firejail --appimage freetube errors #5901
-
|
I am posting this in discussion because I suspect I'm just doing something wrong and that it's not actually a problem with firejail. I mean it's a problem with firejail but because I'm using it wrong, I think at least. Installed Manjaro XFCE minimal. It's the latest version. Then downloaded the portable Freetube version 1.18. Then ran firecfg again but made no difference, makes sense because it's portable but did it anyway just in case. I downloaded the appimage version of freetube instead. I went to proporties and enabled it to be run as an executable. I opened the directory in a terminal. Then ran it and it works. Then I ran it with firejail --appimage but then I get errors: Reading profile /etc/firejail/et.profile ** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl ** Mounting appimage type 2 Parent is shutting down, bye... So it's strange it doesn't read the freetube profile in there. When I tried using the portable version it would at least read the freetube profile. So I'm guessing that at least a part of the problem is that freetube profile isn't being read. But I suspect there are more problems. I want help with getting the appimage version working. Don't care about the portable version any more. I also would like to have a desktop entry for the appimage. But first I want to get it working without a desktop entry file. But when it's time I have prepared this: [Desktop Entry] I don't think the %U thing is needed actually but I guess it doesn't harm. Not exactly sure what it does but just leaving it as it is for now. Also in the errors/warnings there's something about apparmor as well. I never have enabled it. I'm doing all this on a VM. So this is just for testing/learning. After I have figured it out I will do it on my host computer. There is another app that doesn't have any security profile so that's another reason for doing it in a testing VM so I can create the profile there and later copy it to the host before installing the program there as well. But point is that I am hoping I don't need to enable apparmor. It's a bit complicated process I think with editing some of the files and restarting like 2 times or something as well. I will do it on the host though. I actually tried to enable apparmor like it suggests in the error/warning messages by typing: sudo aa-enforce firejail-default So I guess I would have to do it the longer complicated way but I hope it's not necessary for the VM where I just want to get firejail working. As I understand, you are supposed to be able to use only firejail without apparmor. That apparmor is optional. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
AppArmor is optional, correct. If firejail is compiled with AppArmor support but it is not working it warns you because it could be a configuration issue that you want to fix. If you do not want/use AA there's nothing you have to do. Regarding the profile, if you use AppImages you have to specify the profile via |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, that worked. Still learning about Firejail. I'm getting better though. Finally starting to understand symbolic links and which directories precede others etc. I'm probably exactly the kind of user you are building firejail for. Not a sysadmin but still somewhat tech savvy, basically just a user. I also changed the Exec line in the desktop entry so now that works as well:
Still get a lot of warnings and errors even though freetube is running. Like /sbin and /usr/sbin not being blacklisted sounds bad. Are all these warnings and errors because I am not using AppArmor? The way I understood is that firejail when working together with apparmor is kind of duplicating some of the apparmor things, so if apparmor has a rule preventing X, but apparmor would fail for some reason, then firejail is also doing the same thing and preventing X. Or have I misunderstood how it works? Maybe firejail skips doing some things because it expects apparmor to do them? This is the output I get now with Freetube running: Reading profile /etc/firejail/freetube.profile ** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl ** Mounting appimage type 2 (freetube:20): IBUS-WARNING **: 15:03:18.368: Unable to load /var/lib/dbus/machine-id: Failed to open file “/var/lib/dbus/machine-id”: No such file or directory |
Beta Was this translation helpful? Give feedback.
-
No. Only the three lines talk about AA are because of AA.
Yes and Yes and No. There are two things.
Info from firejail because you use
Warning from firejail about a sandbox hole. 99.9% of use see this.
Info from firejail. Can be ignored.
Not sure why. But you can blacklist them in freetube.local if you want.
Warning/Info from firejail. AA.
From freetube. Some are because of firejail, some not. As long as everything works they can be ignored. |
Beta Was this translation helpful? Give feedback.
AppArmor is optional, correct. If firejail is compiled with AppArmor support but it is not working it warns you because it could be a configuration issue that you want to fix. If you do not want/use AA there's nothing you have to do.
Regarding the profile, if you use AppImages you have to specify the profile via
--profile=freetube. We have a heuristic. But heuristics can fail.