Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

multimc: fix instances not running because of missing permissions #6216

Merged
merged 1 commit into from
Feb 29, 2024

Conversation

powerjungle
Copy link
Contributor

When starting an instance, in the logs, a failed attempt to load the lwjgl library is shown and the game doesn't run.
The library is in the /tmp directory. The reason for this appears to be, in the lwjgl source code, the shared library loading function, extracts in the temporary directory and continues from there. This is fixed by whitelisting.

The reason for adding "ignore noexec /tmp" as well, is that without it, the game can't run, even if the directory is whitelisted. It seems the library needs to be loaded from /tmp.

A second error for a failed attempt to access /home/user/.cache/JNA is also shown in the logs. This is also fixed by whitelisting.

The errors which inspired the commit:

Caused by: java.lang.ExceptionInInitializerError: Exception java.lang.UnsatisfiedLinkError: /home/user/.cache/JNA/temp/jna205883382989158645.tmp: /home/user/.cache/JNA/temp/jna205883382989158645.tmp: failed to map segment from shared object [in thread "main"]
Caused by: java.lang.ExceptionInInitializerError: Exception java.lang.UnsatisfiedLinkError: /tmp/lwjgl_user/3.3.2+13/x64/liblwjgl.so: /tmp/lwjgl_user/3.3.2+13/x64/liblwjgl.so: failed to map segment from shared object [in thread "Render thread"]

Links to the source code that should be responsible for the /tmp error:

https://github.com/LWJGL/lwjgl3/blob/56d09c39ff26ad49c74f6be6884d60ef3f597384/modules/lwjgl/core/src/main/java/org/lwjgl/system/SharedLibraryLoader.java#L51

https://github.com/LWJGL/lwjgl3/blob/56d09c39ff26ad49c74f6be6884d60ef3f597384/modules/lwjgl/core/src/main/java/org/lwjgl/system/SharedLibraryLoader.java#L137

When starting an instance, in the logs, a failed attempt to load the lwjgl
library is shown and the game doesn't run.
The library is in the /tmp directory. The reason for this appears to
be, in the lwjgl source code, the shared library loading function,
extracts in the temporary directory and continues from there.
This is fixed by whitelisting.

The reason for adding "ignore noexec /tmp" as well, is that without it, the game
can't run, even if the directory is whitelisted. It seems the library needs
to be loaded from /tmp.

A second error for a failed attempt to access /home/user/.cache/JNA is also
shown in the logs. This is also fixed by whitelisting.
@topimiettinen
Copy link
Collaborator

The extremely predictable path in /tmp is most likely a security vulnerability (CWE-377), especially on a multi-user system.

With Firejail, private-tmp gives protection.

@powerjungle
Copy link
Contributor Author

powerjungle commented Feb 19, 2024

With Firejail, private-tmp gives protection.

The original profile has it in and I haven't changed that. Thanks for mentioning, since I would have forgotten to check.

@netblue30 netblue30 merged commit 54823b0 into netblue30:master Feb 29, 2024
3 checks passed
@netblue30
Copy link
Owner

merged, thanks!

kmk3 added a commit that referenced this pull request Mar 5, 2024
Fix `noblacklist` entry without an equivalent `blacklist` entry.

Added on commit 1a2e8ab ("multimc: instances not running, because of
missing permissions", 2024-02-19) / PR #6216.
@kmk3 kmk3 changed the title multimc: instances not running, because of missing permissions multimc: fix instances not running because of missing permissions Mar 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants