[GH-ISSUE #1342] firejail {--tree|--list} not listing anything

gitea-mirror commented

2026-05-05 07:09:24 -06:00

Owner

Originally created by @rieje on GitHub (Jun 21, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1342

I am running my Firefox instances in sandboxes and neither firejail --tree nor firejail --listare listing anything in the output, with or withoutsudo` privileges. I'm using latest version of Arch Linux and Firejail. I recall using these commands without problems in the past.

How can I diagnose this issue to provide more relevant information?

Originally created by @rieje on GitHub (Jun 21, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1342 I am running my Firefox instances in sandboxes and neither `firejail --tree` nor firejail --list` are listing anything in the output, with or without `sudo` privileges. I'm using latest version of Arch Linux and Firejail. I recall using these commands without problems in the past. How can I diagnose this issue to provide more relevant information?

gitea-mirror

2026-05-05 07:09:24 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:09:33 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Jun 22, 2017):

Please start the task manager of your choice and select tree view or use htop. Is Firefox displayed as a child process of Firejail?

@curiosity-seeker commented on GitHub (Jun 22, 2017): Please start the task manager of your choice and select tree view or use htop. Is Firefox displayed as a child process of Firejail?

gitea-mirror commented

2026-05-05 07:09:38 -06:00

Author

Owner

@rieje commented on GitHub (Jun 22, 2017):

@curiosity-seeker Hmm, seems not. I installed htop and filtered for "firefox" and I don't see firejail anywhere. I have a wrapper script for firejail + firefox so to test another application I did firejail zathura htop still doesn't show anything for firejail.

pidof firejail shows nothing.

When I execute firejail zathura, this is what's displayed at the terminal before zathura launches:

Reading profile /etc/firejail/zathura.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Warning: noroot option is not available
Parent pid 4402, child pid 4403
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized in 68.07 ms

** (zathura:6): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-ubJdZhmLtB: Connection refused

What's the next step?

@rieje commented on GitHub (Jun 22, 2017): @curiosity-seeker Hmm, seems not. I installed htop and filtered for "firefox" and I don't see firejail anywhere. I have a wrapper script for firejail + firefox so to test another application I did `firejail zathura` htop still doesn't show anything for firejail. `pidof firejail` shows nothing. When I execute `firejail zathura`, this is what's displayed at the terminal before zathura launches: Reading profile /etc/firejail/zathura.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-passwdmgr.inc Warning: noroot option is not available Parent pid 4402, child pid 4403 Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Child process initialized in 68.07 ms ** (zathura:6): WARNING **: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-ubJdZhmLtB: Connection refused What's the next step?

gitea-mirror commented

2026-05-05 07:09:41 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 22, 2017):

I am running my Firefox instances in sandboxes and neither firejail --tree nor firejail --listare listing anything in the output, with or withoutsudo` privileges.

This is how you test it: open a terminal and run "firejail", then open another terminal and run "firejail --tree" or "firejail --list". The information for --tree and --list is extracted from /proc directory. If /proc is in any way restricted, the information will not be available. Question: when you mount /proc (probably this happens in /etc/fstab), are you using "hidepid" option?

@netblue30 commented on GitHub (Jun 22, 2017): > I am running my Firefox instances in sandboxes and neither firejail --tree nor firejail --listare listing anything in the output, with or withoutsudo` privileges. This is how you test it: open a terminal and run "firejail", then open another terminal and run "firejail --tree" or "firejail --list". The information for --tree and --list is extracted from /proc directory. If /proc is in any way restricted, the information will not be available. Question: when you mount /proc (probably this happens in /etc/fstab), are you using "hidepid" option?

gitea-mirror commented

2026-05-05 07:09:47 -06:00

Author

Owner

@rieje commented on GitHub (Jun 23, 2017):

@netblue30 Ahh, that was it. I removed hidepid=2,gid=proc (which I had for security reasons) from /etc/fstab, rebooted, and now I'm getting expected output. So I guess this is a trade-off then?

@rieje commented on GitHub (Jun 23, 2017): @netblue30 Ahh, that was it. I removed `hidepid=2,gid=proc` (which I had for security reasons) from `/etc/fstab`, rebooted, and now I'm getting expected output. So I guess this is a trade-off then?

gitea-mirror commented

2026-05-05 07:09:50 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 23, 2017):

Maybe it is because "gid=proc" in your mount option? I am on a 4.9 kernel (Debian stretch):

