[GH-ISSUE #1280] steam.profile update breaks steam #872

Closed
opened 2026-05-05 07:00:36 -06:00 by gitea-mirror · 11 comments
Owner

Originally created by @byouki-onna on GitHub (May 17, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1280

When I updated firejail today steam stopped working. It couldnt find its data directory.
The problem was that firejail whitelisted ~/.local/share/steam, but not ~/.local/share/Steam.
Im pretty sure at least. Its working now that I changed that.
However, the built in web browser is still broken, so I cant access the store.
This is my steam.local, with which it actually starts:

#noblacklist ${HOME}/.local/share/Steam
whitelist ${HOME}/.local/share/Steam
#whitelist ${HOME}/.steam
noblacklist ${HOME}/.steam
noblacklist ${HOME}/.local/share

It does require the whitelist command in particular. it wont start with just noblacklist.
My operating system is x86_64 Void Linux.
Firejail version is 0.9.46.

Originally created by @byouki-onna on GitHub (May 17, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1280 When I updated firejail today steam stopped working. It couldnt find its data directory. The problem was that firejail whitelisted ~/.local/share/steam, but not ~/.local/share/Steam. Im pretty sure at least. Its working now that I changed that. However, the built in web browser is still broken, so I cant access the store. This is my steam.local, with which it actually starts: ``` #noblacklist ${HOME}/.local/share/Steam whitelist ${HOME}/.local/share/Steam #whitelist ${HOME}/.steam noblacklist ${HOME}/.steam noblacklist ${HOME}/.local/share ``` It does require the whitelist command in particular. it wont start with just noblacklist. My operating system is x86_64 Void Linux. Firejail version is 0.9.46.
gitea-mirror 2026-05-05 07:00:36 -06:00
  • closed this issue
  • added the
    bug
    label
Author
Owner

@netblue30 commented on GitHub (May 19, 2017):

Question: On your system, do you have ~/.local/share/steam or ~/.local/share/Steam? Also take a look if you have ~/.steam or ~/.Steam. In quite a number of profiles "steam" is referenced, we probably would have to put "Steam" in also. Thanks for the bug.

<!-- gh-comment-id:302777358 --> @netblue30 commented on GitHub (May 19, 2017): Question: On your system, do you have ~/.local/share/steam or ~/.local/share/Steam? Also take a look if you have ~/.steam or ~/.Steam. In quite a number of profiles "steam" is referenced, we probably would have to put "Steam" in also. Thanks for the bug.
Author
Owner

@byouki-onna commented on GitHub (May 20, 2017):

~/.local/share/Steam, I thought that was implied by saying how whitelisting that fixed it. sorry.

<!-- gh-comment-id:302842263 --> @byouki-onna commented on GitHub (May 20, 2017): ~/.local/share/Steam, I thought that was implied by saying how whitelisting that fixed it. sorry.
Author
Owner

@feragon commented on GitHub (May 20, 2017):

I found how to fix the web browser, it seems to use Chrome, so I removed all the options not present in Chromium profile
I allow perl in my steam.local file, if you don't want to use this file remove disable-devel.

#steam.profile
# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/steam.local

# Steam profile (applies to games/apps launched from Steam as well)
noblacklist ${HOME}/.steam
noblacklist ${HOME}/.local/share/steam
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc

#caps.drop all
ipc-namespace
netfilter
nogroups
#nonewprivs
noroot
#protocol unix,inet,inet6,netlink
#seccomp
shell none
#tracelog

private-dev
private-tmp
#steam.local
private /home/florian/Steam/

private-bin steam,steam-runtime
private-bin sh,bash,env,ls,rm,ln,readlink,dirname,mkdir,tar,id,cp,basename,uname,tr,grep,sed,cat,cmp,md5sum,xz,awk,mktemp,lspci

