github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #656] Viability of use with skype4linux alpha? #456

New issue

Closed

opened 2026-05-05 05:54:04 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:54:04 -06:00

Owner

Originally created by @xee5ch on GitHub (Jul 29, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/656

I am a big fan of this package. I am running a current installation of Debian 8.5.0 amd64 that was updated prior to testing. I tested with firejail 9.4.0 using jessie-backports to stay current and Skype for Linux Alpha 1.3.0 downloaded from their new repo.

$ aptitude show skypeforlinux
Package: skypeforlinux
New: yes
State: installed
Automatically installed: no
Version: 1.3.0.0
Priority: extra
Section: non-free/net
Maintainer: Skype Technologies S.A. info@skype.net
Architecture: amd64
Uncompressed Size: 145 M
Depends: gconf-service, libasound2 (>= 1.0.16), libatk1.0-0 (>= 1.12.4), libc6 (>= 2.12), libcairo2 (>= 1.6.0), libcups2 (>= 1.4.0),
libdbus-1-3 (>= 1.2.14), libexpat1 (>= 2.0.1), libfontconfig1 (>= 2.9.0), libfreetype6 (>= 2.4.2), libgcc1 (>= 1:4.1.1),
libgconf-2-4 (>= 2.31.1), libgdk-pixbuf2.0-0 (>= 2.22.0), libglib2.0-0 (>= 2.31.8), libgnome-keyring0 (>= 2.22.2), libgtk2.0-0
(>= 2.24.0), libnspr4 (>= 2:4.9-2~) | libnspr4-0d (>= 1.8.0.10), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.4), libpango1.0-0
(>= 1.14.0), libstdc++6 (>= 4.6), libx11-6 (>= 2:1.4.99.1), libxcomposite1 (>= 1:0.3-1), libxcursor1 (> 1.1.2), libxdamage1 (>=
1:1.1), libxext6, libxfixes3, libxi6 (>= 2:1.2.99.4), libxrandr2 (>= 2:1.2.99.2), libxrender1, libxss1, libxtst6, gnome-keyring,
apt-transport-https

I have tried the following executions.

$firejail --profile=/etc/firejail/skype.profile --private=firejail/skype skypeforlinux
$firejail --profile=/etc/firejail/default.profile --private=firejail/skype skypeforlinux
$firejail --profile=/etc/firejail/skype.profile --private=firejail/skype skypeforlinux --debug
$firejail --profile=/etc/firejail/skype.profile --private=firejail/skype skypeforlinux --debug-caps --debug-errnos --debug-syscalls --debug-protocols

For the first execution, of course, I get a noprofile recommendation.

Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 9395, child pid 9396
0;firejail skypeforlinux
Child process initialized

Parent is shutting down, bye...

Obviously, with --noprofile, not much difference.

$ firejail --noprofile --private=firejail/skype/ skypeforlinux
Parent pid 9467, child pid 9468
0;firejail skypeforlinux
Child process initialized

Parent is shutting down, bye...

In the other executions, I get similar execution logs.

When I try any with debugging, I do not get much logged out any syscalls. I get nothing additional beyond the same process creation, child creation, and parent exit log. I tried creating a new private directory just to see, and obviously that did not help. I tried outside the jail and it executes. I am sure I am doing something wrong. How can I help you by further debugging. Should I run skypeforlinux with strace to see what it is executing without containment?

Originally created by @xee5ch on GitHub (Jul 29, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/656 I am a big fan of this package. I am running a current installation of Debian 8.5.0 amd64 that was updated prior to testing. I tested with firejail 9.4.0 using `jessie-backports` to stay current and Skype for Linux Alpha 1.3.0 downloaded from their new repo. > $ aptitude show skypeforlinux > Package: skypeforlinux > New: yes > State: installed > Automatically installed: no > Version: 1.3.0.0 > Priority: extra > Section: non-free/net > Maintainer: Skype Technologies S.A. info@skype.net > Architecture: amd64 > Uncompressed Size: 145 M > Depends: gconf-service, libasound2 (>= 1.0.16), libatk1.0-0 (>= 1.12.4), libc6 (>= 2.12), libcairo2 (>= 1.6.0), libcups2 (>= 1.4.0), > libdbus-1-3 (>= 1.2.14), libexpat1 (>= 2.0.1), libfontconfig1 (>= 2.9.0), libfreetype6 (>= 2.4.2), libgcc1 (>= 1:4.1.1), > libgconf-2-4 (>= 2.31.1), libgdk-pixbuf2.0-0 (>= 2.22.0), libglib2.0-0 (>= 2.31.8), libgnome-keyring0 (>= 2.22.2), libgtk2.0-0 > (>= 2.24.0), libnspr4 (>= 2:4.9-2~) | libnspr4-0d (>= 1.8.0.10), libnss3 (>= 2:3.13.4-2~) | libnss3-1d (>= 3.12.4), libpango1.0-0 > (>= 1.14.0), libstdc++6 (>= 4.6), libx11-6 (>= 2:1.4.99.1), libxcomposite1 (>= 1:0.3-1), libxcursor1 (> 1.1.2), libxdamage1 (>= > 1:1.1), libxext6, libxfixes3, libxi6 (>= 2:1.2.99.4), libxrandr2 (>= 2:1.2.99.2), libxrender1, libxss1, libxtst6, gnome-keyring, > apt-transport-https I have tried the following executions. ``` $firejail --profile=/etc/firejail/skype.profile --private=firejail/skype skypeforlinux $firejail --profile=/etc/firejail/default.profile --private=firejail/skype skypeforlinux $firejail --profile=/etc/firejail/skype.profile --private=firejail/skype skypeforlinux --debug $firejail --profile=/etc/firejail/skype.profile --private=firejail/skype skypeforlinux --debug-caps --debug-errnos --debug-syscalls --debug-protocols ``` For the first execution, of course, I get a noprofile recommendation. > Reading profile /etc/firejail/default.profile > Reading profile /etc/firejail/disable-common.inc > Reading profile /etc/firejail/disable-programs.inc > Reading profile /etc/firejail/disable-passwdmgr.inc > > *\* Note: you can use --noprofile to disable default.profile ** > > Parent pid 9395, child pid 9396 > 0;firejail skypeforlinux > Child process initialized > > Parent is shutting down, bye... Obviously, with `--noprofile`, not much difference. > $ firejail --noprofile --private=firejail/skype/ skypeforlinux > Parent pid 9467, child pid 9468 > 0;firejail skypeforlinux > Child process initialized > > Parent is shutting down, bye... In the other executions, I get similar execution logs. When I try any with debugging, I do not get much logged out any syscalls. I get nothing additional beyond the same process creation, child creation, and parent exit log. I tried creating a new private directory just to see, and obviously that did not help. I tried outside the jail and it executes. I am sure I am doing something wrong. How can I help you by further debugging. Should I run `skypeforlinux` with strace to see what it is executing without containment?

