Firejail beta-testers wanted!

Flemur · Post by **Flemur** » Fri May 11, 2018 2:07 pm

It completely hosed up all or nearly all the files in my home directory. Fortunately I have a backup.

I have a non-standard installation of firefox that the "regular" firejail didn't like, though I didn't spend any time trying to get it to work.

Code: Select all

$ cat `which firefox`
apulse /mnt/DATA/Firefox/firefox/firefox -P profile.default -new-instance  "$@"

Code: Select all

$ firejail firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/firefox-common.profile
...
*** Error: Downloads directory was not found in user home.
*** 	Any files saved by the program, will be lost when the sandbox is closed.
...
Error: no suitable firefox executable found
Parent is shutting down, bye...

I changed the /etc/firejail file as below.
firefox-common.profile:whitelist /mnt/DATA/download/

Then

Code: Select all

$ firejail firefox
Warning: an existing sandbox was detected. firefox will run without any additional sandboxing features
Error: Access was denied while trying to open files in your profile directory.

Looking for the conveniently unidentified "existing sandbox" resulted in:

Code: Select all

$ find . -iname "jail*" 
find: './.audacity-data': Permission denied
find: './.config/uGet': Permission denied
... pretty much all of 'em ...
find: './.cache/mozilla': Permission denied
...
find: './.gimp-2.8': Permission denied
find: './.pki': Permission denied
$

Flemur · Post by **Flemur** » Fri May 11, 2018 2:11 pm

Now I also get

Code: Select all

$ sudo -i
bash: /usr/bin/sudo: Permission denied

I'm getting the impression that "firejail" is a substitute for other malware that screws up your computer.

Edit: everything is OK after a reboot.

Fred Barclay · Post by **Fred Barclay** » Fri May 11, 2018 11:40 pm

@Flemur: you must have run sudo firecfg sometime in the past, which creates links in /usr/bin/local that cause all supported programs to run inside firejail. Hence when starting something with firejail, you're really doing the equivalent of firejail firejail <program-name>. Hence the messages about the pre-existing sandbox.
To update the links to include new programs, run sudo firecfg.

To remove these links so nothing will run in firejail by default, sudo firecfg clean.

I'm not sure about

It completely hosed up all or nearly all the files in my home directory. Fortunately I have a backup.

Honestly that's not something firejail is capable of to the very best of my knowledge. Perhaps an unfortunate coincidence or a misunderstanding?

What direct link do you mean? What browser did you use?

Thanks!
Fred

Amii_Leigh · Post by **Amii_Leigh** » Sat May 12, 2018 5:11 am

Fred Barclay wrote: ⤴Fri May 11, 2018 11:42 am Amii_Leigh, how do you normally start tor with firejail?

I usually just do:

Code: Select all

firejail /usr/bin/tor-browser-en.sh

But this version of firejail won't even show me the terminal. Since I have the system sound for closing windows, it goes 'pop!' and I don't see anything.

Amii_Leigh · Post by **Amii_Leigh** » Sat May 12, 2018 6:15 am

This is what happens when I try to run the same command line that martywd used to launch his, though my Tor folder is in my Home folder as .tor-browser-en sans '-US':

Code: Select all

$ firejail ~/.local/opt/tor-browser_en-US/Browser/start-tor-browser
Reading profile /etc/firejail/start-tor-browser.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 14049, child pid 14050
Warning: skipping crypto-policies for private /etc
Warning: skipping alsa for private /etc
Warning: skipping asound.conf for private /etc
Warning: skipping machine-id for private /etc
Private /etc installed in 284.93 ms
17 programs installed in 287.74 ms
Blacklist violations are logged to syslog
Child process initialized in 652.20 ms
Error: no suitable /home/amii/.local/opt/tor-browser_en-US/Browser/start-tor-browser executable found

Parent is shutting down, bye...

Even with the command line what I thought was corrected for my installation, it still wouldn't run.

and

Code: Select all

firejail sh -c '"/home/amii/.local/opt/tor-browser_en-US/Browser/start-tor-browser" --detach || ([ !  -x "/home/amii/.local/opt/tor-browser_en-US/Browser/start-tor-browser" ] && "$(dirname "$*")"/Browser/start-tor-browser --detach)' dummy %k

Code: Select all

$ firejail sh -c '"/home/amii/.local/opt/tor-browser_en-US/Browser/start-tor-browser" --detach || ([ !  -x "/home/amii/.local/opt/tor-browser_en-US/Browser/start-tor-browser" ] && "$(dirname "$*")"/Browser/start-tor-browser --detach)' dummy %k
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 15483, child pid 15484
Warning: cleaning all supplementary groups
Child process initialized in 46.38 ms
dummy: 1: dummy: /home/amii/.local/opt/tor-browser_en-US/Browser/start-tor-browser: not found
dummy: 1: dummy: ./Browser/start-tor-browser: not found

Parent is shutting down, bye...

This works for me, though I can't see Tor in the 'tree' listing:

Code: Select all

 Exec=firejail sh -c '"/home/amii/.tor-browser-en/INSTALL/Browser/start-tor-browser" --detach || ([ !  -x "/home/amii/.tor-browser-en/INSTALL/Browser/start-tor-browser" ] && "$(dirname "$*")"/Browser/start-tor-browser --detach)' dummy %k

Flemur · Post by **Flemur** » Sat May 12, 2018 9:39 am

Fred Barclay wrote: ⤴Fri May 11, 2018 11:40 pm@Flemur: you must have run sudo firecfg sometime in the past, which creates links in /usr/bin/local that cause all supported programs to run inside firejail.

The first run of "firejail firefox" complained about other stuff.
Then I changed a config file to match my setup (no ~/Download directory); the next run of firejail gave "pre-existing sandbox" errors.

I'm not sure about
It completely hosed up all or nearly all the files in my home directory. Fortunately I have a backup.
Honestly that's not something firejail is capable of to the very best of my knowledge. Perhaps an unfortunate coincidence or a misunderstanding?

As I said, the "permission denied" errors and broken "sudo" went away after a reboot, so firejail apparently did something to my account and to sudo, but fortunately it was temporary.

What direct link do you mean?

On the download site your gave, the direct link to download when the automagical download doesn't work, which it didn't (probably because of something blocked by umatrix). IMO a direct link is always better than "if your download doesn't start..."

What browser did you use?

firefox.

martywd · Post by **martywd** » Sat May 12, 2018 10:25 am

Amii_Leigh wrote: ⤴Sat May 12, 2018 6:15 am This is what happens when I try to run the same command line that martywd used to launch his, though my Tor folder is in my Home folder as .tor-browser-en sans '-US':

Sorry. Those commands I published are for the location where MY tor is installed, and should not represent where others have their tor browser installed and a are bit misleading I see now.

I.e., I downloaded the .tar from tor's website. I then created the '~/.config~/.local/opt' directory, un-tar'd the 'tor-browser-linux64-7.x.x_en-US.tar.xz file which created the 'tor-browser_en-US' directory, then moved the just mentioned 'tor-browser_en-US' directory in to: ''~/.config~/.local/opt/' directory, and finally ran the 'start-tor-browser.desktop' for the first time located in my custom created '~/.local/opt/tor-browser_en-US/' directory.

Bottom line. Other user's 'firejail /path/to/tor' statements, as well as any '*.desktop' files tor created from the initial start of tor, will almost certainly be different then the one's that I indicated and that work for me!

Again, apologies for the confusion.

(Later edit to correct incorrect path statements).

.

absque fenestris · Post by **absque fenestris** » Sat May 12, 2018 1:55 pm

firejail_0.9.54~rc1_1_i386.deb

I did it the lazy way: simply installed the new firejail over the old one.

Firefox 60.0 runs best
Vivaldi 1.15.1147.36 runs perfectly
Thunderbird is running fine

Anyone said something against Intel Atom® and 32-bit..?

Fred Barclay · Post by **Fred Barclay** » Sat May 12, 2018 2:16 pm

Thanks absque fenestris!

