
After=wl-session.target

[Service]
Restart=always
ExecStart=/usr/local/bin/flameshot

[Install]
WantedBy=wl-session.target
~ ❯❯❯ systemu cat wl-session.target
# /home/dieter/.config/systemd/user/wl-session.target
[Unit]
Description=dieter wayland session
PartOf=graphical-session.target
After=graphical-session.target

[Install]
WantedBy=graphical-session.target
~ ❯❯❯

Expected behavior

no errors in journal, no restart

Actual behavior

first run works without errors

Behavior without a profile

What changed calling LC_ALL=C firejail --noprofile /path/to/program in a
terminal?

seems to work fine too

 ❯❯❯ LC_ALL=C firejail --noprofile /usr/bin/flameshot                                                                                                                                                          ✘ 1 
firejail version 0.9.78

Parent pid 45957, child pid 45958
Base filesystem installed in 0.40 ms
Child process initialized in 6.02 ms
Detected locale "C" with character encoding "ANSI_X3.4-1968", which is not UTF-8.
Qt depends on a UTF-8 locale, and has switched to "C.UTF-8" instead.
If this causes problems, reconfigure your locale. See the locale(1) manual
for more information.
"No Flameshot translation found for C"
"No Qt translation found for C"
"No Flameshot translation found for C"
"No Qt translation found for C"
^C
Parent received signal 2, shutting down the child process...

Child received signal 2, shutting down the sandbox...

Parent is shutting down, bye...
~ ❯❯❯

Additional context

this was originally thought to be a flatpak problem, but i'm quite sure i don't use flatpak. it's installed, but not running

~ ❯❯❯ flatpak ps
~ ❯❯❯ ps -eo pid,comm,args | grep -E 'bwrap|flatpak run' | grep -v grep
~ ❯❯❯ sudo su -                                                                                                      ✘ 1 
[sudo] password for dieter: 
[root@xps ~]# ps -eo pid,comm,args | grep -E 'bwrap|flatpak run' | grep -v grep
[root@xps ~]# ps aux | grep flatp
root       37877  0.0  0.0   6620  4244 pts/9    S+   09:47   0:00 grep flatp
[root@xps ~]# pacman -Qs flatpak
local/flatpak 1:1.16.2-1
    Linux application sandboxing and distribution framework (formerly xdg-app)
[root@xps ~]#

[root@xps ~]# ps aux | grep flameshot
dieter      3343  0.0  0.0   6444  3716 ?        Ss   08:18   0:00 /usr/bin/firejail /usr/bin/flameshot
dieter      3344  0.0  0.0   6464  3552 ?        S    08:18   0:00 /usr/bin/firejail /usr/bin/flameshot
dieter      3372  0.0  0.2 1139104 86380 ?       Sl   08:18   0:01 /usr/bin/flameshot
root       49247  0.0  0.0   6620  4264 pts/9    S+   10:01   0:00 grep flameshot
[root@xps ~]#

i do have a small flameshot.local but seems to only include unrelated configuration:

~ ❯❯❯ cat .config/firejail/flameshot.local
#noblacklist /dev/dri/*
#whitelist /dev/dri/*
ignore no3d
# Undo profile’s DBus lockdown (common cause of QDBusTrayIcon ServiceUnknown)
ignore dbus-user none
ignore dbus-user filter
private-bin grim #needed to actually take screenshots on wayland
~ ❯❯❯

Environment

Linux 6.18.5-arch1-1 x86_64
Arch Linux (btw)
flameshot 13.3.0-2
firejail 0.9.78-1
~ ❯❯❯

Checklist

I am using firejail 0.9.78 or later
[ x I am using the full program path (e.g. firejail /usr/bin/vlc instead of firejail vlc; see https://github.com/netblue30/firejail/issues/2877)
The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

