github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #524] unable to firejail chrome when using profile-sync-daemon #369

New issue

Closed

opened 2026-05-05 05:42:15 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 05:42:15 -06:00

Owner

Originally created by @millerthegorilla on GitHub (May 18, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/524

Hi, I'm on ubuntustudio xfce 16.04 and am running profile-sync-daemon on my browsers. When I run firejail google-chrome from a terminal I get the following error:

:~$ firejail google-chrome
Reading profile /etc/firejail/google-chrome.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/whitelist-common.inc
Parent pid 20543, child pid 20544
Error: invalid whitelist path /home/james/.config/google-chrome
Error: cannot establish communication with the parent, exiting...

This causes an issue where profile-sync-daemon has created a ramdisk in tmp and symlinked the profile to it from the usual place to /tmp/somename. running firejail --debug google-chrome gives:

:~$ firejail --debug google-chrome
Command name #google-chrome#
Found google-chrome profile in /etc/firejail directory
Reading profile /etc/firejail/google-chrome.profile
Reading profile /etc/firejail/disable-mgmt.inc
Reading profile /etc/firejail/disable-secret.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/whitelist-common.inc
Using the local network stack
Parent pid 20702, child pid 20703
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/dhcp
Mounting tmpfs on /var/lib/snmp
Mounting tmpfs on /var/lib/sudo
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Sanitizing /etc/passwd
Sanitizing /etc/group
Disable /etc/firejail
Downloads directory resolved as "/home/j/Downloads"
Debug 337: new_name #/home/j/Downloads#
Replaced whitelist path: whitelist /home/j/Downloads
Debug 337: new_name #/home/j/.config/google-chrome#
Debug 379: fname #/run/user/1000/j-google-chrome#, cfg.homedir #/home/j#
Error: invalid whitelist path /home/j/.config/google-chrome
Error: cannot establish communication with the parent, exiting...

I'm guessing that this might be something to do with permissions on tmp but I'm not certain.

Many thanks

Originally created by @millerthegorilla on GitHub (May 18, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/524 Hi, I'm on ubuntustudio xfce 16.04 and am running profile-sync-daemon on my browsers. When I run firejail google-chrome from a terminal I get the following error: :~$ firejail google-chrome Reading profile /etc/firejail/google-chrome.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/whitelist-common.inc Parent pid 20543, child pid 20544 Error: invalid whitelist path /home/james/.config/google-chrome Error: cannot establish communication with the parent, exiting... This causes an issue where profile-sync-daemon has created a ramdisk in tmp and symlinked the profile to it from the usual place to /tmp/somename. running firejail --debug google-chrome gives: :~$ firejail --debug google-chrome Command name #google-chrome# Found google-chrome profile in /etc/firejail directory Reading profile /etc/firejail/google-chrome.profile Reading profile /etc/firejail/disable-mgmt.inc Reading profile /etc/firejail/disable-secret.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/whitelist-common.inc Using the local network stack Parent pid 20702, child pid 20703 Initializing child process PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Mounting tmpfs on /var/lib/dhcp Mounting tmpfs on /var/lib/snmp Mounting tmpfs on /var/lib/sudo Create the new utmp file Mount the new utmp file Cleaning /home directory Sanitizing /etc/passwd Sanitizing /etc/group Disable /etc/firejail Downloads directory resolved as "/home/j/Downloads" Debug 337: new_name #/home/j/Downloads# Replaced whitelist path: whitelist /home/j/Downloads Debug 337: new_name #/home/j/.config/google-chrome# Debug 379: fname #/run/user/1000/j-google-chrome#, cfg.homedir #/home/j# Error: invalid whitelist path /home/j/.config/google-chrome Error: cannot establish communication with the parent, exiting... I'm guessing that this might be something to do with permissions on tmp but I'm not certain. Many thanks

gitea-mirror

2026-05-05 05:42:15 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:42:20 -06:00

Author

Owner

@netblue30 commented on GitHub (May 18, 2016):

profile-sync-daemon has created a ramdisk in tmp and symlinked the profile to it from the usual place to /tmp/somename

I think it creates the ramdisk in /home/j. Try to configure profile-sync-daemon to store the real files inside your home directory, for example in a /home/james/myprofilesync directory.

If it is outside your home directory, very likely it will not appear in the sandbox, or it might be marked as read-only, depending where you place it. Inside the sandbox you'll have a single /home/username directory, all other user directories are not accessible.

@netblue30 commented on GitHub (May 18, 2016): > profile-sync-daemon has created a ramdisk in tmp and symlinked the profile to it from the usual place to /tmp/somename I think it creates the ramdisk in /home/j. Try to configure profile-sync-daemon to store the real files inside your home directory, for example in a /home/james/myprofilesync directory. If it is outside your home directory, very likely it will not appear in the sandbox, or it might be marked as read-only, depending where you place it. Inside the sandbox you'll have a single /home/username directory, all other user directories are not accessible.

gitea-mirror commented

2026-05-05 05:42:21 -06:00

Author

Owner

@millerthegorilla commented on GitHub (May 19, 2016):

It creates the ram disk at
tmpfs dir: /run/user/1000/james-firefox-XXXXXX.default (where XXXXX is a series of random characters - perhaps the firefox profile)
May I simply whitelist the /run/user/1000/james-firefox* directory?
Am I able to use wildcards in directory names? I think the directory name may change each time.

Thanks

@millerthegorilla commented on GitHub (May 19, 2016): It creates the ram disk at tmpfs dir: /run/user/1000/james-firefox-XXXXXX.default (where XXXXX is a series of random characters - perhaps the firefox profile) May I simply whitelist the /run/user/1000/james-firefox\* directory? Am I able to use wildcards in directory names? I think the directory name may change each time. Thanks

gitea-mirror commented

2026-05-05 05:42:23 -06:00

Author

Owner

@netblue30 commented on GitHub (May 20, 2016):

In order to prevent "symlink attacks" I had to disable symlinks in /home and /tmp directories. I'm afraid I cannot support profile-sync-daemon, unless the program stores all its files under /home/username.

@netblue30 commented on GitHub (May 20, 2016): In order to prevent "symlink attacks" I had to disable symlinks in /home and /tmp directories. I'm afraid I cannot support profile-sync-daemon, unless the program stores all its files under /home/username.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#369

No description provided.

Rows
Columns