QOwnNotes: cannot access whitelisted external media directory (disable-mnt)

[mYnDstrEAm]

Description

Maybe it's just a trivial thing: I have this in /home/username/.config/firejail/QOwnNotes.local:

noblacklist /media/veracryptId/dir/
whitelist /media/veracryptId/dir/
net none

Edit: it was as trivial as adding ignore disable-mnt, see the comment below.

When I launch it this is the output (please comment if you spot something that shouldn't be there):

Parent pid x, child pid x
2 programs installed in x ms
Warning: skipping crypto-policies for private /etc
Private /etc installed in x ms
Warning: skipping alternatives for private /usr/etc
Warning: skipping ca-certificates for private /usr/etc
Warning: skipping crypto-policies for private /usr/etc
Warning: skipping fonts for private /usr/etc
Warning: skipping host.conf for private /usr/etc
Warning: skipping hosts for private /usr/etc
Warning: skipping ld.so.cache for private /usr/etc
Warning: skipping ld.so.preload for private /usr/etc
Warning: skipping machine-id for private /usr/etc
Warning: skipping nsswitch.conf for private /usr/etc
Warning: skipping pki for private /usr/etc
Warning: skipping pulse for private /usr/etc
Warning: skipping resolv.conf for private /usr/etc
Warning: skipping ssl for private /usr/etc
Private /usr/etc installed in x ms
Error: can't chdir to Nextcloud
Blacklist violations are logged to syslog
Child process initialized in x ms
Warning: doLinuxDarkModeCheck  - 'doLinuxDarkModeCheck' returned false (:0, )
libEGL warning: wayland-egl: could not open /dev/dri/card0 (No such file or directory)
Warning: onResult  - 'network reply error':  QNetworkReply::HostNotFoundError ((null):0, (null))
Critical: "kf5-applications.menu"  not found in  () ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
libEGL warning: wayland-egl: could not open /dev/dri/card0 (No such file or directory)
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Warning: QPainter::begin: Paint device returned engine == 0, type: 2 ((null):0, (null))
Failed to create secure directory (/run/user/1000/pulse): Permission denied
Failed to create secure directory (/run/user/1000/pulse): Permission denied
[id] vlcpulse audio output error: PulseAudio server connection failure: Connection refused
Failed to create secure directory (/run/user/1000/pulse): Permission denied
[id2] vlcpulse audio output error: PulseAudio server connection failure: Connection refused
[id2] main audio output error: no suitable audio output module
Failed to create secure directory (/run/user/1000/pulse): Permission denied
[id3] vlcpulse audio output error: PulseAudio server connection failure: Connection refused
[id3] main audio output error: no suitable audio output module
[id4] main decoder error: failed to create audio output

The net none is in the profile mainly because of this: pbek/QOwnNotes#2602 (it would be great if firejail could prompt the user about whether or not to allow an application Internet access whenever it is first run, but that's a separate issue).

The last few errors about PulseAudio are repeated many times.

I think it has to do with veracrypt: Wayland support in Debian11/KDE is not good so it often crashes and whenever the session is restored VeraCrypt is missing from the traybar and also can't be launched as it just shows a messagebox "VeraCrypt is already running". If anybody knows a solution to this problem: the two questions about this are here: https://unix.stackexchange.com/questions/676989/how-to-circumvent-veracrypt-is-already-running and https://unix.stackexchange.com/q/603777/233262 It may have to do with the PulseAudio messages. I'll check whether QOwnNotes can access the directories when I reboot.

Steps to Reproduce

Steps to reproduce the behavior

1. Run in bash LC_ALL=C firejail QOwnNotes with the above QOwnNotes.local
2. Click on Note->Import->Import notes from text files
3. Try to access the whitelisted veracrypt dir

Expected behavior

It can access the veracrypt directory

Actual behavior

It can't access the whitelisted veracrypt directory

Behavior without a profile

Additional context

Environment

• Linux distribution and version: Debian11/KDE
• Firejail version: 0.9.70

Checklist

• The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
• I can reproduce the issue without custom modifications (e.g. globals.local).
• The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• The profile (and redirect profile if exists) hasn't already been fixed upstream.
• I have performed a short search for similar issues (to avoid opening a duplicate).
  • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
• I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

[mYnDstrEAm]

Tried after rebooting but had the same problem: it was solved by adding ignore disable-mnt to the .local profile.

Shouldn't disable-mnt be added to the QOwnNotes profile? And is there already info about how to undo / override settings via ignore in .local profiles in the docs (man page)?

Moreover, when trying to open a note in the file explorer with "Show note in file manager" it doesn't open Dolphin and has this in the console: Warning: Unable to detect a launcher for 'file:https:///home/username/dir/Notebooks' ((null):0, (null))