LC_ALL=C firejail /usr/bin/flameshot 
Detected locale "C" with character encoding "ANSI_X3.4-1968", which is not UTF-8.
Qt depends on a UTF-8 locale, and has switched to "C.UTF-8" instead.
If this causes problems, reconfigure your locale. See the locale(1) manual
for more information.
"No Flameshot translation found for C"
"No Qt translation found for C"
"No Flameshot translation found for C"
"No Qt translation found for C"</code></summary>
<p>

Output of LC_ALL=C firejail --debug /path/to/program

fjdebug.txt

see fjdebug.txt

Originally created by @Dieterbe on GitHub (Jan 19, 2026). Original GitHub issue: https://github.com/netblue30/firejail/issues/7035 ### Description Hello, this is a continuation from #7006 Flameshot seems to run fine overall, except i see errors in the journal (and also this seems to cause a restart) ``` -- Boot ce1514553a00486d8821d5a9aae04dea -- Jan 19 08:18:00 xps systemd[2242]: Started Flameshot. Jan 19 08:18:01 xps firejail[2481]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount Jan 19 08:18:03 xps flameshot[2481]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount Jan 19 08:18:03 xps flameshot[2446]: Error: proc 2446 cannot sync with peer: unexpected EOF Jan 19 08:18:03 xps flameshot[2446]: Peer 2481 unexpectedly exited with status 1 Jan 19 08:18:03 xps systemd[2242]: flameshot.service: Main process exited, code=exited, status=1/FAILURE Jan 19 08:18:03 xps systemd[2242]: flameshot.service: Failed with result 'exit-code'. Jan 19 08:18:03 xps systemd[2242]: flameshot.service: Scheduled restart job, restart counter is at 1. Jan 19 08:18:03 xps systemd[2242]: Started Flameshot. ``` ### Steps to Reproduce when i run it manually, it seems to work fine. see below. perhaps because the system was up for a while and the issue only occurs earlier on during the startup? ``` LC_ALL=C firejail /usr/bin/flameshot Detected locale "C" with character encoding "ANSI_X3.4-1968", which is not UTF-8. Qt depends on a UTF-8 locale, and has switched to "C.UTF-8" instead. If this causes problems, reconfigure your locale. See the locale(1) manual for more information. "No Flameshot translation found for C" "No Qt translation found for C" "No Flameshot translation found for C" "No Qt translation found for C" ``` this is how it is launched during startup: ``` ~ ❯❯❯ cat /home/dieter/.config/systemd/user/flameshot.service [Unit] Description=Flameshot PartOf=wl-session.target After=wl-session.target [Service] Restart=always ExecStart=/usr/local/bin/flameshot [Install] WantedBy=wl-session.target ~ ❯❯❯ systemu cat wl-session.target # /home/dieter/.config/systemd/user/wl-session.target [Unit] Description=dieter wayland session PartOf=graphical-session.target After=graphical-session.target [Install] WantedBy=graphical-session.target ~ ❯❯❯ ``` ### Expected behavior no errors in journal, no restart ### Actual behavior first run works without errors ### Behavior without a profile _What changed calling `LC_ALL=C firejail --noprofile /path/to/program` in a terminal?