Could not create AF_NETLINK socket error with LXImage-Qt

[glu8716]

Description

LXImage-Qt doesn't start if Firejail is on with a "Could not create AF_NETLINK socket" error.

Steps to Reproduce

1. Run firejail lximage-qt.

Expected behavior

2. Program should start.

Actual behavior

3. Program doesn't start.

Behavior without a profile

If I start the program without Firejail it works.

Additional context

I haven't touched anything in the Firejail configs, it's the standard installation.

Environment

• Linux distribution and version: Artix
• Firejail version 0.9.72

Checklist

• The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
• I can reproduce the issue without custom modifications (e.g. globals.local).
• The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• The profile (and redirect profile if exists) hasn't already been fixed upstream.
• I have performed a short search for similar issues (to avoid opening a duplicate).
  • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
• I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Reading profile /etc/firejail/lximage-qt.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 23205, child pid 23206
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/1000/gvfs
Child process initialized in 79.94 ms
Could not create AF_NETLINK socket (Operation not supported)
propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"
Could not create AF_NETLINK socket (Operation not supported)
Could not create AF_NETLINK socket (Operation not supported)
Could not create AF_NETLINK socket (Operation not supported)
Could not create AF_NETLINK socket (Operation not supported)

Parent is shutting down, bye...

[glitsj16]

firejail/etc/profile-a-l/lximage-qt.profile

Line 31 in f3fc984

protocol unix

Please test with the following:

$ cat ~/.config/firejail/lximage-qt.local
protocol unix,netlink

[glu8716]

The error about AF_NETLINK is gone, but the program still doesn't run.

Reading profile /etc/firejail/lximage-qt.profile
Reading profile /home/lorenzo/.config/firejail/lximage-qt.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 23848, child pid 23849
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: not remounting /run/user/1000/gvfs
Child process initialized in 87.46 ms
propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"

Parent is shutting down, bye...

[glitsj16]

The error about AF_NETLINK is gone, but the program still doesn't run.

So we don't need netlink in the protocol, which is a good thing for a sandbox.

While you were testing I installed lximage-xt on my Arch Linux box. Here it starts and seems to work as expected. I also get those AF_NETLINK warnings but not the D-Bus related last lines from your output:

propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"

The lximage-qt profile doesn't restrict dbus (not even the system bus) so I'm not sure what's that about. What happens when you run firejail --noprofile /usr/bin/lximage-qt?

[glu8716]

If I run firejail --noprofile /usr/bin/lximage-qt the program starts fine. Those two error messages are still present, but the program works.

Parent pid 1981, child pid 1982
Child process initialized in 5.37 ms
propsReply "Method \"GetAll\" with signature \"s\" on interface \"org.freedesktop.DBus.Properties\" doesn't exist\n"
nmReply "Method \"GetDevices\" with signature \"\" on interface \"org.freedesktop.NetworkManager\" doesn't exist\n"
"Object path cannot be empty"

[glitsj16]

Odd. But I'm not familiar with Artix, especially not regarding its D-Bus functionality. Perhaps @kmk3 can assist, IIRC they're on Artix too. Is DBUS_SESSION_BUS_ADDRESS exported correctly? Is the user socket actually created on your system? Apologies for not being more helpfull, but for now I just cannot reproduce.

[glu8716]

Don't worry, thanks for the help!

The env output shows the following:
DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-JiaSDiRKLG,guid=5d2afdf9a5c32fa92f9c8cb8651ae04e
The file is actually there. Don't know if this is normal as I'm not an expert user.

[glitsj16]

DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-JiaSDiRKLG,guid=5d2afdf9a5c32fa92f9c8cb8651ae04e

That might explain things. There's a private-tmp in lximage-xt.profile. Usually the DBUS_SESSION_BUS_ADDRESS points to /run/user/1000/bus. Well, usually might be to strong, but it is what Firejail assumes AFAICT, in ${RUNUSER}. So try ignore private-tmp to confirm that does fix it. If so I'd suggest trying to change whatever Artix uses to set DBUS_SESSION_BUS_ADDRESS to a path under /tmp. There's probably more profiles that could break similarly.

[glu8716]

You are right, adding ignore private-tmp works! Thanks a lot =)
As for the dbus path I honestly have no idea as I've never dealt with it. It might not be Artix but the init system (I use s6) or SDDM (I know SDDM uses the /tmp folder for the XAUTHORITY file too for example).
Anyway I've only had this problem with the lximage-qt profile so far, so if I only have to add an exception for it it's not a big deal I guess.

[kmk3]

As for the dbus path I honestly have no idea as I've never dealt with it. It
might not be Artix but the init system (I use s6) or SDDM (I know SDDM uses
the /tmp folder for the XAUTHORITY file too for example).

The socket also appears on /tmp for me with dwm on Artix.

My guess: dbus is started before whatever it is that sets up
$XDG_RUNTIME_DIR, so it falls back to /tmp.

I think that (e)logind is supposed to do this.

The dbus package appears to depend on (e)logind while the elogind service
depends on (/starts before) dbus, which could explain the issue.

Though I'm not sure and I don't really use dbus.

If anyone finds out more details about this, feel free to post here.

[glitsj16]

Anyway I've only had this problem with the lximage-qt profile so far, so if I only have to add an exception for it it's not a big deal I guess.

That's nice. At least you're aware of this now. Thanks a lot for bringing all this to our attention!