[GH-ISSUE #7133] fontforge: sandboxed libreoffice compilation on Gentoo uses LD_PRELOAD, triggers assertion failures #3498

New issue

Open

opened 2026-05-05 10:02:02 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:02:02 -06:00

Owner

Originally created by @hlein on GitHub (Apr 10, 2026).
Original GitHub issue: https://github.com/netblue30/firejail/issues/7133

Description

Compiling libreoffice on Gentoo fails when fontforge is firejailed, because the build process invokes fontforge with LD_PRELOAD set.

Steps to Reproduce

Try to emerge libreoffice. Other build-from-source distros that use an LD_PRELOAD library for build sandboxing would have similar issues.

Expected behavior

Libreoffice should compile.

Actual behavior

Dies with:

[5000+ lines of successful building]
...
[FNT] CustomTarget/extras/fonts/opens___.ttf
/usr/local/bin/fontforge -lang=ff -c 'Open($1); Generate($2)' /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/extras/source/truetype/symbol/OpenSymbol.sfd /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/workdir/CustomTarget/extras/fonts/opens___.ttf
...
/bin/cp  --no-dereference --force --preserve=timestamps /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/extras/source/gallery/bullets/Bullet08-Diamond-LightBlue.svg /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/instdir/share/gallery/bullets/Bullet08-Diamond-LightBlue.svg
run_symlink: LD_PRELOAD is: 'libsandbox.so'
fontforge: ../../src/firejail/run_symlink.c:81: run_symlink: Assertion `env_get("LD_PRELOAD") == NULL' failed.
make[1]: *** [/var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/extras/CustomTarget_opensymbol.mk:19: /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/workdir/CustomTarget/extras/fonts/opens___.ttf] Aborted
make[1]: *** Waiting for unfinished jobs....
...

libsandbox.so is a library used to instrument/isolate build processes (think fakeroot or InstallWatch. It's not a security boundary, more for QA to make sure a build doesn't reference things outside its build env / stated dependencies, etc.

Behavior without a profile

Would also fail because the LD_PRELOAD check is not profile-dependent.

Additional context

I already commented about this on an existing issue discussing the assert, #6532

However, creating a dedicated issue until bigger changes to the asserts on LD_PRELOAD can be considered. I'll probably only disable fontforge in the Gentoo package's firecfg.config, rather than request it being disabled by default, but would like this bug to be discoverable by others who encounter something similar on Arch or whatnot.

Environment

Name/version/arch of the Linux kernel (uname -srm): Linux 6.6.119-gentoo x86_64
Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Gentoo Linux
Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1,
mesa 1:24.3.3-2"): media-gfx/fontforge-20230101-r2, while trying to emerge app-office/libreoffice-25.2.7.2-r1
Version of Firejail (firejail --version): firejail version 0.9.80
If you use a development version of firejail, also the commit from which it
was compiled (git rev-parse HEAD):

Checklist

I am using firejail 0.9.80 or later
[n/a] I am using the full program path (e.g. firejail /usr/bin/vlc instead of firejail vlc; see https://github.com/netblue30/firejail/issues/2877)
The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
[n/a] I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Originally created by @hlein on GitHub (Apr 10, 2026). Original GitHub issue: https://github.com/netblue30/firejail/issues/7133 ### Description Compiling `libreoffice` on Gentoo fails when `fontforge` is `firejail`ed, because the build process invokes `fontforge` with `LD_PRELOAD` set. ### Steps to Reproduce Try to emerge `libreoffice`. Other build-from-source distros that use an `LD_PRELOAD` library for build sandboxing would have similar issues. ### Expected behavior Libreoffice should compile. ### Actual behavior Dies with: ``` [5000+ lines of successful building] ... [FNT] CustomTarget/extras/fonts/opens___.ttf /usr/local/bin/fontforge -lang=ff -c 'Open($1); Generate($2)' /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/extras/source/truetype/symbol/OpenSymbol.sfd /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/workdir/CustomTarget/extras/fonts/opens___.ttf ... /bin/cp --no-dereference --force --preserve=timestamps /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/extras/source/gallery/bullets/Bullet08-Diamond-LightBlue.svg /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/instdir/share/gallery/bullets/Bullet08-Diamond-LightBlue.svg run_symlink: LD_PRELOAD is: 'libsandbox.so' fontforge: ../../src/firejail/run_symlink.c:81: run_symlink: Assertion `env_get("LD_PRELOAD") == NULL' failed. make[1]: *** [/var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/extras/CustomTarget_opensymbol.mk:19: /var/tmp/portage/app-office/libreoffice-25.2.7.2-r1/work/libreoffice-25.2.7.2/workdir/CustomTarget/extras/fonts/opens___.ttf] Aborted make[1]: *** Waiting for unfinished jobs.... ... ``` `libsandbox.so` is a library used to instrument/isolate build processes (think `fakeroot` or `InstallWatch`. It's not a security boundary, more for QA to make sure a build doesn't reference things outside its build env / stated dependencies, etc. ### Behavior without a profile Would also fail because the `LD_PRELOAD` check is not profile-dependent. ### Additional context I already commented about this on an existing issue discussing the `assert`, #6532 However, creating a dedicated issue until bigger changes to the asserts on `LD_PRELOAD` can be considered. I'll probably only disable `fontforge` in the Gentoo package's `firecfg.config`, rather than request it being disabled by default, but would like this bug to be discoverable by others who encounter something similar on Arch or whatnot. ### Environment - Name/version/arch of the Linux kernel (`uname -srm`): `Linux 6.6.119-gentoo x86_64` - Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Gentoo Linux - Name/version of the relevant program(s)/package(s) (e.g. "firefox 134.0-1, mesa 1:24.3.3-2"): `media-gfx/fontforge-20230101-r2`, while trying to `emerge app-office/libreoffice-25.2.7.2-r1` - Version of Firejail (`firejail --version`): `firejail version 0.9.80` - If you use a development version of firejail, also the commit from which it was compiled (`git rev-parse HEAD`): ### Checklist  - [x] I am using firejail [0.9.80 or later](https://github.com/netblue30/firejail/tree/master/SECURITY.md) - [n/a] I am using the full program path (e.g. `firejail /usr/bin/vlc` instead of `firejail vlc`; see `https://github.com/netblue30/firejail/issues/2877`) - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [n/a] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3498

No description provided.

Rows
Columns