_ seems to work fine too ``` ❯❯❯ LC_ALL=C firejail --noprofile /usr/bin/flameshot ✘ 1 firejail version 0.9.78 Parent pid 45957, child pid 45958 Base filesystem installed in 0.40 ms Child process initialized in 6.02 ms Detected locale "C" with character encoding "ANSI_X3.4-1968", which is not UTF-8. Qt depends on a UTF-8 locale, and has switched to "C.UTF-8" instead. If this causes problems, reconfigure your locale. See the locale(1) manual for more information. "No Flameshot translation found for C" "No Qt translation found for C" "No Flameshot translation found for C" "No Qt translation found for C" ^C Parent received signal 2, shutting down the child process... Child received signal 2, shutting down the sandbox... Parent is shutting down, bye... ~ ❯❯❯ ``` ### Additional context this was originally thought to be a flatpak problem, but i'm quite sure i don't use flatpak. it's installed, but not running ``` ~ ❯❯❯ flatpak ps ~ ❯❯❯ ps -eo pid,comm,args | grep -E 'bwrap|flatpak run' | grep -v grep ~ ❯❯❯ sudo su - ✘ 1 [sudo] password for dieter: [root@xps ~]# ps -eo pid,comm,args | grep -E 'bwrap|flatpak run' | grep -v grep [root@xps ~]# ps aux | grep flatp root 37877 0.0 0.0 6620 4244 pts/9 S+ 09:47 0:00 grep flatp [root@xps ~]# pacman -Qs flatpak local/flatpak 1:1.16.2-1 Linux application sandboxing and distribution framework (formerly xdg-app) [root@xps ~]# ``` ``` [root@xps ~]# ps aux | grep flameshot dieter 3343 0.0 0.0 6444 3716 ? Ss 08:18 0:00 /usr/bin/firejail /usr/bin/flameshot dieter 3344 0.0 0.0 6464 3552 ? S 08:18 0:00 /usr/bin/firejail /usr/bin/flameshot dieter 3372 0.0 0.2 1139104 86380 ? Sl 08:18 0:01 /usr/bin/flameshot root 49247 0.0 0.0 6620 4264 pts/9 S+ 10:01 0:00 grep flameshot [root@xps ~]# ``` i do have a small flameshot.local but seems to only include unrelated configuration: ``` ~ ❯❯❯ cat .config/firejail/flameshot.local #noblacklist /dev/dri/* #whitelist /dev/dri/* ignore no3d # Undo profile’s DBus lockdown (common cause of QDBusTrayIcon ServiceUnknown) ignore dbus-user none ignore dbus-user filter private-bin grim #needed to actually take screenshots on wayland ~ ❯❯❯ ``` ### Environment ``` Linux 6.18.5-arch1-1 x86_64 Arch Linux (btw) flameshot 13.3.0-2 firejail 0.9.78-1 ~ ❯❯❯ ``` ### Checklist  - [x] I am using firejail [0.9.78 or later](https://github.com/netblue30/firejail/tree/master/SECURITY.md) - [ x I am using the full program path (e.g. `firejail /usr/bin/vlc` instead of `firejail vlc`; see `https://github.com/netblue30/firejail/issues/2877`) - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> ``` LC_ALL=C firejail /usr/bin/flameshot Detected locale "C" with character encoding "ANSI_X3.4-1968", which is not UTF-8. Qt depends on a UTF-8 locale, and has switched to "C.UTF-8" instead. If this causes problems, reconfigure your locale. See the locale(1) manual for more information. "No Flameshot translation found for C" "No Qt translation found for C" "No Flameshot translation found for C" "No Qt translation found for C"</code></summary> <p> ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p> [fjdebug.txt](https://github.com/user-attachments/files/24711695/fjdebug.txt) ``` see fjdebug.txt ``` </p> </details>

