[GH-ISSUE #1321] keepassx segfault #903

Closed
opened 2026-05-05 07:05:51 -06:00 by gitea-mirror · 27 comments
Owner

Originally created by @8cc on GitHub (May 30, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1321

Fedora 25 KDE spins, firejail 0.9.44.10 (copr nielsenb/firejail), keepassx 2.0.3.
When try to select a file, segfault.

$ firejail keepassx
Reading profile /etc/firejail/keepassx.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Parent pid 4773, child pid 4774
Blacklist violations are logged to syslog
Child process initialized
Qt: Session management error: Could not open network socket
ERROR: Running KSycoca failed.

Parent is shutting down, bye...

dmesg
[199975.701777] keepassx[5132]: segfault at 0 ip 00007f2fead15a09 sp 00007ffdb9aecad0 error 4 in libkio.so.5.14.30[7f2feab26000+2b4000]

Originally created by @8cc on GitHub (May 30, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1321 Fedora 25 KDE spins, firejail 0.9.44.10 (copr nielsenb/firejail), keepassx 2.0.3. When try to select a file, segfault. ``` $ firejail keepassx Reading profile /etc/firejail/keepassx.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-passwdmgr.inc Parent pid 4773, child pid 4774 Blacklist violations are logged to syslog Child process initialized Qt: Session management error: Could not open network socket ERROR: Running KSycoca failed. Parent is shutting down, bye... ``` dmesg `[199975.701777] keepassx[5132]: segfault at 0 ip 00007f2fead15a09 sp 00007ffdb9aecad0 error 4 in libkio.so.5.14.30[7f2feab26000+2b4000]`
gitea-mirror 2026-05-05 07:05:51 -06:00
Author
Owner

@netblue30 commented on GitHub (May 30, 2017):

In a text editor open /etc/firejail/kepassx.profile and change "protocol unix" in "protocol unix,inet,inet6". Let me know if is working.

<!-- gh-comment-id:305017622 --> @netblue30 commented on GitHub (May 30, 2017): In a text editor open /etc/firejail/kepassx.profile and change "protocol unix" in "protocol unix,inet,inet6". Let me know if is working.
Author
Owner

@8cc commented on GitHub (May 30, 2017):

It's not working. Problem persists.

<!-- gh-comment-id:305021884 --> @8cc commented on GitHub (May 30, 2017): It's not working. Problem persists.
Author
Owner

@netblue30 commented on GitHub (May 30, 2017):

I think is "net none" in the same file - comment it out. Somehow I missed it!

<!-- gh-comment-id:305022794 --> @netblue30 commented on GitHub (May 30, 2017): I think is "net none" in the same file - comment it out. Somehow I missed it!
Author
Owner

@8cc commented on GitHub (May 30, 2017):

Comment to "net none" could not help, problem persists.

<!-- gh-comment-id:305024120 --> @8cc commented on GitHub (May 30, 2017): Comment to "net none" could not help, problem persists.
Author
Owner

@Fred-Barclay commented on GitHub (May 31, 2017):

@8cc Is the latest version of firejail (0.9.46) available for your distro?

On 05/30/2017 05:14 PM, 8cc wrote:

Comments to "net none" could not help, problem persists.


You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/netblue30/firejail/issues/1321#issuecomment-305024120,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AKphKwFGGhKj8kMI60GKOKSgq-wcvpNFks5r_JSogaJpZM4NqgG4.

<!-- gh-comment-id:305076379 --> @Fred-Barclay commented on GitHub (May 31, 2017): @8cc Is the latest version of firejail (0.9.46) available for your distro? On 05/30/2017 05:14 PM, 8cc wrote: > > Comments to "net none" could not help, problem persists. > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <https://github.com/netblue30/firejail/issues/1321#issuecomment-305024120>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AKphKwFGGhKj8kMI60GKOKSgq-wcvpNFks5r_JSogaJpZM4NqgG4>. >
Author
Owner

@8cc commented on GitHub (May 31, 2017):

Firejail is available in third-party repositories from the community, but I do not see the latest version. There is also a binary .rpm package with the latest version here: https://sourceforge.net/projects/firejail/files/firejail/ But it seemed to me that the problem is in configs, and the new version is not so much needed.