$ sudo mount -o remount,rw,hidepid=2 /proc
[sudo] password for netblue: 
$ ls /proc/
1002  1132  2751       crypto       kallsyms     mounts        sysrq-trigger
1010  1136  3275       devices      kcore        mtrr          sysvipc
1047  1141  3277       diskstats    keys         net           thread-self
1052  1145  3289       dma          key-users    pagetypeinfo  timer_list
1056  1150  997        driver       kmsg         partitions    tty
1067  1159  acpi       execdomains  kpagecgroup  sched_debug   uptime
1076  1176  asound     fb           kpagecount   schedstat     version
1081  1483  buddyinfo  filesystems  kpageflags   self          vmallocinfo
1098  1490  bus        fs           loadavg      slabinfo      vmstat
1102  1502  cgroups    interrupts   locks        softirqs      zoneinfo
1111  1727  cmdline    iomem        meminfo      stat
1118  2349  consoles   ioports      misc         swaps
1129  2351  cpuinfo    irq          modules      sys
$ firejail --list
2989:netblue:/usr/bin/firejail /usr/bin/firefox-esr 
3290:netblue:firejail --list 
$ firejail --tree
2989:netblue:/usr/bin/firejail /usr/bin/firefox-esr 
  2990:netblue:/usr/bin/firejail /usr/bin/firefox-esr 
    3003:netblue:/usr/bin/firefox-esr 
      3058:netblue:/usr/lib/firefox-esr/plugin-container -greomni /usr/lib/firefox-esr/omni.ja -appomni /usr/lib/firefox-esr/browser/omni.ja -appdir /usr/lib/firefox-esr/browser 12 true tab 
3308:netblue:firejail --tree 

$ uname -r
4.9.0-3-amd64

@netblue30 commented on GitHub (Jun 23, 2017): Maybe it is because "gid=proc" in your mount option? I am on a 4.9 kernel (Debian stretch): ````` $ sudo mount -o remount,rw,hidepid=2 /proc [sudo] password for netblue: $ ls /proc/ 1002 1132 2751 crypto kallsyms mounts sysrq-trigger 1010 1136 3275 devices kcore mtrr sysvipc 1047 1141 3277 diskstats keys net thread-self 1052 1145 3289 dma key-users pagetypeinfo timer_list 1056 1150 997 driver kmsg partitions tty 1067 1159 acpi execdomains kpagecgroup sched_debug uptime 1076 1176 asound fb kpagecount schedstat version 1081 1483 buddyinfo filesystems kpageflags self vmallocinfo 1098 1490 bus fs loadavg slabinfo vmstat 1102 1502 cgroups interrupts locks softirqs zoneinfo 1111 1727 cmdline iomem meminfo stat 1118 2349 consoles ioports misc swaps 1129 2351 cpuinfo irq modules sys $ firejail --list 2989:netblue:/usr/bin/firejail /usr/bin/firefox-esr 3290:netblue:firejail --list $ firejail --tree 2989:netblue:/usr/bin/firejail /usr/bin/firefox-esr 2990:netblue:/usr/bin/firejail /usr/bin/firefox-esr 3003:netblue:/usr/bin/firefox-esr 3058:netblue:/usr/lib/firefox-esr/plugin-container -greomni /usr/lib/firefox-esr/omni.ja -appomni /usr/lib/firefox-esr/browser/omni.ja -appdir /usr/lib/firefox-esr/browser 12 true tab 3308:netblue:firejail --tree $ uname -r 4.9.0-3-amd64 `````

gitea-mirror commented

2026-05-05 07:09:53 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 23, 2017):

Definitely something to do with gid=proc (kernel 4.9):

$ sudo mount -o remount,rw,hidepid=2,gid=proc /proc
mount: special device proc does not exist

The correct one, at leaset on 4.9 kernel seems to be:

$ sudo mount -o remount,rw,hidepid=2,gid=1000 /proc
$

1000 is the id of my group:

$ id
uid=1000(netblue) gid=1000(netblue) groups=1000(netblue),27(sudo)

@netblue30 commented on GitHub (Jun 23, 2017): Definitely something to do with gid=proc (kernel 4.9): ````` $ sudo mount -o remount,rw,hidepid=2,gid=proc /proc mount: special device proc does not exist ````` The correct one, at leaset on 4.9 kernel seems to be: ````` $ sudo mount -o remount,rw,hidepid=2,gid=1000 /proc $ ````` 1000 is the id of my group: ````` $ id uid=1000(netblue) gid=1000(netblue) groups=1000(netblue),27(sudo) `````

gitea-mirror commented

2026-05-05 07:09:57 -06:00

Author

Owner

@rieje commented on GitHub (Jul 3, 2017):

Do you use this yourself? I noticed with it I can't log into X and needed t comment it out from /etc/fstab then restart the system. My line is:

proc 			/proc		proc		nosuid,nodev,noexec,hidepid=2,gid=1000  0 0

with 1000 being the id of my group.

@rieje commented on GitHub (Jul 3, 2017): Do you use this yourself? I noticed with it I can't log into X and needed t comment it out from /etc/fstab then restart the system. My line is: proc /proc proc nosuid,nodev,noexec,hidepid=2,gid=1000 0 0 with 1000 being the id of my group.

gitea-mirror referenced this issue

2026-05-05 10:08:06 -06:00

[PR #924] [MERGED] Many new profiles #3797

gitea-mirror referenced this issue

2026-05-05 10:49:28 -06:00

[PR #6477] [MERGED] profiles: firecfg: disable text editors #6033

Rows
Columns

[GH-ISSUE #1342] firejail {--tree|--list} not listing anything #924