github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #814] Issue with private-bin option in version 0.9.42 #554

New issue
Closed
opened 2026-05-05 06:07:05 -06:00 by gitea-mirror · 11 comments
gitea-mirror commented 2026-05-05 06:07:05 -06:00
Owner
Copy link

Originally created by @s0lo7 on GitHub (Sep 26, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/814

Applications fail to load after updating to version 0.9.42. 'private-bin' option in the profiles seem to be the issue. Manually changed a few profiles by uncommenting the option and it works.

Originally created by @s0lo7 on GitHub (Sep 26, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/814 Applications fail to load after updating to version 0.9.42. 'private-bin' option in the profiles seem to be the issue. Manually changed a few profiles by uncommenting the option and it works.
gitea-mirror 2026-05-05 06:07:05 -06:00
  • closed this issue
  • added the
    bug
         label
gitea-mirror commented 2026-05-05 06:07:13 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Sep 26, 2016):

Give me an example, how are you starting the sandbox and what do you have in your profile under private-bin?

<!-- gh-comment-id:249623565 --> @netblue30 commented on GitHub (Sep 26, 2016): Give me an example, how are you starting the sandbox and what do you have in your profile under private-bin?
gitea-mirror commented 2026-05-05 06:07:17 -06:00
Author
Owner
Copy link

@s0lo7 commented on GitHub (Sep 26, 2016):

Applications which failed to load for me are 'evince' and 'transmission-gtk'.
uncommenting the "private-bin" option in both the profiles made the applications work. I tried to launch them from terminal to see if any errors would be reported. Nothing is reported and the process exits silently.

Profiles for both the apps were not modified. "private-bin" option causing the problem is
private-bin evince,evince-previewer,evince-thumbnailer
private-bin transmission-gtk

<!-- gh-comment-id:249629276 --> @s0lo7 commented on GitHub (Sep 26, 2016): Applications which failed to load for me are 'evince' and 'transmission-gtk'. uncommenting the "private-bin" option in both the profiles made the applications work. I tried to launch them from terminal to see if any errors would be reported. Nothing is reported and the process exits silently. Profiles for both the apps were not modified. "private-bin" option causing the problem is **private-bin evince,evince-previewer,evince-thumbnailer** **private-bin transmission-gtk**
gitea-mirror commented 2026-05-05 06:07:21 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Sep 26, 2016):

Do like this:

In terminal, run "sudo firermon". In a separate terminal start the program: "firejail evince". In the first terminal you will get a list with all the programs the sandbox tries to start, something like this:

14:10:10 exec 6758 (root) NEW SANDBOX: /usr/bin/firejail /usr/bin/evince 
14:10:10 uid  6758 (root) /usr/bin/firejail /usr/bin/evince 
14:10:10 uid  6758 (netblue) /usr/bin/firejail /usr/bin/evince 
14:10:10 gid  6758 (netblue) /usr/bin/firejail /usr/bin/evince 
14:10:10 fork 6760 (netblue) /usr/bin/firejail /usr/bin/evince 
    child 6766 /usr/bin/evince 
14:10:10 uid  6760 (netblue) /usr/bin/firejail /usr/bin/evince 
14:10:10 gid  6760 (netblue) /usr/bin/firejail /usr/bin/evince

You look for "fork" entries.

<!-- gh-comment-id:249649704 --> @netblue30 commented on GitHub (Sep 26, 2016): Do like this: In terminal, run "sudo firermon". In a separate terminal start the program: "firejail evince". In the first terminal you will get a list with all the programs the sandbox tries to start, something like this: ``` 14:10:10 exec 6758 (root) NEW SANDBOX: /usr/bin/firejail /usr/bin/evince 14:10:10 uid 6758 (root) /usr/bin/firejail /usr/bin/evince 14:10:10 uid 6758 (netblue) /usr/bin/firejail /usr/bin/evince 14:10:10 gid 6758 (netblue) /usr/bin/firejail /usr/bin/evince 14:10:10 fork 6760 (netblue) /usr/bin/firejail /usr/bin/evince child 6766 /usr/bin/evince 14:10:10 uid 6760 (netblue) /usr/bin/firejail /usr/bin/evince 14:10:10 gid 6760 (netblue) /usr/bin/firejail /usr/bin/evince ``` You look for "fork" entries.
gitea-mirror commented 2026-05-05 06:07:22 -06:00
Author
Owner
Copy link

@s0lo7 commented on GitHub (Sep 26, 2016):

'fork' entries for both the applications are similar to your output. I've attached the output of 'sudo firemon' for both the apps.

evince.txt
transmission.txt

<!-- gh-comment-id:249659628 --> @s0lo7 commented on GitHub (Sep 26, 2016): 'fork' entries for both the applications are similar to your output. I've attached the output of 'sudo firemon' for both the apps. [evince.txt](https://github.com/netblue30/firejail/files/493853/evince.txt) [transmission.txt](https://github.com/netblue30/firejail/files/493854/transmission.txt)
gitea-mirror commented 2026-05-05 06:07:24 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Sep 26, 2016):

exec 15808 (root) /run/firejail/mnt/cp -a /usr/local/bin/evince /run/firejail/mnt/bin/evince

Firejail is picking up evince from /usr/local/bin directory, instead of /usr/bin. Do you have a script under the name "evince" in /usr/local/bin?

I guess for transmission you have the same problem. The trace looks like you run the sandbox with private-bin commented out.