gitea-mirror added the

bug

label 2026-05-05 10:00:44 -06:00

gitea-mirror commented

2026-05-05 10:00:46 -06:00

Author

Owner

@Dieterbe commented on GitHub (Jan 19, 2026):

note, i don't have globals.local.
i have now also tried it by taking out my custom .config/firejail/flameshot.local
this caused the next boot to be fine, and a subsequent one to fail the same way (see below), and just like before, once the system is up, any further flameshot restarts work fine.

- Boot b72fd64f05e3401d8dca2c9812fa1cf4 --
Jan 19 11:05:14 xps systemd[2237]: Started Flameshot.
Jan 19 11:05:15 xps flameshot[2820]: QDBusTrayIcon encountered a D-Bus error: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown")
Jan 19 11:05:43 xps systemd[2237]: Stopping Flameshot...
Jan 19 11:05:44 xps systemd[2237]: flameshot.service: Main process exited, code=exited, status=143/n/a
Jan 19 11:05:44 xps systemd[2237]: flameshot.service: Failed with result 'exit-code'.
Jan 19 11:05:44 xps systemd[2237]: Stopped Flameshot.
-- Boot 4dd258bdbf0a46c9a3869bea1be4cdf9 --
Jan 19 11:06:29 xps systemd[2228]: Started Flameshot.
Jan 19 11:06:29 xps firejail[2461]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount
Jan 19 11:06:31 xps flameshot[2461]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount
Jan 19 11:06:31 xps flameshot[2418]: Error: proc 2418 cannot sync with peer: unexpected EOF
Jan 19 11:06:31 xps flameshot[2418]: Peer 2461 unexpectedly exited with status 1
Jan 19 11:06:31 xps systemd[2228]: flameshot.service: Main process exited, code=exited, status=1/FAILURE
Jan 19 11:06:31 xps systemd[2228]: flameshot.service: Failed with result 'exit-code'.
Jan 19 11:06:31 xps systemd[2228]: flameshot.service: Scheduled restart job, restart counter is at 1.
Jan 19 11:06:31 xps systemd[2228]: Started Flameshot.
Jan 19 11:06:31 xps flameshot[3360]: QDBusTrayIcon encountered a D-Bus error: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown")

@Dieterbe commented on GitHub (Jan 19, 2026): note, i don't have globals.local. i have now also tried it by taking out my custom .config/firejail/flameshot.local this caused the next boot to be fine, and a subsequent one to fail the same way (see below), and just like before, once the system is up, any further flameshot restarts work fine. ``` - Boot b72fd64f05e3401d8dca2c9812fa1cf4 -- Jan 19 11:05:14 xps systemd[2237]: Started Flameshot. Jan 19 11:05:15 xps flameshot[2820]: QDBusTrayIcon encountered a D-Bus error: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown") Jan 19 11:05:43 xps systemd[2237]: Stopping Flameshot... Jan 19 11:05:44 xps systemd[2237]: flameshot.service: Main process exited, code=exited, status=143/n/a Jan 19 11:05:44 xps systemd[2237]: flameshot.service: Failed with result 'exit-code'. Jan 19 11:05:44 xps systemd[2237]: Stopped Flameshot. -- Boot 4dd258bdbf0a46c9a3869bea1be4cdf9 -- Jan 19 11:06:29 xps systemd[2228]: Started Flameshot. Jan 19 11:06:29 xps firejail[2461]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount Jan 19 11:06:31 xps flameshot[2461]: Access error: uid 1000, last mount name:/ dir:/run/user/1000/gvfs type:fuse.gvfsd-fuse - invalid whitelist mount Jan 19 11:06:31 xps flameshot[2418]: Error: proc 2418 cannot sync with peer: unexpected EOF Jan 19 11:06:31 xps flameshot[2418]: Peer 2461 unexpectedly exited with status 1 Jan 19 11:06:31 xps systemd[2228]: flameshot.service: Main process exited, code=exited, status=1/FAILURE Jan 19 11:06:31 xps systemd[2228]: flameshot.service: Failed with result 'exit-code'. Jan 19 11:06:31 xps systemd[2228]: flameshot.service: Scheduled restart job, restart counter is at 1. Jan 19 11:06:31 xps systemd[2228]: Started Flameshot. Jan 19 11:06:31 xps flameshot[3360]: QDBusTrayIcon encountered a D-Bus error: QDBusError("org.freedesktop.DBus.Error.ServiceUnknown", "org.freedesktop.DBus.Error.ServiceUnknown") ```

gitea-mirror commented

2026-05-05 10:00:47 -06:00

Author

Owner

@Dieterbe commented on GitHub (Jan 19, 2026):

I can confirm that when I change the systemd unit to call /usr/bin/flameshot directly (without firejail) it also works fine (tried about 6 boots)

@Dieterbe commented on GitHub (Jan 19, 2026): I can confirm that when I change the systemd unit to call /usr/bin/flameshot directly (without firejail) it also works fine (tried about 6 boots)

gitea-mirror commented

2026-05-05 10:00:47 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 23, 2026):

I'll mark it as a bug for now, thanks!

@netblue30 commented on GitHub (Jan 23, 2026): I'll mark it as a bug for now, thanks!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3460

No description provided.

Rows
Columns