<!-- gh-comment-id:305095750 --> @8cc commented on GitHub (May 31, 2017): Firejail is available in third-party repositories from the community, but I do not see the latest version. There is also a binary .rpm package with the latest version here: https://sourceforge.net/projects/firejail/files/firejail/ But it seemed to me that the problem is in configs, and the new version is not so much needed.
Author
Owner

@Fred-Barclay commented on GitHub (May 31, 2017):

Hi @8cc,

Go with the binary .rpm from
https://sourceforge.net/projects/firejail/files/firejail/ please, then
see if the problem still exists.

On 05/31/2017 01:24 AM, 8cc wrote:

Firejail is available in third-party repositories from the community,
but I do not see the latest version. There is also a binary .rpm
package with the latest version here:
https://sourceforge.net/projects/firejail/files/firejail/


You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/netblue30/firejail/issues/1321#issuecomment-305095750,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AKphK8BXUbu9dwzT2kM0cJ8gGgrs3TT3ks5r_QeJgaJpZM4NqgG4.

<!-- gh-comment-id:305210195 --> @Fred-Barclay commented on GitHub (May 31, 2017): Hi @8cc, Go with the binary .rpm from https://sourceforge.net/projects/firejail/files/firejail/ please, then see if the problem still exists. On 05/31/2017 01:24 AM, 8cc wrote: > > Firejail is available in third-party repositories from the community, > but I do not see the latest version. There is also a binary .rpm > package with the latest version here: > https://sourceforge.net/projects/firejail/files/firejail/ > > — > You are receiving this because you commented. > Reply to this email directly, view it on GitHub > <https://github.com/netblue30/firejail/issues/1321#issuecomment-305095750>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AKphK8BXUbu9dwzT2kM0cJ8gGgrs3TT3ks5r_QeJgaJpZM4NqgG4>. >
Author
Owner

@8cc commented on GitHub (May 31, 2017):

Updated to the latest version through the .rpm , now the keepassx does not start. Tried to change configs, does not help.

<!-- gh-comment-id:305234305 --> @8cc commented on GitHub (May 31, 2017): Updated to the latest version through the .rpm , now the keepassx does not start. Tried to change configs, does not help.
Author
Owner

@Fred-Barclay commented on GitHub (May 31, 2017):

@8cc let me make sure I understand the problem correctly:

  • For firejail 0.9.44.10 through copr nielsenb/firejail, keepassx starts but segfaults when you try to choose a file.'
  • For firejail 0.9.46, keepassx does not start at all
  • When not using firejail (either version), keepassx behaves normally

Is this correct?
Can you post the exact keepassx profile you are using?
Can you run the following and post the output: firejail --debug keepassx?

<!-- gh-comment-id:305334368 --> @Fred-Barclay commented on GitHub (May 31, 2017): @8cc let me make sure I understand the problem correctly: - For firejail 0.9.44.10 through copr nielsenb/firejail, keepassx starts but segfaults when you try to choose a file.' - For firejail 0.9.46, keepassx does not start at all - When not using firejail (either version), keepassx behaves normally Is this correct? Can you post the exact keepassx profile you are using? Can you run the following and post the output: `firejail --debug keepassx`?
Author
Owner

@8cc commented on GitHub (May 31, 2017):

Yes, that right.
I use default configuration in nielsenb/firejail:

# This file is overwritten during software install.
# Persistent customizations should go in a .local file.
include /etc/firejail/keepassx.local

# keepassx password manager profile
noblacklist ${HOME}/.config/keepassx
noblacklist ${HOME}/.keepassx
noblacklist ${HOME}/*.kdbx
noblacklist ${HOME}/*.kdb
 
include /etc/firejail/disable-common.inc
include /etc/firejail/disable-programs.inc
include /etc/firejail/disable-devel.inc
include /etc/firejail/disable-passwdmgr.inc

caps.drop all
net none
nogroups
nonewprivs
noroot
nosound
protocol unix
seccomp
shell none
tracelog

private-bin keepassx
private-etc fonts
private-dev
#private-tmp - mask KDE problems

firejail --debug keepassx
and tried to select a file.
https://gist.github.com/8cc/bbee4754f8b12e0b6a777e29f5ce3c73

