Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chromium-privacy-browser crashed and won't launch under firejail #3633

Closed
brianpepino opened this issue Sep 17, 2020 · 8 comments · Fixed by #3688
Closed

chromium-privacy-browser crashed and won't launch under firejail #3633

brianpepino opened this issue Sep 17, 2020 · 8 comments · Fixed by #3688

Comments

@brianpepino
Copy link

I got this error when using firejail to run chromium-privacy-browser:

Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc

** Note: you can use --noprofile to disable default.profile **

Parent pid 144065, child pid 144066
Warning: cleaning all supplementary groups
Child process initialized in 33.87 ms
[3:3:0917/174043.946346:FATAL:zygote_host_impl_linux.cc(203)] Check failed: ReceiveFixedMessage(fds[0], kZygoteHelloMessage, sizeof(kZygoteHelloMessage), &real_pid).
#0 0x55e9a7d15829 base::debug::CollectStackTrace()

Received signal 6
#0 0x55e9a7d15829 base::debug::CollectStackTrace()
r8: 0000000000000000 r9: 00007ffdd7c67790 r10: 0000000000000008 r11: 0000000000000246
r12: 00007ffdd7c68a00 r13: 00007ffdd7c68a10 r14: 00000000000000a6 r15: 00007ffdd7c689f0
di: 0000000000000002 si: 00007ffdd7c67790 bp: 00007ffdd7c679e0 bx: 00007f690ac57240
dx: 0000000000000000 ax: 0000000000000000 cx: 00007f690e1a09e5 sp: 00007ffdd7c67790
ip: 00007f690e1a09e5 efl: 0000000000000246 cgf: 002b000000000033 erf: 0000000000000000
trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.

Parent is shutting down, bye...

I also get the same error when I use firejail to launch Chromium-freeworld.

Any idea on how to solve this?

Thanks
@rusty-snake
Copy link
Collaborator

chromium-privacy-browser has no profile, therefore firejail uses default.profile. You can try to use the chromium.profile (firejail --profile=chromium chromium-privacy-browser). If that still don't work, copy the chromium/chromium-common profile to ~/.config/firejail (maybe you need to create that directory) and change some paths.

@brianpepino
Copy link
Author

chromium-privacy-browser has no profile, therefore firejail uses default.profile. You can try to use the chromium.profile (firejail --profile=chromium chromium-privacy-browser). If that still don't work, copy the chromium/chromium-common profile to ~/.config/firejail (maybe you need to create that directory) and change some paths.

Apologies for the delay in responding to you.

I tried your suggestion and it launched Chromium but with this error:

firejail --profile=chromium chromium-freeworld
Reading profile /etc/firejail/chromium.profile
Reading profile /etc/firejail/chromium-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 171133, child pid 171134
Child process initialized in 71.89 ms
Warning: an existing sandbox was detected. /usr/bin/chromium-freeworld will run without any additional sandboxing features
/usr/bin/chromium-freeworld: line 52: /dev/fd/62: No such file or directory
/usr/bin/chromium-freeworld: line 53: /dev/fd/62: No such file or directory
[4:24:0924/103132.165699:ERROR:address_tracker_linux.cc(214)] Could not bind NETLINK socket: Address already in use (98)
[44:44:0924/103132.187920:ERROR:vaapi_wrapper.cc(436)] vaInitialize failed: unknown libva error

My apologies but I am out of my depth here as to the cause of this. Perhaps it is my distro? I am using Fedora 32.

In addition, when I launched Chromium using its icon it does not respect firejail even though I already linked it.

Any suggestions?

My apologies for all this hassle. Thank you so much for your help.

@rusty-snake
Copy link
Collaborator

it launched Chromium but with this error

Is something broken or are there just error messages? What's your firejail version?

In addition, when I launched Chromium using its icon it does not respect firejail even though I already linked it.

This is likely caused by an absolute path in its .desktop file. Copy it to your home and change the line Exec=/usr/bin/chromium-freeworld to Exec=chromium-freeworld.

Assuming is uses chromium-freeworld.desktop:

cp /usr/share/applications/chromium-freeworld.desktop ~/.local/share/applications
vim ~/.local/share/applications/chromium-freeworld.desktop

I tried your suggestion and it launched Chromium

So no other config files needed. You can create ~/.config/firejail/ chromium-freeworld.profile to skip the --profile option.

chromium-freeworld.profile:

# Firejail profile for chromium-freeworld
# This file is overwritten after every install/update

# Redirect
include chromium.profile

@rusty-snake
Copy link
Collaborator

Does this profile work? If so I can commit it upstream, so the next release can firejail chromium-freeworld with firecfg.

@brianpepino
Copy link
Author

brianpepino commented Oct 2, 2020 •
edited
Loading

Does this profile work? If so I can commit it upstream, so the next release can firejail chromium-freeworld with firecfg.

Thank you for the follow up. I really appreciate it.

The version of firejail I am running is firejail.x86_64 0.9.62.4-1.fc32.

Regarding the error message, the one I posted above is the only error message I got but even with that error message Firjeail managed to run Chromium Freeworld and jail it.

As to the steps you enumerated, I used it and I was able to run chromium-freeworld inside firejail when I type on my terminal "chromium-freeworld" but with this error message:

chromium-freeworld
Reading profile /home/weatherman/.config/firejail/chromium-freeworld.profile
Reading profile /etc/firejail/chromium.profile
Reading profile /etc/firejail/chromium-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 145383, child pid 145384
Child process initialized in 74.52 ms
/usr/bin/chromium-freeworld: line 52: /dev/fd/62: No such file or directory
/usr/bin/chromium-freeworld: line 53: /dev/fd/62: No such file or directory
[4:24:1002/123525.290298:ERROR:address_tracker_linux.cc(214)] Could not bind NETLINK socket: Address already in use (98)
[44:44:1002/123525.324766:ERROR:vaapi_wrapper.cc(436)] vaInitialize failed: unknown libva error

Next, when I click my Chromium Freeworld icon it will launch but not inside firejail. I am using Cinnamon Desktop Environment.

