[GH-ISSUE #922] `firejail --seccomp opera' fails with` setuid sandbox is not running as root (...) Failed to move to new namespace' #625

New issue

Closed

opened 2026-05-05 06:18:20 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:18:20 -06:00

Owner

Originally created by @czka on GitHub (Nov 19, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/922

Arch Linux 4.8.7 x86_64, Gnome 3.22.2, Opera 41.0.2353.56, Firejail 0.9.44.

$ firejail --seccomp opera
Reading profile /etc/firejail/opera.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/whitelist-common.inc
Parent pid 13307, child pid 13308
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized
The setuid sandbox is not running as root. Common causes:
  * An unprivileged process using ptrace on it, like a debugger.
  * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
[1119/185349:FATAL:zygote_host_impl_linux.cc(182)] Check failed: ReceiveFixedMessage(fds[0], kZygoteBootMessage, sizeof(kZygoteBootMessage), &boot_pid). 
#0 0x000001af3dce <unknown>
#1 0x000001b07a6b <unknown>
#2 0x0000014862b0 <unknown>
#3 0x0000014855bf <unknown>
#4 0x000001485b6e <unknown>
#5 0x00000119a93a <unknown>
#6 0x0000011a167f <unknown>
#7 0x000001738d21 <unknown>
#8 0x000001118530 <unknown>
#9 0x000001118ed7 <unknown>
#10 0x000001112470 <unknown>
#11 0x00000174a32a OperaMain
#12 0x7f779cd76291 __libc_start_main
#13 0x000000452b5d <unknown>

Without --seccomp it starts OK.

Tried --seccomp with thunderbird, firefox, gedit - all OK.

What could be the issue?

Originally created by @czka on GitHub (Nov 19, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/922 Arch Linux 4.8.7 x86_64, Gnome 3.22.2, Opera 41.0.2353.56, Firejail 0.9.44. ``` $ firejail --seccomp opera Reading profile /etc/firejail/opera.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/whitelist-common.inc Parent pid 13307, child pid 13308 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Child process initialized The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted [1119/185349:FATAL:zygote_host_impl_linux.cc(182)] Check failed: ReceiveFixedMessage(fds[0], kZygoteBootMessage, sizeof(kZygoteBootMessage), &boot_pid). #0 0x000001af3dce <unknown> #1 0x000001b07a6b <unknown> #2 0x0000014862b0 <unknown> #3 0x0000014855bf <unknown> #4 0x000001485b6e <unknown> #5 0x00000119a93a <unknown> #6 0x0000011a167f <unknown> #7 0x000001738d21 <unknown> #8 0x000001118530 <unknown> #9 0x000001118ed7 <unknown> #10 0x000001112470 <unknown> #11 0x00000174a32a OperaMain #12 0x7f779cd76291 __libc_start_main #13 0x000000452b5d <unknown> ``` Without `--seccomp` it starts OK. Tried `--seccomp` with thunderbird, firefox, gedit - all OK. What could be the issue?

gitea-mirror closed this issue

2026-05-05 06:18:21 -06:00

gitea-mirror commented

2026-05-05 06:18:25 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Nov 19, 2016):

Opera's based on Chrome/Chromium now, right? That means (I believe) that it already uses its own sandbox, so using --seccomp doesn't let it create its sandbox and it fails to run. The same problem exists with Chrome/Chromium actually, as you will see if you look at the profile (seccomp isn't used in those profiles).

@chiraag-nataraj commented on GitHub (Nov 19, 2016): Opera's based on Chrome/Chromium now, right? That means (I believe) that it already uses its own sandbox, so using `--seccomp` doesn't let it create its sandbox and it fails to run. The same problem exists with Chrome/Chromium actually, as you will see if you look at the profile (`seccomp` isn't used in those profiles).

gitea-mirror commented

2026-05-05 06:18:29 -06:00

Author

Owner

@czka commented on GitHub (Nov 20, 2016):

@chiraag-nataraj That makes sense. Thanks. Anybody, please feel free to close this ticket if you are sure.

@czka commented on GitHub (Nov 20, 2016): @chiraag-nataraj That makes sense. Thanks. Anybody, please feel free to close this ticket if you are sure.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#625

No description provided.

Rows
Columns

[GH-ISSUE #922] firejail --seccomp opera' fails with setuid sandbox is not running as root (...) Failed to move to new namespace' #625

[GH-ISSUE #922] `firejail --seccomp opera' fails with` setuid sandbox is not running as root (...) Failed to move to new namespace' #625