<!-- gh-comment-id:305350795 --> @8cc commented on GitHub (May 31, 2017): Yes, that right. I use default configuration in nielsenb/firejail: ``` # This file is overwritten during software install. # Persistent customizations should go in a .local file. include /etc/firejail/keepassx.local # keepassx password manager profile noblacklist ${HOME}/.config/keepassx noblacklist ${HOME}/.keepassx noblacklist ${HOME}/*.kdbx noblacklist ${HOME}/*.kdb include /etc/firejail/disable-common.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-passwdmgr.inc caps.drop all net none nogroups nonewprivs noroot nosound protocol unix seccomp shell none tracelog private-bin keepassx private-etc fonts private-dev #private-tmp - mask KDE problems ``` firejail --debug keepassx and tried to select a file. https://gist.github.com/8cc/bbee4754f8b12e0b6a777e29f5ce3c73
Author
Owner

@Fred-Barclay commented on GitHub (Jun 1, 2017):

Try commenting out private-bin keepassx

Can you help me understand what this Ksyscoca is that keeps being referenced in the error message? I can't find it in the Fedora package database https://admin.fedoraproject.org/pkgdb/packages/KSycoca%2A/
The best I can tell it was dropped after KDE 3, though it's still in the Trinity DE.

<!-- gh-comment-id:305382368 --> @Fred-Barclay commented on GitHub (Jun 1, 2017): Try commenting out `private-bin keepassx` Can you help me understand what this Ksyscoca is that keeps being referenced in the error message? I can't find it in the Fedora package database https://admin.fedoraproject.org/pkgdb/packages/KSycoca%2A/ The best I can tell it was dropped after KDE 3, though it's still in the Trinity DE.
Author
Owner

@8cc commented on GitHub (Jun 1, 2017):

Сomment private-bin keepassx not help.
KDE SYstem COnfiguration CAche.

<!-- gh-comment-id:305390035 --> @8cc commented on GitHub (Jun 1, 2017): Сomment `private-bin keepassx` not help. [KDE SYstem COnfiguration CAche](https://userbase.kde.org/KDE_System_Administration/Caches#KSycoca).
Author
Owner

@Anyon3 commented on GitHub (Jun 1, 2017):

Try with firejail in command line without a defined profile

firejail --machine-id --noprofile --nonewprivs --noroot --caps.drop=all --nosound --private-dev --seccomp --no3d --private-tmp --nogroups --net=none keepassx

Hope it's help

<!-- gh-comment-id:305391627 --> @Anyon3 commented on GitHub (Jun 1, 2017): Try with firejail in command line without a defined profile firejail --machine-id --noprofile --nonewprivs --noroot --caps.drop=all --nosound --private-dev --seccomp --no3d --private-tmp --nogroups --net=none keepassx Hope it's help
Author
Owner

@8cc commented on GitHub (Jun 1, 2017):

firejail --machine-id --noprofile --nonewprivs --noroot --caps.drop=all --nosound --private-dev --seccomp --no3d --private-tmp --nogroups --net=none keepassx

Keepassx started, the file selection dialog appeared, but when try to select: "The specified folder does not exist or was not readable." Perhaps this is not the fault of the firejail.

<!-- gh-comment-id:305400754 --> @8cc commented on GitHub (Jun 1, 2017): `firejail --machine-id --noprofile --nonewprivs --noroot --caps.drop=all --nosound --private-dev --seccomp --no3d --private-tmp --nogroups --net=none keepassx` Keepassx started, the file selection dialog appeared, but when try to select: "The specified folder does not exist or was not readable." Perhaps this is not the fault of the firejail.
Author
Owner

@Anyon3 commented on GitHub (Jun 1, 2017):

Try to remove the argument --nogroups and --nonewprivs (nonewprivs is not required when --seccomp is passed)

If it's still the same, give a try to keepassxc

<!-- gh-comment-id:305407070 --> @Anyon3 commented on GitHub (Jun 1, 2017): Try to remove the argument --nogroups and --nonewprivs (nonewprivs is not required when --seccomp is passed) If it's still the same, give a try to keepassxc
Author
Owner

@8cc commented on GitHub (Jun 1, 2017):

Keepassx started, the file selection dialog appeared, but when try to select: "The specified folder does not exist or was not readable." Perhaps this is not the fault of the firejail.