<!-- gh-comment-id:249676844 --> @netblue30 commented on GitHub (Sep 26, 2016): ``` exec 15808 (root) /run/firejail/mnt/cp -a /usr/local/bin/evince /run/firejail/mnt/bin/evince ``` Firejail is picking up evince from /usr/local/bin directory, instead of /usr/bin. Do you have a script under the name "evince" in /usr/local/bin? I guess for transmission you have the same problem. The trace looks like you run the sandbox with private-bin commented out.
gitea-mirror commented 2026-05-05 06:07:27 -06:00
Author
Owner
Copy link

@s0lo7 commented on GitHub (Sep 26, 2016):

I do have scripts under "/usr/local/bin" for all the apps which are invoked with firejail.
It seems that the command /run/firejail/mnt/cp -a uses hardcoded PATH values to search for the executables and copy them. This was the cause of problem for me.
Is there an option to pass new environment variables (PATH in my case) to firejail which will be used to locate the executable?

<!-- gh-comment-id:249695393 --> @s0lo7 commented on GitHub (Sep 26, 2016): I do have scripts under "/usr/local/bin" for all the apps which are invoked with firejail. It seems that the command **/run/firejail/mnt/cp -a** uses hardcoded PATH values to search for the executables and copy them. This was the cause of problem for me. Is there an option to pass new environment variables (PATH in my case) to firejail which will be used to locate the executable?
gitea-mirror commented 2026-05-05 06:07:31 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Sep 26, 2016):

OK, I got it. My documentation is all messed up. I'll have to update the description under "DESKTOP INTEGRATION" in man firejail.

There are two ways to /usr/local/bin. You can use firecfg utility (man firecfg) to create symbolic links to /usr/bin/firejail in order to start your programs automatically, or you can place your own scripts in /usr/local/bin. If you go for your scripts, you need to set "private-bin-no-local yes" in /etc/firejail/firejail.config.

I'll leave this open until I fix the docs, just add "private-bin-no-local yes" and it will work fine.

<!-- gh-comment-id:249706778 --> @netblue30 commented on GitHub (Sep 26, 2016): OK, I got it. My documentation is all messed up. I'll have to update the description under "DESKTOP INTEGRATION" in man firejail. There are two ways to /usr/local/bin. You can use firecfg utility (man firecfg) to create symbolic links to /usr/bin/firejail in order to start your programs automatically, or you can place your own scripts in /usr/local/bin. If you go for your scripts, you need to set "private-bin-no-local yes" in /etc/firejail/firejail.config. I'll leave this open until I fix the docs, just add "private-bin-no-local yes" and it will work fine.
gitea-mirror commented 2026-05-05 06:07:32 -06:00
Author
Owner
Copy link

@s0lo7 commented on GitHub (Sep 27, 2016):

Adding private-bin-no-local yes to /etc/firejail/firejail.config reports it as an invalid line. I think it has something to do with the code in "src/firejail/checkcfg.c", but the code seems fair to me.
For now, I recompiled the code by manually removing the "/usr/local" entries in "src/firejail/fs_bin.c" and it works fine.
Please let me know if I'm missing something.

<!-- gh-comment-id:249804839 --> @s0lo7 commented on GitHub (Sep 27, 2016): Adding **private-bin-no-local yes** to /etc/firejail/firejail.config reports it as an invalid line. I think it has something to do with the code in "src/firejail/checkcfg.c", but the code seems fair to me. For now, I recompiled the code by manually removing the "/usr/local" entries in "src/firejail/fs_bin.c" and it works fine. Please let me know if I'm missing something.
gitea-mirror commented 2026-05-05 06:07:34 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Sep 27, 2016):

I think "private-bin-no-local" came in git after the release of 0.9.42. In /etc/firejail/firejail.config you should have the following two lines commented out:

# Remove /usr/local directories from private-bin list, default disabled.
# private-bin-no-local no
<!-- gh-comment-id:249891395 --> @netblue30 commented on GitHub (Sep 27, 2016): I think "private-bin-no-local" came in git after the release of 0.9.42. In /etc/firejail/firejail.config you should have the following two lines commented out: ``` # Remove /usr/local directories from private-bin list, default disabled. # private-bin-no-local no ```
gitea-mirror commented 2026-05-05 06:07:37 -06:00
Author
Owner
Copy link

@mr-blobbyyy commented on GitHub (Sep 27, 2016):

# Remove /usr/local directories from private-bin list, default disabled.
# private-bin-no-local no

Um, these lines are not even in 0.9.42's config? For me, I use firejail for vlc and it appears I only need to comment out private-tmp in the default profile in order for vlc to start up normally. Otherwise, libvlc came back with interface and X server errors. Hopefully not due to a luks encrypted filesystem I setup by default...and I also have a firejail symlink in /usr/local/bin for vlc...

<!-- gh-comment-id:250028361 --> @mr-blobbyyy commented on GitHub (Sep 27, 2016): > `# Remove /usr/local directories from private-bin list, default disabled.` > `# private-bin-no-local no` Um, these lines are not even in 0.9.42's config? For me, I use firejail for vlc and it appears I only need to comment out `private-tmp` in the default profile in order for vlc to start up normally. Otherwise, libvlc came back with interface and X server errors. Hopefully not due to a luks encrypted filesystem I setup by default...and I also have a firejail symlink in /usr/local/bin for vlc...
gitea-mirror commented 2026-05-05 06:07:38 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Sep 28, 2016):

Yes, it got added in git after 0.9.42 was released - another user complained about it. I'll have the new 0.9.44 version coming up in October. For now just comment out private-bin in your profiles.

<!-- gh-comment-id:250198400 --> @netblue30 commented on GitHub (Sep 28, 2016): Yes, it got added in git after 0.9.42 was released - another user complained about it. I'll have the new 0.9.44 version coming up in October. For now just comment out private-bin in your profiles.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#554
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?