Sorry but anything else I should do at this point? I feel we are at a point that this thing will be solved except I am simply lost as to what else to do. Sorry.

Thank you so much for the quick response and assistance. I really appreciate it.

@rusty-snake
Copy link
Collaborator

but with this error message

If nothing is broken, that's fine. The first three I saw often with chromium-based browsers. The last is about VA-API which is almost useless for Chrome+Linux AFAIK.

Next, when I click my Chromium Freeworld icon it will launch but not inside firejail. I am using Cinnamon Desktop Environment.

Did you tried my suggestion above?

rusty-snake added a commit that referenced this issue Oct 3, 2020
@rusty-snake
chromium-freeworld profile (#3633)
af0f2ed
@brianpepino
Copy link
Author

but with this error message

If nothing is broken, that's fine. The first three I saw often with chromium-based browsers. The last is about VA-API which is almost useless for Chrome+Linux AFAIK.

Next, when I click my Chromium Freeworld icon it will launch but not inside firejail. I am using Cinnamon Desktop Environment.

Did you tried my suggestion above?

Hi! I did this "cp /usr/share/applications/chromium-freeworld.desktop ~/.local/share/applications
vim ~/.local/share/applications/chromium-freeworld.desktop" and even edited my chromium-freeworld.desktop file to include this line "Exec=chromium-freeworld --incognito" but it is still not respecting firejail.

Did I miss anything?

Thanks.

@rusty-snake
Copy link
Collaborator

Sum up: ~/.local/share/applications/chromium-freeworld.desktop does not contain /usr/bin/chromium-freewold (or similar) and which chromium-freeworld shows /usr/local/bin/chromium-freewold (the firecfg symlink).

If this still not respects firejail, I cann't help because IDK how cinnamon's menu works.

rusty-snake added a commit to rusty-snake/firejail that referenced this issue Oct 23, 2020
@rusty-snake
rework chromium
d281e3c 
 + 516d081 has removed fundamental security features.
   (remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
   Though this is only necessary if running under a kernel which
disallow
   unprivileged userns clones. Arch's linux-hardened and debian kernel
are
   patched accordingly. Arch's linux and linux-lts kernels support this
   restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
   Other kernels such as mainline or fedora/redhat always support
unprivileged
   userns clone and have no sysctl parameter to disable it. Debian and
Arch
   users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
   This commit adds a chromium-common-hardened.inc which can be included
in
   chromium-common to enhance security of chromium-based programs.

 + chromium-common.profile: add private-cache

 + chromium-common.profile: add wruc and wusc, but disable it for the
   following
   profiles until tested. tests welcome.

    - [ ] bnox, dnox, enox, inox, snox
    - [ ] brave
    - [ ] flashpeak-slimjet
    - [ ] google-chrome, google-chrome-beta, google-chrome-unstable
    - [ ] iridium
    - [ ] min
    - [ ] opera, opera-beta

 + move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
   /usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
  vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
  missed also some features from vivaldi.profile, solve this by making
it
  redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
  also for vivaldi-snapshot?

 + Move drm-relaktions in vivaldi.profile behind BROWSER_ALLOW_DRM.
   TODO: rethink this again

 + create chromium-browser-privacy.profile (closes netblue30#3633)
@rusty-snake rusty-snake mentioned this issue Oct 23, 2020
Merged
7 tasks
rusty-snake added a commit that referenced this issue Nov 9, 2020
@rusty-snake
rework chromium (#3688)
5943003 
* rework chromium

 + 516d081 has removed fundamental security features.
   (remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
   Though this is only necessary if running under a kernel which
disallow
   unprivileged userns clones. Arch's linux-hardened and debian kernel
are
   patched accordingly. Arch's linux and linux-lts kernels support this
   restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
   Other kernels such as mainline or fedora/redhat always support
unprivileged
   userns clone and have no sysctl parameter to disable it. Debian and
Arch
   users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
   This commit adds a chromium-common-hardened.inc which can be included
in
   chromium-common to enhance security of chromium-based programs.

 + chromium-common.profile: add private-cache

 + chromium-common.profile: add wruc and wusc, but disable it for the
   following
   profiles until tested. tests welcome.

    - [ ] bnox, dnox, enox, inox, snox
    - [ ] brave
    - [ ] flashpeak-slimjet
    - [ ] google-chrome, google-chrome-beta, google-chrome-unstable
    - [ ] iridium
    - [ ] min
    - [ ] opera, opera-beta

 + move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
   /usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
  vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
  missed also some features from vivaldi.profile, solve this by making
it
  redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
  also for vivaldi-snapshot?

 + create chromium-browser-privacy.profile (closes #3633)

* update 1

 + add missing 'ignore whitelist /usr/share/chromium'

 + revert 'Move drm-relaktions in vivaldi.profile behind
   BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such
   as AAC too. In addition vivaldi shows a something is broken pop-up,
   we would have a lot of 'does not work with firejail' issues.

* update 2

* update 3

fixes #3709
@matu3ba matu3ba mentioned this issue Oct 7, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

rework chromium rusty-snake/firejail
2 participants
@rusty-snake @brianpepino