Electron & Chromium #2946

rusty-snake · 2019-09-06T23:28:45Z

There are serveral issues with the chromium sandbox (see below) which is also used in electron. If firejail breaks a electron-based program (or any other program internaly using chromium) and the problem can be fixed by adding seccomp !chroot to PROFILE.local, post here which program is affected. Note: If you are not using firejail lastet git, you must add the following to PROFILE.local to get the same effect:

ignore seccomp
seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice

If this doesn't work, but firejail --ignore=nonewprivs --ignore=noroot --ignore=protocol --ignore=seccomp --ignore=caps.drop --caps.keep=sys_admin,sys_chroot PROGRAM works, say it here. Otherwise open a new issue.

If none of the commands works, open a new issue.

Some issues about the chromium-sandbox:
#2933 - skypeforlinux 8.51.0.86 now requires SYS_ADMIN, SYS_CHROOT capabilities
#2912 - Skypeforlinux 8.51.0.72 crashes on startup since it's not permitted to use the chroot syscall
#2945 - Signal 1.27 Fails to Start
#2866 - new version of Slack Desktop (4.0) not working
#2854 - Standard notes not working
#2901 - [Teamspeak 3] crashes on opening options window if seccomp is enabled
#2821 - /usr/bin/riot-desktop: line 3: 8 Trace/breakpoint trap (core dumped) electron /usr/lib/riot/ "$@"
#2943 - firejail - Ubuntu 19.10 snap chromium incompatibility
#2944 - Firejail breaks Brave browser default sandboxing

Three new issues in 10 hours 😱 .

The text was updated successfully, but these errors were encountered:

daks · 2019-10-09T12:31:30Z

Hi,

I again have a problem with slack after upgrading it to 4.1.1 on Debian 9.
I use firejail version from Debian, and created a slack.local with the private-etc tip from #2866

I tried to add to it the parameters indicated above, without change.

update not sure about the following, it may be because i use fish as a shell

I tried also the command firejail --ignore=nonewprivs --ignore=noroot --ignore=protocol --ignore=seccomp --ignore=caps.drop --caps.keep=sys_admin,sys_chroot slack without success.

StarPicard · 2019-10-13T08:37:22Z

Hi,

Visual Studio Code won't start up at all under Archlinux.

firejail version 0.9.60

Compile time support:
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- file and directory whitelisting support is enabled
	- file transfer support is enabled
	- networking support is enabled
	- overlayfs support is enabled
	- private-home support is enabled
	- seccomp-bpf support is enabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

This is the output at startup:

Reading profile /etc/firejail/code.profile
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-passwdmgr.local
Reading profile /etc/firejail/disable-programs.inc
Parent pid 4538, child pid 4539
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized in 56.81 ms

Tried both commands recommended at the top.

rusty-snake · 2019-10-13T08:48:14Z

@daks @StarPicard Can you guys open own issues for that. This issue is to catch the chromium sandbox on program update (I update the OP).

@StarPicard can you also post your globals.local.

daks · 2019-10-15T10:56:11Z

@rusty-snake done

rusty-snake · 2019-12-23T09:56:51Z

All AppImages with chromium/electron programs are broken because --appimage force caps.drop=all but sys_admin,sys_chroot are needed.

cyrinux · 2020-01-15T21:20:18Z

Hi, wire-desktop (electron6) got the problem.

[1]: #2946 (comment)

rusty-snake · 2020-01-16T13:58:50Z

@cyrinux thx, can you confirm that this(27eb40b) works.

cyrinux · 2020-01-17T21:14:15Z

Hi @rusty-snake it works like this with electron6 bin too in my case (under archlinux)

setpill · 2020-03-13T08:45:03Z

Slack is broken, fixed when adding seccomp !chroot to ~/.config/firejail/slack.local

* discord 0.10 | fix #3247 * revert private-bin move & use disable-exec * fix slack, see #2946 (comment)

tscolari · 2020-04-03T08:23:22Z

I've added the fixes but slack (4.4.0) is still not working. It got rid of the errors but get stuck in the Creating Slack Application.

...
Child process initialized in 50.90 ms
Gtk-Message: 09:20:00.662: Failed to load module "unity-gtk-module"
Gtk-Message: 09:20:00.688: Failed to load module "unity-gtk-module"
Gtk-Message: 09:20:00.714: Failed to load module "unity-gtk-module"
Initializing local storage instance at path: /home/tiagohc/.config/Slack/local-settings.json

(slack:18): dconf-WARNING **: 09:20:00.807: Unable to open /var/lib/snapd/desktop/dconf/profile/user: Permission denied
Creating Slack Application

rusty-snake · 2020-04-03T15:42:49Z

How do you installed slack? snap isn't supported by firejail.

I'd like to tighten this up more esp. for seccomp - caps.keep sys_chroot needed or fails with Cannot chroot into /proc/ directory: Operation not permitted 1. caps.drop all replaced with caps.keep - caps.keep sys_admin needed or fails with Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 2. nonewprivs dropped to avoid failure: The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 3. noroot dropped to avoid failure: [22:0404/121643.400578:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /usr/lib/slack/chrome-sandbox is owned by root and has mode 4755. 4. Removed protocol filter to avoid: The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 5. Unable to get a working seccomp filter See #2946 (comment) seccomp !chroot seems to have worked for earlier versions of slack 6. private-tmp means no tray icon Observed on Debian 10, Slack 4.4.0

tscolari · 2020-04-11T12:29:25Z

How do you installed slack? snap isn't supported by firejail.