Amii_Leigh, do you still have tor in /usr/bin/tor-browser-en as mentioned in https://github.com/netblue30/firejail/issues/1930 ?
If not, can you post the path to tor on your system?

absque fenestris · Post by **absque fenestris** » Sat May 12, 2018 2:35 pm

Hi Fred

Thanks to you and the other developers, too.

Why is it actually Beta? I see nothing that could be better...

Amii_Leigh · Post by **Amii_Leigh** » Sun May 13, 2018 1:04 am

Fred Barclay wrote: ⤴Sat May 12, 2018 2:16 pm Amii_Leigh, do you still have tor in /usr/bin/tor-browser-en as mentioned in https://github.com/netblue30/firejail/issues/1930 ?
If not, can you post the path to tor on your system?

This is the command line which contains the path to my installation of Tor Browser:

Code: Select all

sh -c '/home/amii/.tor-browser-en/INSTALL/Browser/start-tor-browser" --detach || ([ !  -x "/home/amii/.tor-browser-en/INSTALL/Browser/start-tor-browser" ] && "$(dirname "$*")"/Browser/start-tor-browser --detach)' dummy %k

Also, using the "--ignore=tracelog" command, Palemoon now runs for me. It complains that DBUS isn't running, but besides that it's just splendiferous.

Fred Barclay · Post by **Fred Barclay** » Sun May 13, 2018 1:05 am

Amii_Leigh wrote: ⤴Sun May 13, 2018 1:04 am Also, using the "--ignore=tracelog" command, Palemoon now runs for me. It complains that DBUS isn't running, but besides that it's just splendiferous.

That's great news! We want it to complain that dbus is inaccessible. Hoorray!

I'll try and get a firejail tor test for you to run within the next 8 hours or so, Amii, if you're willing.

Pjotr · Post by **Pjotr** » Sun May 13, 2018 6:39 am

Just tested Firejail 0.9.54~rc2_1 on my Bionic box (Xubuntu). Works fine with Firefox 60 now....

64-bit installer:
https://sourceforge.net/projects/fireja ... b/download

32-bit installer:
https://sourceforge.net/projects/fireja ... b/download

Note: having a previous version of Firejail installed, might cause installation failure. So first remove your current, older Firejail:

Code: Select all

sudo apt-get purge firejail

Amii_Leigh · Post by **Amii_Leigh** » Sun May 13, 2018 6:45 pm

Fred Barclay wrote: ⤴Sun May 13, 2018 1:05 am

I'll try and get a firejail tor test for you to run within the next 8 hours or so, Amii, if you're willing.

Sure! It's not like I have a life or anything, lol

martywd · Post by **martywd** » Sun May 13, 2018 7:52 pm

Just notice that ...rc2 is available:

64-bit ==> https://sourceforge.net/projects/fireja ... b/download

32-bit ==> https://sourceforge.net/projects/fireja ... b/download

For me with this latest rc2 (64-bit)... palemoon, tor, firefox-esr, and vivaldi-stable continue to launch with the 'firejail ...' prefix command. No issues thus far...

.

bertradio · Post by **bertradio** » Sun May 13, 2018 8:03 pm

Works for me too with FF 60.

slipstick · Post by **slipstick** » Mon May 14, 2018 4:46 am

I have installed firejail 0.9.54~rc2 and FF version 60 works fine, but now I can't open a text file from Nemo - I click on the file and just get a spinning circle for about 10-15 seconds which then disappears. This is for files that I own in my home directory and also for system files which I used to be able to open in read-only mode. However I can open the files from Nemo if I open the containing directory "as Root" - I have to do this even for files I own in my home directory. But I can "cat" the files from a terminal with no problem.

