Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Firefox native messaging regression in 0.9.62.4 -> 0.9.64rc1 #3701

Closed
cinnaboot opened this issue Oct 26, 2020 · 2 comments
Closed

Firefox native messaging regression in 0.9.62.4 -> 0.9.64rc1 #3701

cinnaboot opened this issue Oct 26, 2020 · 2 comments
Labels
information_old (Deprecated; use "doc-todo" or "needinfo" instead) Information was/is required

Comments

@cinnaboot
Copy link

cinnaboot commented Oct 26, 2020

When upgrading to firejail 0.9.64rc1, the firefox extension https://github.com/woodruffw/ff2mpv breaks.
It makes use of https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging to talk to other native applications.

In firefox.local, I have
# Python 3
noblacklist ${PATH}/python3*
noblacklist /usr/include/python3*
noblacklist /usr/lib/python3*
noblacklist /usr/lib64/python3*
noblacklist /usr/local/lib/python3*
noblacklist /usr/share/python3*

After upgrading to 1.9.64rc1 (and in 1.9.64), I get the following in strace:
[pid 261] execve("/home/user/.mozilla/ff2mpv.py", ["/home/user/.mozilla/ff2mpv.py", "/home/user/.mozilla/native-mes"..., "[email protected]"], 0x7f9a121b4c00 /* 86 vars */) = -1 EACCES (Permission denied)

firejail --noprofile does work too

Do I need to add some more options for the new DBus filtering maybe?

Forgot to add, this is on Arch Linux

@rusty-snake
Copy link
Collaborator

Add ignore noexec ${HOME} to your firefox.local.

In 0.9.62 was ignore noexec ${HOME} by default set even it shouldn't.

@cinnaboot
Copy link
Author

Thanks, that helped.
I ended up needing to add a bunch of stuff from mpv.profile to make it go also:

ignore noexec ${HOME}

# copy firejail config parts from mpv.profile
noblacklist ${HOME}/.config/mpv
noblacklist ${HOME}/.config/youtube-dl
noblacklist ${HOME}/.netrc

include allow-lua.inc
include allow-python3.inc
mkdir ${HOME}/.config/mpv
mkdir ${HOME}/.config/youtube-dl
mkfile ${HOME}/.netrc
whitelist ${HOME}/.config/mpv
whitelist ${HOME}/.config/youtube-dl
whitelist ${HOME}/.netrc
whitelist /usr/share/lua
whitelist /usr/share/lua*
whitelist /usr/share/vulkan

private-bin env,mpv,python*,waf,youtube-dl

@rusty-snake rusty-snake added the information_old (Deprecated; use "doc-todo" or "needinfo" instead) Information was/is required label Nov 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
information_old (Deprecated; use "doc-todo" or "needinfo" instead) Information was/is required
Projects
None yet
Development

No branches or pull requests

2 participants