[GH-ISSUE #1008] Can't run Chromium in firejail with --overlay-tmpfs option

gitea-mirror commented

2026-05-05 06:26:43 -06:00

Owner

Originally created by @laniakea64 on GitHub (Dec 26, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1008

Xubuntu 16.04
firejail 0.9.44.2
Chromium version -

$ chromium-browser --version
Chromium 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04

This works -

firejail --noprofile --caps.drop=all chromium-browser --disable-gpu

This, however, does not -

$ firejail --overlay-tmpfs --noprofile chromium-browser --disable-gpu
Parent pid 2351, child pid 2352
OverlayFS configured in /run/firejail/mnt directory
Dropping all Linux capabilities and enforcing default seccomp filter
Warning: failed to unmount /sys
Warning: whitelist feature is disabled in overlay
Child process initialized
[...snipped irrelevant output...]
The setuid sandbox is not running as root. Common causes:
  * An unprivileged process using ptrace on it, like a debugger.
  * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...)
Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted
[2:2:1225/211042:FATAL:zygote_host_impl_linux.cc(182)] Check failed: ReceiveFixedMessage(fds[0], kZygoteBootMessage, sizeof(kZygoteBootMessage), &boot_pid). 
#0 0x7f36468176ae base::debug::StackTrace::StackTrace()
#1 0x7f364683470e logging::LogMessage::~LogMessage()
#2 0x7f364498f06b content::ZygoteHostImpl::LaunchZygote()
#3 0x7f364498dfc7 content::ZygoteCommunication::Init()
#4 0x7f364498e5be content::CreateZygote()
#5 0x7f3644647abc content::BrowserMainLoop::EarlyInitialization()
#6 0x7f364464b051 <unknown>
#7 0x7f3644643863 content::BrowserMain()
#8 0x7f36445b3f4d <unknown>
#9 0x7f36445b3141 content::ContentMain()
#10 0x55580b11619a ChromeMain
#11 0x7f363b0b7830 __libc_start_main
#12 0x55580b116049 _start


Parent is shutting down, bye...

This also fails in firejail 0.9.38.

In Lubuntu 14.04, this still fails under firejail 0.9.44.2. But there it works fine in firejail 0.9.38.

How to get Chromium to run in firejail 0.9.44.2 with the --overlay-tmpfs option?

Originally created by @laniakea64 on GitHub (Dec 26, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/1008 Xubuntu 16.04 firejail 0.9.44.2 Chromium version - ``` $ chromium-browser --version Chromium 53.0.2785.143 Built on Ubuntu , running on Ubuntu 16.04 ``` This works - ``` firejail --noprofile --caps.drop=all chromium-browser --disable-gpu ``` This, however, does not - ``` $ firejail --overlay-tmpfs --noprofile chromium-browser --disable-gpu Parent pid 2351, child pid 2352 OverlayFS configured in /run/firejail/mnt directory Dropping all Linux capabilities and enforcing default seccomp filter Warning: failed to unmount /sys Warning: whitelist feature is disabled in overlay Child process initialized [...snipped irrelevant output...] The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted [2:2:1225/211042:FATAL:zygote_host_impl_linux.cc(182)] Check failed: ReceiveFixedMessage(fds[0], kZygoteBootMessage, sizeof(kZygoteBootMessage), &boot_pid). #0 0x7f36468176ae base::debug::StackTrace::StackTrace() #1 0x7f364683470e logging::LogMessage::~LogMessage() #2 0x7f364498f06b content::ZygoteHostImpl::LaunchZygote() #3 0x7f364498dfc7 content::ZygoteCommunication::Init() #4 0x7f364498e5be content::CreateZygote() #5 0x7f3644647abc content::BrowserMainLoop::EarlyInitialization() #6 0x7f364464b051 <unknown> #7 0x7f3644643863 content::BrowserMain() #8 0x7f36445b3f4d <unknown> #9 0x7f36445b3141 content::ContentMain() #10 0x55580b11619a ChromeMain #11 0x7f363b0b7830 __libc_start_main #12 0x55580b116049 _start Parent is shutting down, bye... ``` This also fails in firejail 0.9.38. In Lubuntu 14.04, this still fails under firejail 0.9.44.2. But there it works fine in firejail 0.9.38. How to get Chromium to run in firejail 0.9.44.2 with the `--overlay-tmpfs` option?

gitea-mirror

2026-05-05 06:26:43 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 06:26:48 -06:00

Author

Owner

@netblue30 commented on GitHub (Dec 27, 2016):

I'll put a fix in.

@netblue30 commented on GitHub (Dec 27, 2016): I'll put a fix in.

gitea-mirror commented

2026-05-05 06:26:50 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 4, 2017):

All fixed in git.