I've installed it from the .deb file, not the snap store :(

rusty-snake · 2020-04-11T12:44:37Z

Can you post your current profile.

Fixes #3423.

bbhtt · 2020-08-17T07:40:42Z

I've added the fixes but slack (4.4.0) is still not working. It got rid of the errors but get stuck in the Creating Slack Application.

I don't know what the issue is with slack but this profile seems to work for me on Arch using the AUR slack-desktop package, the sign-in won't work because that is a redirect to firefox, so one time setup without firejail and subsequent sessions can be firejailed https://imgur.com/pWZjW6x

This is more hardened than in master.

https://termbin.com/688p

rusty-snake added the bug Something isn't working label Sep 6, 2019

rusty-snake pinned this issue Sep 7, 2019

StarPicard mentioned this issue Oct 13, 2019

Visual Studio Code not working under Archlinux #2997

Closed

rusty-snake mentioned this issue Nov 20, 2019

Need help for Opera Firejail Profile #3048

Closed

rusty-snake pushed a commit that referenced this issue Jan 16, 2020

fix wire-desktop [1]

27eb40b

[1]: #2946 (comment)

rusty-snake pushed a commit to rusty-snake/firejail that referenced this issue Mar 13, 2020

fix slack, see netblue30#2946 (comment)

57888b0

rusty-snake pushed a commit that referenced this issue Mar 13, 2020

discord 0.10 | fix #3247 (#3259)

284b976

* discord 0.10 | fix #3247 * revert private-bin move & use disable-exec * fix slack, see #2946 (comment)

rusty-snake mentioned this issue Apr 9, 2020

Best practice for AppImage profiles #3330

Closed

glitsj16 mentioned this issue May 19, 2020

seccomp is breaking wire-desktop #3423

Closed

glitsj16 referenced this issue May 20, 2020

fix seccomp in wire-desktop.profile

7612739

Fixes #3423.

rusty-snake mentioned this issue Jun 11, 2020

Atom 1.48.0 breaks with Firejail 0.9.58.2 #3464

Closed

blackpidgeon mentioned this issue Jun 21, 2020

Riot-desktop does not launch #3474

Closed

rusty-snake mentioned this issue Jun 24, 2020

slack-desktop 4.4.3 not starting #3477

Closed

This was referenced Jul 17, 2020

Hardend Signal desktop profile #3519

Merged

Add Mattermost desktop profile #3520

Merged

rusty-snake mentioned this issue Sep 18, 2020

Discord 0.0.12 not starting #3634

Closed

4 tasks

rusty-snake unpinned this issue Oct 20, 2020

rusty-snake closed this as completed Oct 20, 2020

rusty-snake mentioned this issue Dec 9, 2020

ms teams not starting in firejail 0.9.64 Nvidia Card Detected #3795

Closed

mYnDstrEAm mentioned this issue Jan 12, 2021

Getting "Permission denied" when running Electron apps with --no-sandbox #3883

Closed

rusty-snake mentioned this issue Jul 29, 2021

Codium doesn't work anymore #4428

Closed

7 tasks

kmk3 mentioned this issue Oct 5, 2021

Firejail profile for VsCodium doesn't work: vscodium was renamed to codium #3871

Closed

cubercsl mentioned this issue Dec 31, 2022

Suggest using firejail profile instead of wrapper. BeautyyuYanli/linuxqq-firejail#1

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Electron & Chromium #2946

Electron & Chromium #2946

rusty-snake commented Sep 6, 2019 •

edited

Loading

daks commented Oct 9, 2019 •

edited

Loading

StarPicard commented Oct 13, 2019 •

edited

Loading

rusty-snake commented Oct 13, 2019

daks commented Oct 15, 2019

rusty-snake commented Dec 23, 2019

cyrinux commented Jan 15, 2020

rusty-snake commented Jan 16, 2020

cyrinux commented Jan 17, 2020

setpill commented Mar 13, 2020

tscolari commented Apr 3, 2020 •

edited

Loading

rusty-snake commented Apr 3, 2020

tscolari commented Apr 11, 2020

rusty-snake commented Apr 11, 2020

bbhtt commented Aug 17, 2020

Electron & Chromium #2946

Electron & Chromium #2946

Comments

rusty-snake commented Sep 6, 2019 • edited Loading

daks commented Oct 9, 2019 • edited Loading

StarPicard commented Oct 13, 2019 • edited Loading

rusty-snake commented Oct 13, 2019

daks commented Oct 15, 2019

rusty-snake commented Dec 23, 2019

cyrinux commented Jan 15, 2020

rusty-snake commented Jan 16, 2020

cyrinux commented Jan 17, 2020

setpill commented Mar 13, 2020

tscolari commented Apr 3, 2020 • edited Loading

rusty-snake commented Apr 3, 2020

tscolari commented Apr 11, 2020

rusty-snake commented Apr 11, 2020

bbhtt commented Aug 17, 2020

rusty-snake commented Sep 6, 2019 •

edited

Loading

daks commented Oct 9, 2019 •

edited

Loading

StarPicard commented Oct 13, 2019 •

edited

Loading

tscolari commented Apr 3, 2020 •

edited

Loading