Code: Select all

steve@steve-Z97X ~ $ inxi -Fxz
System:    Host: steve-Z97X Kernel: 4.4.0-124-generic x86_64 (64 bit gcc: 5.4.0)
           Desktop: Cinnamon 3.6.7 (Gtk 3.18.9-1ubuntu3.3) Distro: Linux Mint 18.3 Sylvia
Machine:   Mobo: Gigabyte model: Z97X-Gaming 3 v: x.x Bios: American Megatrends v: F6h date: 01/29/2015
CPU:       Quad core Intel Core i5-4690 (-MCP-) cache: 6144 KB
           flags: (lm nx sse sse2 sse3 sse4_1 sse4_2 ssse3 vmx) bmips: 28002
           clock speeds: max: 3900 MHz 1: 3875 MHz 2: 3891 MHz 3: 3889 MHz 4: 3881 MHz
Graphics:  Card-1: Intel Xeon E3-1200 v3/4th Gen Core Processor Integrated Graphics Controller bus-ID: 00:02.0
           Card-2: NVIDIA GM107 [GeForce GTX 750 Ti] bus-ID: 01:00.0
           Display Server: X.Org 1.18.4 drivers: nvidia (unloaded: fbdev,vesa,nouveau)
           Resolution: 1920x1200@59.95hz
           GLX Renderer: GeForce GTX 750 Ti/PCIe/SSE2 GLX Version: 4.5.0 NVIDIA 384.111 Direct Rendering: Yes
Audio:     Card-1 Intel Xeon E3-1200 v3/4th Gen Core Processor HD Audio Controller
           driver: snd_hda_intel bus-ID: 00:03.0
           Card-2 Intel 9 Series Family HD Audio Controller driver: snd_hda_intel bus-ID: 00:1b.0
           Card-3 NVIDIA Device 0fbc driver: snd_hda_intel bus-ID: 01:00.1          
           Sound: Advanced Linux Sound Architecture v: k4.4.0-124-generic
Network:   Card: Qualcomm Atheros Killer E220x Gigabit Ethernet Controller driver: alx port: d000 bus-ID: 03:00.0
           IF: enp3s0 state: up speed: 1000 Mbps duplex: full mac: <filter>
Drives:    HDD Total Size: 1500.3GB (21.1% used) ID-1: /dev/sda model: ST1000DM003 size: 1000.2GB
           ID-2: USB /dev/sdb model: Elements_1078 size: 500.1GB
Partition: ID-1: / size: 20G used: 8.8G (48%) fs: ext4 dev: /dev/sda11
           ID-2: /home size: 9.8G used: 883M (10%) fs: ext4 dev: /dev/sda12
           ID-3: swap-1 size: 17.18GB used: 0.03GB (0%) fs: swap dev: /dev/sda8
RAID:      No RAID devices: /proc/mdstat, md_mod kernel module present
Sensors:   System Temperatures: cpu: 29.8C mobo: 27.8C gpu: 0.0:34C
           Fan Speeds (in rpm): cpu: N/A
Info:      Processes: 223 Uptime: 2 days Memory: 3071.1/7820.2MB Init: systemd runlevel: 5 Gcc sys: 5.4.0
           Client: Shell (bash 4.3.481) inxi: 2.2.35

Note - I don't think this is related, but I did add a whitelist statement in /etc/firejail/firefox.profile and in /etc/firejail/thunderbird.profile which were necessary because I keep my firefox and thunderbird profiles stored on my separate Data partition under ~/Data/.firefox and ~/Data/.thunderbird.

Code: Select all

steve@steve-Z97X /etc/firejail $ cat firefox.profile
# Firejail profile for firefox
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/firefox.local
# Persistent global definitions
include /etc/firejail/globals.local

noblacklist ${HOME}/.cache/mozilla
noblacklist ${HOME}/.mozilla

mkdir ${HOME}/.cache/mozilla/firefox
mkdir ${HOME}/.mozilla
whitelist ${HOME}/.cache/mozilla/firefox
whitelist ${HOME}/.mozilla
whitelist ${HOME}/Data/.firefox

# firefox requires a shell to launch on Arch.
#private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash
# private-etc must first be enabled in firefox-common.profile
#private-etc firefox

# Redirect
include /etc/firejail/firefox-common.profile

Code: Select all

steve@steve-Z97X /etc/firejail $ cat thunderbird.profile
# Firejail profile for thunderbird
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/thunderbird.local
# Persistent global definitions
include /etc/firejail/globals.local