gitea-mirror

2026-05-05 05:54:04 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:54:11 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Jul 29, 2016):

G'day xee5ch. I wonder what would happen if you ran it without --private=firejail/skype?

Can you try running each of the following, pasting the output on Gist or a pastebin service, and posting the links here? Of course, let us know what happens each time too. :)
firejail --profile=/etc/firejail/skype.profile --debug skypeforlinux
firejail --profile=/etc/firejail/default.profile --debug skypeforlinux
firejail --noprofile --debug skypeforlinux

Thanks!

@Fred-Barclay commented on GitHub (Jul 29, 2016): G'day xee5ch. I wonder what would happen if you ran it without `--private=firejail/skype`? Can you try running each of the following, pasting the output on Gist or a pastebin service, and posting the links here? Of course, let us know what happens each time too. :) `firejail --profile=/etc/firejail/skype.profile --debug skypeforlinux` `firejail --profile=/etc/firejail/default.profile --debug skypeforlinux` `firejail --noprofile --debug skypeforlinux` Thanks!

gitea-mirror commented

2026-05-05 05:54:14 -06:00

Author

Owner

@xee5ch commented on GitHub (Jul 29, 2016):

On my way out. Will report back in detail later but I removed the --private argument and got the same result.

@xee5ch commented on GitHub (Jul 29, 2016): On my way out. Will report back in detail later but I removed the `--private` argument and got the same result.

gitea-mirror commented

2026-05-05 05:54:17 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 29, 2016):

What bothered him was the protocol line, it needs netlnk. Use this profile:

################################
# Microsoft's skypeforlinux
################################
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-passwdmgr.inc

#blacklist ${HOME}/.wine

caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp

Save it as skypeforlinux.profile. Type "firejail --profile=skypeforlinux.profile skypeforlinux" to start it. I've tested it on Ubuntu 16.04

@netblue30 commented on GitHub (Jul 29, 2016): What bothered him was the protocol line, it needs netlnk. Use this profile: ``` ################################ # Microsoft's skypeforlinux ################################ include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-passwdmgr.inc #blacklist ${HOME}/.wine caps.drop all netfilter nonewprivs noroot protocol unix,inet,inet6,netlink seccomp ``` Save it as skypeforlinux.profile. Type "firejail --profile=skypeforlinux.profile skypeforlinux" to start it. I've tested it on Ubuntu 16.04

gitea-mirror commented

2026-05-05 05:54:19 -06:00

Author

Owner

@xee5ch commented on GitHub (Jul 30, 2016):

@netblue30 Thanks so much for your orompt response. I am curious though, how did you figure that out so quickly?

@xee5ch commented on GitHub (Jul 30, 2016): @netblue30 Thanks so much for your orompt response. I am curious though, how did you figure that out so quickly?

gitea-mirror commented

2026-05-05 05:54:21 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 30, 2016):

I just took the default.profile file and commented out the lines one by one until I found the one with the problem. I kind o knew it was somewhere in seccomp/protocol area, so it wasn't so bad. Thanks for bringing up the problem.

@netblue30 commented on GitHub (Jul 30, 2016): I just took the default.profile file and commented out the lines one by one until I found the one with the problem. I kind o knew it was somewhere in seccomp/protocol area, so it wasn't so bad. Thanks for bringing up the problem.

gitea-mirror referenced this issue

2026-05-05 10:04:58 -06:00

[PR #456] [MERGED] added google-play-music-desktop-player profile #3631

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#456

No description provided.

Rows
Columns