private-bin chromium,perl
noblacklist /usr/lib/perl*
noblacklist /usr/share/perl*
<!-- gh-comment-id:302871877 --> @feragon commented on GitHub (May 20, 2017): I found how to fix the web browser, it seems to use Chrome, so I removed all the options not present in Chromium profile I allow perl in my steam.local file, if you don't want to use this file remove `disable-devel`. ``` #steam.profile # This file is overwritten during software install. # Persistent customizations should go in a .local file. include /etc/firejail/steam.local # Steam profile (applies to games/apps launched from Steam as well) noblacklist ${HOME}/.steam noblacklist ${HOME}/.local/share/steam include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc #caps.drop all ipc-namespace netfilter nogroups #nonewprivs noroot #protocol unix,inet,inet6,netlink #seccomp shell none #tracelog private-dev private-tmp ``` ``` #steam.local private /home/florian/Steam/ private-bin steam,steam-runtime private-bin sh,bash,env,ls,rm,ln,readlink,dirname,mkdir,tar,id,cp,basename,uname,tr,grep,sed,cat,cmp,md5sum,xz,awk,mktemp,lspci private-bin chromium,perl noblacklist /usr/lib/perl* noblacklist /usr/share/perl* ```
Author
Owner

@Fred-Barclay commented on GitHub (May 20, 2017):

@feragon Thanks!

@byouki-onna Can you try copying this profile to ~/.config/firejail/steam.profile and seeing if everything works?

# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/steam.local

# Steam profile (applies to games/apps launched from Steam as well)
noblacklist ${HOME}/.Steam
noblacklist ${HOME}/.steam
noblacklist ${HOME}/.local/share/Steam
noblacklist ${HOME}/.local/share/steam
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc

ipc-namespace
netfilter
nogroups
noroot
shell none
# Disabled since Steam uses the chromium web browser
#caps.drop all
#nonewprivs
#protocol unix,inet,inet6,netlink
#seccomp
#tracelog

private-dev
private-tmp
<!-- gh-comment-id:302881955 --> @Fred-Barclay commented on GitHub (May 20, 2017): @feragon Thanks! @byouki-onna Can you try copying this profile to ~/.config/firejail/steam.profile and seeing if everything works? ``` # This file is overwritten during software install. # Persistent customizations should go in a .local file. include /etc/firejail/steam.local # Steam profile (applies to games/apps launched from Steam as well) noblacklist ${HOME}/.Steam noblacklist ${HOME}/.steam noblacklist ${HOME}/.local/share/Steam noblacklist ${HOME}/.local/share/steam include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc ipc-namespace netfilter nogroups noroot shell none # Disabled since Steam uses the chromium web browser #caps.drop all #nonewprivs #protocol unix,inet,inet6,netlink #seccomp #tracelog private-dev private-tmp ```
Author
Owner

@breznak commented on GitHub (May 25, 2017):

I'm getting maybe similar? error:

Reading profile /etc/firejail/steam.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Parent pid 30642, child pid 30643
Blacklist violations are logged to syslog
Child process initialized in 74.76 ms
rm: cannot remove '/home/mmm/.steam/ubuntu12_32/steam': Device or resource busy
Running Steam on neon 16.04 64-bit
STEAM_RUNTIME is enabled automatically
Error: Couldn't find bootstrap, it's not safe to reset Steam. Please contact technical support.

Parent is shutting down, bye...
<!-- gh-comment-id:303999455 --> @breznak commented on GitHub (May 25, 2017): I'm getting maybe similar? error: ``` Reading profile /etc/firejail/steam.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-passwdmgr.inc Parent pid 30642, child pid 30643 Blacklist violations are logged to syslog Child process initialized in 74.76 ms rm: cannot remove '/home/mmm/.steam/ubuntu12_32/steam': Device or resource busy Running Steam on neon 16.04 64-bit STEAM_RUNTIME is enabled automatically Error: Couldn't find bootstrap, it's not safe to reset Steam. Please contact technical support. Parent is shutting down, bye... ```
Author
Owner

@Fred-Barclay commented on GitHub (May 25, 2017):

@breznak Can you try the profile I posted above?