# Users have thunderbird set to open a browser by clicking a link in an email
# We are not allowed to blacklist browser-specific directories

noblacklist ${HOME}/.cache/thunderbird
noblacklist ${HOME}/.gnupg
# noblacklist ${HOME}/.icedove
noblacklist ${HOME}/.thunderbird

mkdir ${HOME}/.cache/thunderbird
mkdir ${HOME}/.gnupg
# mkdir ${HOME}/.icedove
mkdir ${HOME}/.thunderbird
whitelist ${HOME}/.cache/thunderbird
whitelist ${HOME}/.gnupg
# whitelist ${HOME}/.icedove
whitelist ${HOME}/.thunderbird
whitelist ${HOME}/Data/.thunderbird

# We need the real /tmp for data exchange when xdg-open handles email attachments on KDE
ignore private-tmp
# machine-id breaks audio in browsers; enable it when sound is not required
# machine-id
read-only ${HOME}/.config/mimeapps.list
# writable-run-user is needed for signing and encrypting emails
writable-run-user

# allow browsers
# Redirect
include /etc/firejail/firefox.profile

EDIT: I can't open .pdf files or shell scripts, either. How can I enable opening these files that I own by double-clicking on them in Nemo?

It seems that I'm not the only one with this problem:
viewtopic.php?f=47&t=269263&start=40#p1469428

absque fenestris · Post by **absque fenestris** » Mon May 14, 2018 6:06 am

32-bit/firejail_0.9.54_rc2_1_i386.deb

No problems with Vivaldi & Firefox 60.0

Fred Barclay · Post by **Fred Barclay** » Mon May 14, 2018 8:41 pm

slipstick wrote: ⤴Mon May 14, 2018 4:46 am I have installed firejail 0.9.54~rc2 and FF version 60 works fine, but now I can't open a text file from Nemo ...

Can you do this again, but run firejail --tree for me and post the output?

slipstick · Post by **slipstick** » Mon May 14, 2018 9:00 pm

Fred Barclay wrote: ⤴Mon May 14, 2018 8:41 pm [Can you do this again, but run firejail --tree for me and post the output?

Not sure exactly what you want me to "do again", but here's the result of "firejail --tree" with FF, Tbird, Nemo and a terminal open:

Code: Select all

steve@steve-Z97X ~ $ firejail --tree
6845:steve::/usr/bin/firejail /usr/bin/thunderbird 
  6847:steve::/usr/bin/firejail /usr/bin/thunderbird 
    6856:steve::/usr/lib/thunderbird/thunderbird 
6935:steve::/usr/bin/firejail /usr/bin/firefox 
  6938:steve::/usr/bin/firejail /usr/bin/firefox 
    6947:steve::/usr/lib/firefox/firefox 
      6998:steve::/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -intPrefs 235:1|236:2| -boolPrefs 36:1|231:1|259:1|299:0|309:0| -stringPrefs 285:36;880af10a-8e1e-4b45-8e8f-2fd347accff2| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 9 true tab 
      7064:steve::/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -intPrefs 235:1|236:2| -boolPrefs 36:1|231:1|259:1|299:0|309:0| -stringPrefs 285:36;880af10a-8e1e-4b45-8e8f-2fd347accff2| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 9 true tab 
      7684:steve::/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -intPrefs 235:1|236:2| -boolPrefs 36:1|231:1|259:1|299:0|309:0| -stringPrefs 285:36;880af10a-8e1e-4b45-8e8f-2fd347accff2| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 9 true tab 
      7724:steve::/usr/lib/firefox/firefox -contentproc -childID 6 -isForBrowser -intPrefs 235:1|236:2| -boolPrefs 36:1|231:1|259:1|299:0|309:0| -stringPrefs 285:36;880af10a-8e1e-4b45-8e8f-2fd347accff2| -schedulerPrefs 0001,2 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 9 true tab

Linux Mint Forums

Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!

Re: Firejail beta-testers wanted!