github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1046] rules: Firejail is preventing epiphany from "installing" web applications #709

New issue

Closed

opened 2026-05-05 06:29:28 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 06:29:28 -06:00

Owner

Originally created by @genodeftest on GitHub (Jan 12, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1046

I don't see any way to start a web application I created with Epiphany 3.22.

Steps to reproduce:

browse on any website, e.g. https://web.telegram.org/
save website as web application
close epiphany
try to find the web application

What happens:
The web application doesn't show up in gnome-shell activities overview search or in alacarte's "Web application" section. It doesn't show up in ~/.local/share/applications either. I have to manually start the application from ~/.config/epiphany/app-epiphany-telegram-web-[some-hash]/epiphany-telegram-web-[some-hash].desktop. Instead, this message is printed to syslog:

Jan 09 20:40:53 hostname org.gnome.Software[1566]: 19:40:53:0674 Gs  Failed to get AppStream metadata: GPG signatures found, but none are in trusted keyring [g-io-error-quark:0]
Jan 09 20:40:53 hostname org.gnome.Software[1566]: 19:40:53:0682 Gs  State change on system/*/*/webapp/epiphany.desktop/* from installed to available is not OK

What should happen:
Symlink the ~/.config/epiphany/[foo]/[bar].desktop file to ~/.local/share/applications or somewhere else where gnome-shell can find it.

Installed software versions:
gnome-shell-3.22.2-2.fc25.x86_64
epiphany-3.22.4-1.fc25.x86_64
firejail 0.9.45 from git master

Additional info:
Originally created as bug 777189 in GNOME's bugzilla.

Originally created by @genodeftest on GitHub (Jan 12, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1046 I don't see any way to start a web application I created with Epiphany 3.22. Steps to reproduce: 1. browse on any website, e.g. https://web.telegram.org/ 2. save website as web application 3. close epiphany 4. try to find the web application What happens: The web application doesn't show up in gnome-shell activities overview search or in alacarte's "Web application" section. It doesn't show up in `~/.local/share/applications` either. I have to manually start the application from `~/.config/epiphany/app-epiphany-telegram-web-[some-hash]/epiphany-telegram-web-[some-hash].desktop`. Instead, this message is printed to syslog: ``` Jan 09 20:40:53 hostname org.gnome.Software[1566]: 19:40:53:0674 Gs Failed to get AppStream metadata: GPG signatures found, but none are in trusted keyring [g-io-error-quark:0] Jan 09 20:40:53 hostname org.gnome.Software[1566]: 19:40:53:0682 Gs State change on system/*/*/webapp/epiphany.desktop/* from installed to available is not OK ``` What should happen: Symlink the ~/.config/epiphany/[foo]/[bar].desktop file to ~/.local/share/applications or somewhere else where gnome-shell can find it. Installed software versions: gnome-shell-3.22.2-2.fc25.x86_64 epiphany-3.22.4-1.fc25.x86_64 firejail 0.9.45 from git master Additional info: Originally created as bug [777189](https://bugzilla.gnome.org/show_bug.cgi?id=777189) in GNOME's bugzilla.

gitea-mirror

2026-05-05 06:29:28 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 06:29:33 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 14, 2017):

I'll have to investigate it. Epiphany has a whitelisted profile, it is possible the web app is installed in the user home directory, and this directory is in a temporary filesystem. The filesystem is not visible to the rest of the system. What happens is you run epiphany with no profile? - "firejail --noprofile epiphany"

@netblue30 commented on GitHub (Jan 14, 2017): I'll have to investigate it. Epiphany has a whitelisted profile, it is possible the web app is installed in the user home directory, and this directory is in a temporary filesystem. The filesystem is not visible to the rest of the system. What happens is you run epiphany with no profile? - "firejail --noprofile epiphany"

gitea-mirror commented

2026-05-05 06:29:35 -06:00

Author

Owner

@genodeftest commented on GitHub (Jan 14, 2017):

What happens is you run epiphany with no profile? - "firejail --noprofile epiphany"

With this command, creating and running web applications works fine.

@genodeftest commented on GitHub (Jan 14, 2017): > What happens is you run epiphany with no profile? - "firejail --noprofile epiphany" With this command, creating and running web applications works fine.

gitea-mirror commented

2026-05-05 06:29:38 -06:00

Author

Owner

@genodeftest commented on GitHub (Jan 14, 2017):

I would guess the fix includes not blacklisting ~/.local/share/applications, but adding a noblacklist ${HOME}/.local/share/applications or a whitelist ${HOME}/.local/share/applications line doesn't fix the problem.

@genodeftest commented on GitHub (Jan 14, 2017): I would guess the fix includes not blacklisting `~/.local/share/applications`, but adding a `noblacklist ${HOME}/.local/share/applications` or a `whitelist ${HOME}/.local/share/applications` line doesn't fix the problem.

gitea-mirror commented

2026-05-05 06:29:41 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 17, 2017):

With this command, creating and running web applications works fine.

This is good news, it means we can fix it. Let's try to replace epiphany with a very generic profile:.

$ firejail --profile=/etc/firejail/openbox.profile epiphany

openbox profile is the most generic profile we have at the moment. It disables only password and encryption keys in home directory, but it installs secccomp and all the other security filters.

@netblue30 commented on GitHub (Jan 17, 2017): > With this command, creating and running web applications works fine. This is good news, it means we can fix it. Let's try to replace epiphany with a very generic profile:. ````` $ firejail --profile=/etc/firejail/openbox.profile epiphany ````` openbox profile is the most generic profile we have at the moment. It disables only password and encryption keys in home directory, but it installs secccomp and all the other security filters.

gitea-mirror referenced this issue

2026-05-05 10:06:45 -06:00

[PR #709] [MERGED] Gather shell selection code in one place #3723

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#709

No description provided.

Rows
Columns