mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1137] Chrome applications (including electron) that use system tray sets empty tray icon when private-tmp is active #786
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#786
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @msva on GitHub (Mar 9, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1137
I've found that
slack(which haveprivate-tmpactive in default system-wide profile) started to render empty icon in the tray.Debugging showed that on every start it creates two directories under
/tmp, named like.org.chromium.Chromium.[6 random alphanumeric]. And one of them containsicons/hicolor/24x24/appspath, and in theappsdirectory, it places is a files (may be more than one), that named like:chrome_app_indicator2_[32 random hex digit].png.I guess, it tells systemtray to load icon from that path, but since the path exists only in private bin, system tray fails to do that.
I'd try to work it around with
whitelist /tmp/.org.chromium.Chromium.*, but...whitelist(and friends) does not support regex 😺// Although, I anyway not sure, if
whitelistworks in reverse way and allows to create whitelisted files on host system...And, it is also happens when running
chrome/chromiumunder firejail and using chrome apps, as it also happens with another electron-based apps.@netblue30 commented on GitHub (Mar 9, 2017):
I would try to comment out (add a #) private-tmp in /etc/firejail/slack.profile.
@msva commented on GitHub (Mar 9, 2017):
Yes, it helps (that is how I debugged that it is private-tmp's fault).
But it has side-effects:
@netblue30 commented on GitHub (Mar 10, 2017):
For 2) is easy, I'll remove it from the profile.
For 1), can you figure out what files or directories it uses in /tmp? We can whitelist /tmp. At minimum, we need just a "whitelist /tmp/.X11-unix" and the directories/files created by slack.
@msva commented on GitHub (Mar 10, 2017):
as far as I looked in private /tmp inside jail, it only creates directory
"Slack Crashes" and two directories I described above
(".org.chromium.Chromium.[a-zA-Z0-9]{6}"), and uses nothing from system's /tmp
@netblue30 commented on GitHub (Mar 10, 2017):
OK, so I only need to add some basic globbing/regx support in whitelists, something like
@msva commented on GitHub (Apr 9, 2017):
Hi there!
Is it ant progress about this? 😎
@msva commented on GitHub (Aug 1, 2017):
I'm not sure if whitelist now supports wildcards (at least, it doesn't compain on
*), but this is still the issue.And, I'm not sure, if it will work as intended out of the box, since it creates that directories (containing the tray icon png file) in runtime (i.e. after start), and they have unique names every time.
So, I'm not sure, if it will be enough to just whitelist that directories (with wildcard), or will firejail need to "proxy" that directories in "outter" /tmp?..
How do you think, @netblue30 ?
@msva commented on GitHub (Aug 1, 2017):
By the way, the same thing is actual for chrome forks. For example, Yandex Browser just created
/tmp/.ru.yandex.desktop.browser.MJGCGodirectory. I bet new Opera doing it in the similar way.So, we definitely need a way to somehow whitelist not-yet-created directories by mask (to not just manually blacklist files from /tmp to prevent proprietary things to access, but just sandbox them in their own /tmp, but having some directories they creating in outter /tmp.
Or, maybe, do a LD_PRELOAD hack to hijack that files creation/writing to them and do the same in "external" copy in "outter" /tmp.
@chiraag-nataraj commented on GitHub (Mar 29, 2018):
Hey all,
I'm actually currently using
private-tmpwithslackand it's actually the only way it works (apparently Electron apps need/tmpto be executable, and my/tmpis mountednoexec). I've attached the profile I'm using currently - can someone else test and report back if it works for them?slack.txt
@alien2003 commented on GitHub (Mar 22, 2019):
The same with wire-desktop and slack for me
@SkewedZeppelin commented on GitHub (Mar 22, 2019):
@alien2003
try adding the following to
~/.config/firejail/[broken program].localor globals.local@alien2003 commented on GitHub (Mar 22, 2019):
@SkewedZeppelin No errors in terminal now but the icon is still missing. I use Gnome 3.30.2 on Manjaro with this extension for tay icons: https://extensions.gnome.org/extension/615/appindicator-support/
@alien2003 commented on GitHub (Mar 22, 2019):
Seems to be ok with this extension: https://extensions.gnome.org/extension/1503/tray-icons/
@intika commented on GitHub (May 19, 2019):
Same issue with skype... as its chromium based...
Awaiting wildcards support for white-list here are some possible solutions....
(Edit: not good) run the application with an other user dedicated to that application... (with dbus-lauch)
(Edit: not good) Ohhh i found a quick easy solution ! just prefix the binary with dbus-launch...
firejail --profile=/etc/firejail/skypeforlinux.profile dbus-launch skypeforlinuxdbus-launch will proxify the necessary stuff and keep the tmp jailed...
Note that with dbus-launcher it's buggy and slow to use it with... so left with no solution... have to dig a little deeper... Wildcards white list is not implemented yet as of 05/2019
Edit:
i think i found the problem and its not related at all...
here is the solution
export TMPDIR=${HOME}/whateverAfter some debugging... here is my little report
First of all the problem seems to be caused by an empty $TMPDIR environment variable when --private-tmp is used (firejail bug ?)
So basically the solution is to create a directory accessible by the user let say /tmpjail then set $TMPDIR to that directory under the profile file like so:
env TMPDIR=/tmpjail@netblue30 for firejail a reliable solution could be a new feature (let say --accessible-tmp) that would mount a tmpfs to the main namespace under /tmp/tmpjail (and white list it) then set $TMPDIR and $TMP to /tmp/tmpjail (this solution would solve the problem and keep the /tmp jailed)
A quick easy solution would be editing the problematic profiles like skype use "mkdir" to create /tmp/tmpjail, whitelist it then set the tmp variable to that file...
@smitsohu commented on GitHub (Jul 25, 2020):
Whitelist globbing was added recently by @netblue30, so
whitelist /tmp/.org.chromium.Chromium.*should work now in Firejail master.Could someone confirm?
@rusty-snake commented on GitHub (Jul 25, 2020):
@smitsohu if I got this right,
/tmp/foobar.XXXXis create by foobar. This still did not help.@smitsohu commented on GitHub (Jul 25, 2020):
@rusty-snake I see. Then the only solutions are indeed
ignore private-tmp@rusty-snake commented on GitHub (Aug 5, 2020):
result from #3540:
edit: removed useless
dbus-user.talk org.freedesktop.StatusNotifierItemlines, see #3774.Would it make sense to add a
private-tmp-exposedwhich does the/tmp/FOO-tmpstuff?