Works! Files are selected when not --private. (I added it for some reason)

<!-- gh-comment-id:305412296 --> @8cc commented on GitHub (Jun 1, 2017): > Keepassx started, the file selection dialog appeared, but when try to select: "The specified folder does not exist or was not readable." Perhaps this is not the fault of the firejail. Works! Files are selected when not `--private`. (I added it for some reason)
Author
Owner

@Anyon3 commented on GitHub (Jun 1, 2017):

you could maybe try to add a directory inside your /home/$user/ like keepassxjail and add --private=~/keepassxjail/ (don't forget to place your kdbx database inside keepassxjail) to increase the security.

<!-- gh-comment-id:305416482 --> @Anyon3 commented on GitHub (Jun 1, 2017): you could maybe try to add a directory inside your /home/$user/ like keepassxjail and add --private=~/keepassxjail/ (don't forget to place your kdbx database inside keepassxjail) to increase the security.
Author
Owner

@netblue30 commented on GitHub (Jun 1, 2017):

Qt: Session management error: Could not open network socket

What bothers me is you have a password manager crashed by the sandbox when it tries to connect to the network. Why would a password manager try to connect to the network?

Also, make sure you run 0.9.46. In this version a lot of fixes went in for all keepass utilities. You can get an .rpm package from our download page, it was build on CentOS 7, it should work fine on any Fedora distro released after that.

<!-- gh-comment-id:305467433 --> @netblue30 commented on GitHub (Jun 1, 2017): > Qt: Session management error: Could not open network socket What bothers me is you have a password manager crashed by the sandbox when it tries to connect to the network. Why would a password manager try to connect to the network? Also, make sure you run 0.9.46. In this version a lot of fixes went in for all keepass utilities. You can get an .rpm package from our download page, it was build on CentOS 7, it should work fine on any Fedora distro released after that.
Author
Owner

@Anyon3 commented on GitHub (Jun 1, 2017):

Looking at the dmesg output, could https://en.wikipedia.org/wiki/KIO explain the connection of his keepassx over the network ?

<!-- gh-comment-id:305533602 --> @Anyon3 commented on GitHub (Jun 1, 2017): Looking at the dmesg output, could https://en.wikipedia.org/wiki/KIO explain the connection of his keepassx over the network ?
Author
Owner

@Fred-Barclay commented on GitHub (Jun 1, 2017):

What bothers me is you have a password manager crashed by the sandbox when it tries to connect to the network.

I'm not sure that it's crashed when trying to connect to the network. I get the exact same output on Debian Sid MATE and keepassx works fine in firejail:

Reading profile /etc/firejail/keepassx.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Parent pid 6387, child pid 6388
Blacklist violations are logged to syslog
Child process initialized in 75.42 ms
Qt: Session management error: Could not open network socket
<!-- gh-comment-id:305552208 --> @Fred-Barclay commented on GitHub (Jun 1, 2017): > What bothers me is you have a password manager crashed by the sandbox when it tries to connect to the network. I'm not sure that it's crashed when trying to connect to the network. I get the exact same output on Debian Sid MATE and keepassx works fine in firejail: ```$ firejail keepassx Reading profile /etc/firejail/keepassx.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-passwdmgr.inc Parent pid 6387, child pid 6388 Blacklist violations are logged to syslog Child process initialized in 75.42 ms Qt: Session management error: Could not open network socket ```
Author
Owner

@Fred-Barclay commented on GitHub (Jun 2, 2017):

I might have a fix in. On a Fedora 25 Gnome VM, keepassx would crash in firejail if private-bin did not contain both keepassx and keepassx2, or if it couldn't read /etc/machine-id (which we've been blocking with private-etc fonts). I've added keepassx2 to private-bin, and added /etc/machine-id to the sandbox... but it's spoofed with the machine-id option so keepassx still can't see your real machine id. 😁

@8cc Can you try the new profile? It's at https://raw.githubusercontent.com/netblue30/firejail/3a2428bd4ba70e4b4c71b8e7ae7aeee8e027428e/etc/keepassx.profile

