[GH-ISSUE #1101] Latest firefox doesn't work with firejail #755

Closed
opened 2026-05-05 06:34:53 -06:00 by gitea-mirror · 4 comments
Owner

Originally created by @Pentarctagon on GitHub (Feb 13, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1101

Firefox version is 53.0a2(downloaded to my desktop from here, e10s is enabled)
Firejail version is 0.9.44.8
OS is Mint 18.1

When starting firefox through firejail, it shows the following:

Reading profile /home/derpy/.config/firejail/firefox.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/whitelist-common.inc
Warning: cannot switch euid to root
Warning: cannot switch egid to root
Warning: cannot switch euid to root
Warning: cannot switch egid to root
Warning: an existing sandbox was detected. /home/derpy/Desktop/firefox/firefox will run without any additional sandboxing features

My profile:

noblacklist ~/.mozilla
noblacklist ~/.cache/mozilla
noblacklist /home/derpy/Desktop/firefox

include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc

caps.drop all
netfilter
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp
tracelog

whitelist ${DOWNLOADS}
whitelist ~/.mozilla
whitelist ~/.cache/mozilla/firefox
whitelist /home/derpy/Desktop/firefox

include /etc/firejail/whitelist-common.inc

I also modified /usr/bin/firefox to do:
exec firejail --name=foxjail /home/derpy/Desktop/firefox/firefox "$@"

Using --force does not help.

Originally created by @Pentarctagon on GitHub (Feb 13, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1101 Firefox version is 53.0a2(downloaded to my desktop from [here](https://www.mozilla.org/en-US/firefox/channel/desktop/#aurora), e10s is enabled) Firejail version is 0.9.44.8 OS is Mint 18.1 When starting firefox through firejail, it shows the following: > Reading profile /home/derpy/.config/firejail/firefox.profile > Reading profile /etc/firejail/disable-common.inc > Reading profile /etc/firejail/disable-programs.inc > Reading profile /etc/firejail/disable-devel.inc > Reading profile /etc/firejail/whitelist-common.inc > Warning: cannot switch euid to root > Warning: cannot switch egid to root > Warning: cannot switch euid to root > Warning: cannot switch egid to root > Warning: an existing sandbox was detected. /home/derpy/Desktop/firefox/firefox will run without any additional sandboxing features My profile: > noblacklist ~/.mozilla > noblacklist ~/.cache/mozilla > noblacklist /home/derpy/Desktop/firefox > > include /etc/firejail/disable-common.inc > include /etc/firejail/disable-programs.inc > include /etc/firejail/disable-devel.inc > > caps.drop all > netfilter > nonewprivs > noroot > protocol unix,inet,inet6,netlink > seccomp > tracelog > > whitelist ${DOWNLOADS} > whitelist ~/.mozilla > whitelist ~/.cache/mozilla/firefox > whitelist /home/derpy/Desktop/firefox > > include /etc/firejail/whitelist-common.inc I also modified /usr/bin/firefox to do: `exec firejail --name=foxjail /home/derpy/Desktop/firefox/firefox "$@"` Using `--force` does not help.
Author
Owner

@curiosity-seeker commented on GitHub (Feb 13, 2017):

I suspect that this might be caused by the fact that sandboxing finally might be enabled in that version which is based on seccomp-bpf. If that's the case this probably collides with the Firejail seccomp option (as it is the case for Chromium/Chrome).

So you can try 2 things to solve the problem:

  1. Comment seccomp in the Firejail profile.
  2. Deactivate seccomp somehow/somewhere in about:config
<!-- gh-comment-id:279351972 --> @curiosity-seeker commented on GitHub (Feb 13, 2017): I suspect that this might be caused by the fact that [sandboxing](https://wiki.mozilla.org/Security/Sandbox) finally might be enabled in that version which is based on seccomp-bpf. If that's the case this probably collides with the Firejail seccomp option (as it is the case for Chromium/Chrome). So you can try 2 things to solve the problem: 1. Comment `seccomp` in the Firejail profile. 2. Deactivate seccomp somehow/somewhere in about:config
Author
Owner

@Pentarctagon commented on GitHub (Feb 13, 2017):

For 1) removing seccomp from the profile does not fix the problem.

For 2) I attempted to disable seccomp via this environment variable, which didn't help. Neither did using about:config to disable the sandbox as a whole. In fact, neither of these seem to do anything at all. The about:config entries didn't even exist and I had to create them myself. Disabling e10s also did not cause the error to go away.

<!-- gh-comment-id:279507614 --> @Pentarctagon commented on GitHub (Feb 13, 2017): For 1) removing `seccomp` from the profile does not fix the problem. For 2) I attempted to disable seccomp via [this](https://wiki.mozilla.org/Security/Sandbox/Seccomp#How_do_I_disable_the_sandbox_temporarily.3F) environment variable, which didn't help. Neither did using [about:config](https://wiki.mozilla.org/Security/Sandbox#Linux) to disable the sandbox as a whole. In fact, neither of these seem to do anything at all. The about:config entries didn't even exist and I had to create them myself. Disabling e10s also did not cause the error to go away.
Author
Owner

@netblue30 commented on GitHub (Feb 13, 2017):

I got the developer version from your link, and is working fine. Apparently, they don't start the sandbox by default.

<!-- gh-comment-id:279560093 --> @netblue30 commented on GitHub (Feb 13, 2017): I got the developer version from your link, and is working fine. Apparently, they don't start the sandbox by default.
Author
Owner

@Pentarctagon commented on GitHub (Feb 14, 2017):

Huh, that's odd. I've changed quite a few things, but the sandbox was never one of them. I have been thinking of starting over with a fresh profile for a while though; maybe it's time I finally do that.

Thanks for the replies.

<!-- gh-comment-id:279625398 --> @Pentarctagon commented on GitHub (Feb 14, 2017): Huh, that's odd. I've changed quite a few things, but the sandbox was never one of them. I have been thinking of starting over with a fresh profile for a while though; maybe it's time I finally do that. Thanks for the replies.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#755
No description provided.