<!-- gh-comment-id:304011670 --> @Fred-Barclay commented on GitHub (May 25, 2017): @breznak Can you try the profile I posted above?
Author
Owner

@breznak commented on GitHub (May 25, 2017):

  • created the file https://github.com/netblue30/firejail/issues/1280#issuecomment-302881955
  • ran # firecfg
  • steam -> same crash!
  • #firecfg --clean
  • steam (non-jailed)
    • runs OK
    • I'm using publicbeta channel
    • my ~/.steam is a symlink to -> /mnt/games/steam
    • there was a "steam installer update" which installed during the non-jailed steam run
  • # firecfg (reenable)
  • steam runs, but
    • I'm not sure if in firejail? There are not the msgs as used to be:
$ steam      
Running Steam on neon 16.04 64-bit
STEAM_RUNTIME is enabled automatically
[2017-05-25 16:58:48] Startup - updater built May 19 2017 00:18:18
[2017-05-25 16:58:48] Opted in to client beta 'publicbeta' via beta file
You are in the 'publicbeta' client beta.
Looks like steam didn't shutdown cleanly, scheduling immediate update check
[2017-05-25 16:58:48] Checking for update on startup
[2017-05-25 16:58:48] Checking for available updates...
[2017-05-25 16:58:49] Package file tenfoot_all.zip.vz.d5c981ce92cbf12e9a4fc8ec1df0b0779628c3a8_2276117 missing or incorrect size
[2017-05-25 16:58:49] Package file bins_ubuntu12.zip.vz.d54499a289c37c9cebd3c88c8bdedd9eacac6296_16533941 missing or incorrect size
[2017-05-25 16:58:49] Package file bins_pub_ubuntu12.zip.v

TL;DR:
I think there are 2 issues:

  • steam update crashes when in jail
  • firecfg does not reenable the firejail *)

*)
When I run firejail steam, I get

$firejail  steam
Reading profile /etc/firejail/steam.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Parent pid 23602, child pid 23603
Blacklist violations are logged to syslog
Child process initialized in 72.27 ms
Warning: cannot switch euid to root
Warning: cannot switch egid to root
Warning: cannot switch euid to root
Warning: cannot switch egid to root
Warning: an existing sandbox was detected. /usr/games/steam will run without any additional sandboxing features
rm: cannot remove '/home/mmm/.steam/ubuntu12_32/steam': Device or resource busy
Running Steam on neon 16.04 64-bit
STEAM_RUNTIME is enabled automatically
Error: Couldn't find bootstrap, it's not safe to reset Steam. Please contact technical support.

after firecfg, which steam correctly shows /usr/local/bin/steam

<!-- gh-comment-id:304033674 --> @breznak commented on GitHub (May 25, 2017): - created the file https://github.com/netblue30/firejail/issues/1280#issuecomment-302881955 - ran `# firecfg` - `steam` -> same crash! - `#firecfg --clean` - `steam` (non-jailed) - runs OK - I'm using `publicbeta` channel - my `~/.steam` is a symlink to `-> /mnt/games/steam` - there was a "steam installer update" which installed during the non-jailed steam run - `# firecfg` (reenable) - steam runs, but - I'm not sure if in firejail? There are not the msgs as used to be: ``` $ steam Running Steam on neon 16.04 64-bit STEAM_RUNTIME is enabled automatically [2017-05-25 16:58:48] Startup - updater built May 19 2017 00:18:18 [2017-05-25 16:58:48] Opted in to client beta 'publicbeta' via beta file You are in the 'publicbeta' client beta. Looks like steam didn't shutdown cleanly, scheduling immediate update check [2017-05-25 16:58:48] Checking for update on startup [2017-05-25 16:58:48] Checking for available updates... [2017-05-25 16:58:49] Package file tenfoot_all.zip.vz.d5c981ce92cbf12e9a4fc8ec1df0b0779628c3a8_2276117 missing or incorrect size [2017-05-25 16:58:49] Package file bins_ubuntu12.zip.vz.d54499a289c37c9cebd3c88c8bdedd9eacac6296_16533941 missing or incorrect size [2017-05-25 16:58:49] Package file bins_pub_ubuntu12.zip.v ``` TL;DR: I think there are 2 issues: - steam update crashes when in jail - firecfg does not reenable the firejail *) *) When I run `firejail steam`, I get ``` $firejail steam Reading profile /etc/firejail/steam.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-passwdmgr.inc Parent pid 23602, child pid 23603 Blacklist violations are logged to syslog Child process initialized in 72.27 ms Warning: cannot switch euid to root Warning: cannot switch egid to root Warning: cannot switch euid to root Warning: cannot switch egid to root Warning: an existing sandbox was detected. /usr/games/steam will run without any additional sandboxing features rm: cannot remove '/home/mmm/.steam/ubuntu12_32/steam': Device or resource busy Running Steam on neon 16.04 64-bit STEAM_RUNTIME is enabled automatically Error: Couldn't find bootstrap, it's not safe to reset Steam. Please contact technical support. ``` after firecfg, `which steam` correctly shows `/usr/local/bin/steam`
Author
Owner