<!-- gh-comment-id:305917910 --> @Fred-Barclay commented on GitHub (Jun 2, 2017): I might have a fix in. On a Fedora 25 Gnome VM, keepassx would crash in firejail if `private-bin` did not contain both keepassx and keepassx2, or if it couldn't read /etc/machine-id (which we've been blocking with `private-etc fonts`). I've added keepassx2 to private-bin, and added /etc/machine-id to the sandbox... but it's spoofed with the `machine-id` option so keepassx still can't see your real machine id. 😁 @8cc Can you try the new profile? It's at https://raw.githubusercontent.com/netblue30/firejail/3a2428bd4ba70e4b4c71b8e7ae7aeee8e027428e/etc/keepassx.profile
Author
Owner

@8cc commented on GitHub (Jun 3, 2017):

@8cc Can you try the new profile? It's at https://raw.githubusercontent.com/netblue30/firejail/3a2428bd4ba70e4b4c71b8e7ae7aeee8e027428e/etc/keepassx.profile

Profile did not help, firejail 0.9.46.

<!-- gh-comment-id:305964121 --> @8cc commented on GitHub (Jun 3, 2017): > @8cc Can you try the new profile? It's at https://raw.githubusercontent.com/netblue30/firejail/3a2428bd4ba70e4b4c71b8e7ae7aeee8e027428e/etc/keepassx.profile Profile did not help, firejail 0.9.46.
Author
Owner

@Anyon3 commented on GitHub (Jun 3, 2017):

I tried the keepassx profile proposed by Fred-Barclay on my Gentoo Hardened and got this

keepassx: error while loading shared libraries: libQtCore.so.4: cannot open shared object file: No such file or directory

I added a comment to

private-etc fonts,machine-id

And this fixed the error. Another small thing I spotted is the use of nonewprivs, I may be wrong but according to the man firejail

This option is enabled by default if seccomp filter is activated

As seccomp is passed in the profile, nonewprivs can be removed ?

Firejail 0.9.47
KeepassX 2.0.2-r1

<!-- gh-comment-id:305977056 --> @Anyon3 commented on GitHub (Jun 3, 2017): I tried the keepassx profile proposed by Fred-Barclay on my Gentoo Hardened and got this keepassx: error while loading shared libraries: libQtCore.so.4: cannot open shared object file: No such file or directory I added a comment to private-etc fonts,machine-id And this fixed the error. Another small thing I spotted is the use of nonewprivs, I may be wrong but according to the man firejail This option is enabled by default if seccomp filter is activated As seccomp is passed in the profile, nonewprivs can be removed ? Firejail 0.9.47 KeepassX 2.0.2-r1
Author
Owner

@netblue30 commented on GitHub (Jun 4, 2017):

As seccomp is passed in the profile, nonewprivs can be removed ?

Yes, you can remove it. However, if you remove seccomp, it is a very good idea to bring back nonewprivs.

<!-- gh-comment-id:306064462 --> @netblue30 commented on GitHub (Jun 4, 2017): > As seccomp is passed in the profile, nonewprivs can be removed ? Yes, you can remove it. However, if you remove seccomp, it is a very good idea to bring back nonewprivs.
Author
Owner

@Anyon3 commented on GitHub (Jun 5, 2017):

Ok thanks for this infos. Most of the profile have nonewprivs and seccomp, this is in case seccomp is not active on the system Linux right ?

<!-- gh-comment-id:306234037 --> @Anyon3 commented on GitHub (Jun 5, 2017): Ok thanks for this infos. Most of the profile have nonewprivs and seccomp, this is in case seccomp is not active on the system Linux right ?
Author
Owner

@netblue30 commented on GitHub (Jun 10, 2017):

this is in case seccomp is not active on the system Linux right ?

Seccomp and nonewprivs are not enabled by default on any Linux system. Seccomp configuration is very specific to the particular program running.

<!-- gh-comment-id:307558783 --> @netblue30 commented on GitHub (Jun 10, 2017): > this is in case seccomp is not active on the system Linux right ? Seccomp and nonewprivs are not enabled by default on any Linux system. Seccomp configuration is very specific to the particular program running.
Author
Owner

@Tanath commented on GitHub (Jan 22, 2018):

I was getting this issue until I commented out memory-deny-write-execute.

<!-- gh-comment-id:359477849 --> @Tanath commented on GitHub (Jan 22, 2018): I was getting this issue until I commented out `memory-deny-write-execute`.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#903
No description provided.