@netblue30 commented on GitHub (Jan 4, 2017): All fixed in git.

gitea-mirror commented

2026-05-05 06:26:52 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jan 4, 2017):

Unfortunately can't try it out due to build failure -

for file in contrib/*; do \
                install -c -m 0755 $file debian//usr/lib/firejail/.; \
        done
install: cannot stat ‘contrib/*’: No such file or directory
make[2]: *** [realinstall] Error 1
make[2]: Leaving directory `/srv/fjx/firejail/firejail-0.9.45'
make[1]: *** [install-strip] Error 2
make[1]: Leaving directory `/srv/fjx/firejail/firejail-0.9.45'
*****************************************
install size 568        firejail-0.9.45/debian
*****************************************
mv: cannot stat ‘firejail-0.9.45/debian/usr/share/doc/firejail/RELNOTES’: No such file or directory
gzip: firejail-0.9.45/debian/usr/share/doc/firejail/changelog.Debian: No such file or directory
rm: cannot remove ‘firejail-0.9.45/debian/usr/share/doc/firejail/COPYING’: No such file or directory
cp: cannot create regular file ‘firejail-0.9.45/debian/usr/share/doc/firejail/.’: No such file or directory
dpkg-deb: error: conffile `/etc/firejail/0ad.profile' does not appear in package
warning: cannot find binary, udeb or source package debian.deb in lab (skipping)
mv: cannot stat ‘debian.deb’: No such file or directory
if building a 32bit package, rename the deb file manually

@laniakea64 commented on GitHub (Jan 4, 2017): Unfortunately can't try it out due to build failure - ``` for file in contrib/*; do \ install -c -m 0755 $file debian//usr/lib/firejail/.; \ done install: cannot stat ‘contrib/*’: No such file or directory make[2]: *** [realinstall] Error 1 make[2]: Leaving directory `/srv/fjx/firejail/firejail-0.9.45' make[1]: *** [install-strip] Error 2 make[1]: Leaving directory `/srv/fjx/firejail/firejail-0.9.45' ***************************************** install size 568 firejail-0.9.45/debian ***************************************** mv: cannot stat ‘firejail-0.9.45/debian/usr/share/doc/firejail/RELNOTES’: No such file or directory gzip: firejail-0.9.45/debian/usr/share/doc/firejail/changelog.Debian: No such file or directory rm: cannot remove ‘firejail-0.9.45/debian/usr/share/doc/firejail/COPYING’: No such file or directory cp: cannot create regular file ‘firejail-0.9.45/debian/usr/share/doc/firejail/.’: No such file or directory dpkg-deb: error: conffile `/etc/firejail/0ad.profile' does not appear in package warning: cannot find binary, udeb or source package debian.deb in lab (skipping) mv: cannot stat ‘debian.deb’: No such file or directory if building a 32bit package, rename the deb file manually ```

gitea-mirror commented

2026-05-05 06:26:53 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 4, 2017):

Fixed, problem in the Makefile.in.

@netblue30 commented on GitHub (Jan 4, 2017): Fixed, problem in the Makefile.in.

gitea-mirror commented

2026-05-05 06:26:55 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jan 4, 2017):

Thanks!

In 14.04, Chromium now does run with --overlay-tmpfs.

Still fails in 16.04 though, same error as before. 🙁

@laniakea64 commented on GitHub (Jan 4, 2017): Thanks! In 14.04, Chromium now does run with `--overlay-tmpfs`. Still fails in 16.04 though, same error as before. :slightly_frowning_face:

gitea-mirror commented

2026-05-05 06:26:55 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 4, 2017):

It's possible, I only tested it here on Debian stable. I'll give it a try on 16.04.

@netblue30 commented on GitHub (Jan 4, 2017): It's possible, I only tested it here on Debian stable. I'll give it a try on 16.04.

gitea-mirror commented

2026-05-05 06:26:58 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 5, 2017):

Sorry I had to drop this, there are some security issues. For now, OverlayFS will require seccomp, and seccomp will prevent Chromium from starting.

@netblue30 commented on GitHub (Feb 5, 2017): Sorry I had to drop this, there are some security issues. For now, OverlayFS will require seccomp, and seccomp will prevent Chromium from starting.

gitea-mirror commented

2026-05-05 06:26:59 -06:00

Author

Owner

@laniakea64 commented on GitHub (Feb 5, 2017):

Thank you for letting me know.

I tried building the latest firejail with the --disable-seccomp configure flag. And oddly, it didn't work there either.

Anyway, I may have found a workaround -

$ firejail --overlay-tmpfs --noprofile chromium-browser --disable-gpu --no-sandbox

Do I lose out on anything this way?

@laniakea64 commented on GitHub (Feb 5, 2017): Thank you for letting me know. I tried building the latest firejail with the `--disable-seccomp` configure flag. And oddly, it didn't work there either. Anyway, I may have found a workaround - ``` $ firejail --overlay-tmpfs --noprofile chromium-browser --disable-gpu --no-sandbox ``` Do I lose out on anything this way?

gitea-mirror commented

2026-05-05 06:27:01 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 6, 2017):

You will still have seccomp enabled, it is just moved from chromium process to firejail process.

It is very difficult to say what is the best place for seccomp to be. In both cases there are advantages and disadvantages.

@netblue30 commented on GitHub (Feb 6, 2017): You will still have seccomp enabled, it is just moved from chromium process to firejail process. It is very difficult to say what is the best place for seccomp to be. In both cases there are advantages and disadvantages.

gitea-mirror referenced this issue

2026-05-05 10:06:34 -06:00

[PR #687] [MERGED] Typo #3716

Rows
Columns

[GH-ISSUE #1008] Can't run Chromium in firejail with --overlay-tmpfs option #687