@h1z1 commented on GitHub (Jun 13, 2017):

Tried using the profile above, it fails for several reasons. One is trying to access the client pid file

blacklist violation - sandbox 11080, exe cat, syscall open, path /home/steam/.steam/steam.pid

It's also unable to access 32bit libs ?

$ firejail  --tracelog  -- steam -inhibitbootstrap -nobootstraperupdate 
Reading profile /home/steam/.config/firejail/steam.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc
Parent pid 11080, child pid 11081
Blacklist violations are logged to syslog
Child process initialized in 28.50 ms
cat: /home/steam/.steam/steam.pid: Permission denied
Running Steam on centos 7 64-bit
STEAM_RUNTIME is enabled automatically
Error: You are missing the following 32-bit libraries, and Steam may not run:
libc.so.6
/home/steam/.local/share/Steam/steam.sh: line 755: /home/steam/.local/share/Steam/ubuntu12_32/steam: Permission denied

Parent is shutting down, bye...

It's worth noting the last two updates from Valve have broken many systems with varying library problems. Throwing steam in a severely restricted jail is way overdue.

<!-- gh-comment-id:308043321 --> @h1z1 commented on GitHub (Jun 13, 2017): Tried using the profile above, it fails for several reasons. One is trying to access the client pid file ``` blacklist violation - sandbox 11080, exe cat, syscall open, path /home/steam/.steam/steam.pid ``` It's also unable to access 32bit libs ? ``` $ firejail --tracelog -- steam -inhibitbootstrap -nobootstraperupdate Reading profile /home/steam/.config/firejail/steam.profile Reading profile /usr/local/etc/firejail/disable-common.inc Reading profile /usr/local/etc/firejail/disable-programs.inc Reading profile /usr/local/etc/firejail/disable-devel.inc Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc Parent pid 11080, child pid 11081 Blacklist violations are logged to syslog Child process initialized in 28.50 ms cat: /home/steam/.steam/steam.pid: Permission denied Running Steam on centos 7 64-bit STEAM_RUNTIME is enabled automatically Error: You are missing the following 32-bit libraries, and Steam may not run: libc.so.6 /home/steam/.local/share/Steam/steam.sh: line 755: /home/steam/.local/share/Steam/ubuntu12_32/steam: Permission denied Parent is shutting down, bye... ``` It's worth noting the last two updates from Valve have broken many systems with varying library problems. Throwing steam in a severely restricted jail is way overdue.
Author
Owner

@reinerh commented on GitHub (Jun 26, 2017):

I commited a potential fix in 7971937.
The issue was also reported in https://bugs.debian.org/866014
For me this change fixed steam again.
It would be nice if someone could confirm this as well.

<!-- gh-comment-id:311124608 --> @reinerh commented on GitHub (Jun 26, 2017): I commited a potential fix in 7971937. The issue was also reported in https://bugs.debian.org/866014 For me this change fixed steam again. It would be nice if someone could confirm this as well.
Author
Owner

@viq commented on GitHub (Jul 2, 2017):

For what it's worth, this works for me on archlinux:

$ cat .config/firejail/steam.profile 
# Persistent global definitions go here
include /etc/firejail/globals.local

# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/steam.local

# Steam profile (applies to games/apps launched from Steam as well)
noblacklist ${HOME}/.Steam
noblacklist ${HOME}/.steam
noblacklist ${HOME}/.Steampath
noblacklist ${HOME}/.steampath
noblacklist ${HOME}/.Steampid
noblacklist ${HOME}/.steampid
noblacklist ${HOME}/.local/share/Steam
noblacklist ${HOME}/.local/share/steam
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
#include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc

caps.drop all
#caps.keep sys_chroot,sys_admin
ipc-namespace
netfilter
nogroups
nonewprivs
noroot
protocol unix,inet,inet6,netlink
seccomp
shell none
#tracelog

private-dev
private-tmp
$ cat /etc/firejail/steam.local 
## Steam profile (applies to games/apps launched from Steam as well)
#noblacklist ${HOME}/.Steam
#noblacklist ${HOME}/.steam
#noblacklist ${HOME}/.steampath
#noblacklist ${HOME}/.steampid
#noblacklist ${HOME}/.local/share/Steam
#noblacklist ${HOME}/.local/share/steam
#whitelist ${HOME}/.local/share/Steam
#whitelist ${HOME}/.local/share/steam
#whitelist ${HOME}/.steam
##ipc-namespace
include /etc/firejail/whitelist-common.inc

#steam.local
private /home/viq/Steam

private-bin steam,steam-runtime,steam-native
private-bin sh,bash,env,ls,rm,ln,readlink,dirname,mkdir,tar,id,cp,basename,uname,tr,grep,sed,cat,cmp,md5sum,xz,awk,mktemp,lspci
private-bin file,ldd,awk,gawk,zenity,mv

private-bin chromium,perl
noblacklist /usr/lib/perl*
noblacklist /usr/share/perl*
noblacklist /usr/lib32/*
noblacklist /usr/lib/chromium/*

Yes, probably a bunch of the stuff in steam.local is not necessary.

But, one very strange thing: having tracelog enabled causes steam store (so the integrated browser) just show black page, nothing on it. Disabling tracelog makes it work again.

<!-- gh-comment-id:312477855 --> @viq commented on GitHub (Jul 2, 2017): For what it's worth, this works for me on archlinux: ``` $ cat .config/firejail/steam.profile # Persistent global definitions go here include /etc/firejail/globals.local # This file is overwritten during software install. # Persistent customizations should go in a .local file. include /etc/firejail/steam.local # Steam profile (applies to games/apps launched from Steam as well) noblacklist ${HOME}/.Steam noblacklist ${HOME}/.steam noblacklist ${HOME}/.Steampath noblacklist ${HOME}/.steampath noblacklist ${HOME}/.Steampid noblacklist ${HOME}/.steampid noblacklist ${HOME}/.local/share/Steam noblacklist ${HOME}/.local/share/steam include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc #include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc caps.drop all #caps.keep sys_chroot,sys_admin ipc-namespace netfilter nogroups nonewprivs noroot protocol unix,inet,inet6,netlink seccomp shell none #tracelog private-dev private-tmp ``` ``` $ cat /etc/firejail/steam.local ## Steam profile (applies to games/apps launched from Steam as well) #noblacklist ${HOME}/.Steam #noblacklist ${HOME}/.steam #noblacklist ${HOME}/.steampath #noblacklist ${HOME}/.steampid #noblacklist ${HOME}/.local/share/Steam #noblacklist ${HOME}/.local/share/steam #whitelist ${HOME}/.local/share/Steam #whitelist ${HOME}/.local/share/steam #whitelist ${HOME}/.steam ##ipc-namespace include /etc/firejail/whitelist-common.inc #steam.local private /home/viq/Steam private-bin steam,steam-runtime,steam-native private-bin sh,bash,env,ls,rm,ln,readlink,dirname,mkdir,tar,id,cp,basename,uname,tr,grep,sed,cat,cmp,md5sum,xz,awk,mktemp,lspci private-bin file,ldd,awk,gawk,zenity,mv private-bin chromium,perl noblacklist /usr/lib/perl* noblacklist /usr/share/perl* noblacklist /usr/lib32/* noblacklist /usr/lib/chromium/* ``` Yes, probably a bunch of the stuff in `steam.local` is not necessary. But, one very strange thing: having `tracelog` enabled causes steam store (so the integrated browser) just show black page, nothing on it. Disabling `tracelog` makes it work again.
Author
Owner

@reinerh commented on GitHub (Jul 11, 2017):

Thanks @viq. The tracelog hint was helpful. It restored the integrated browser also for me. I'll commit this fix.

<!-- gh-comment-id:314416493 --> @reinerh commented on GitHub (Jul 11, 2017): Thanks @viq. The `tracelog` hint was helpful. It restored the integrated browser also for me. I'll commit this fix.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#872
No description provided.