Arch Linux

Sapiens

Member

Registered: 2021-07-05

Posts: 52

[SOLVED] firejail list generates no output to show that firejail is on

Hi everyone,

I followed the Firejail Wiki article.and installed firejail version 0.9.66. I also run firecfg as root to set its usage as the standard.

I tried starting Firefox using the CLI

firejail firefox

As well as trying to let it use the firejail symlink that is created after running firecfg.

Firefox opens and while it is open I run

sudo firejail --list

firejail --list

Both generate no output.

How can I verify that firejail is working, what is wrong here? Thanks in advance!

Last edited by Sapiens (2021-07-16 17:29:29)

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: [SOLVED] firejail list generates no output to show that firejail is on

Hi everyone,

I followed the Firejail Wiki article.and installed firejail version 0.9.66. I also run firecfg as root to set its usage as the standard.

I tried starting Firefox using the CLI

firejail firefox

As well as trying to let it use the firejail symlink that is created after running firecfg.

You don't normally need to do this if 'firecfg' created the symlinks in '/usr/local/bin'
Did you check if this happened?

Firefox opens and while it is open I run

sudo firejail --list

firejail --list

Both generate no output.

How can I verify that firejail is working, what is wrong here? Thanks in advance!

'pstree' or 'ps -x|grep firejail'

If the symlinks are created you only need to start firefox and it will automatically be jailed.
If you remove the symlink (/usr/local/bin) you would need to start the jail yourself...

Sapiens

Member

Registered: 2021-07-05

Posts: 52

Re: [SOLVED] firejail list generates no output to show that firejail is on

ps -x | grep firejail

[sapiens]$ ps -x | grep firejail
  15533 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15536 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15538 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15541 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15543 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15545 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15549 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15570 pts/0    S+     0:00 grep firejail
[sapiens]$ ps -x | grep firejail
  15572 pts/0    S+     0:00 grep firejail

I only did try to invoke firejail manually because it seems it is not starting automatically.

Did you check if this happened?

Yes the links were created!

[sapiens]$ readlink -f /usr/local/bin/firefox
/usr/bin/firejail

Last edited by Sapiens (2023-01-07 17:00:00)

adventurer

Member

Registered: 2014-05-04

Posts: 128

Re: [SOLVED] firejail list generates no output to show that firejail is on

What‘s the output of

echo $PATH

?

Sapiens

Member

Registered: 2021-07-05

Posts: 52

Re: [SOLVED] firejail list generates no output to show that firejail is on

What‘s the output of

echo $PATH

?

/sbin:/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl

adventurer

Member

Registered: 2014-05-04

Posts: 128

Re: [SOLVED] firejail list generates no output to show that firejail is on

/sbin:/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl

I think we found the culprit. In order to make Symlink Invocation - which is automated by executing sudo firecfg - work, /usr/local/bin (which contains the symlinks pointing to /usr/bin/firejail) must be set in the PATH before /usr/bin and /bin (since the latter is a symlink to /usr/bin).

So in oder to fix your probelm add

export PATH="/usr/local/bin:/sbin:/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl"

to your ~/.bashrc. Execute source .bashrc and everytthing should work as expected.

Last edited by adventurer (2021-07-14 12:37:37)

Sapiens

Member

Registered: 2021-07-05

Posts: 52

Re: [SOLVED] firejail list generates no output to show that firejail is on

Thank you, this worked. I did not know about /bin containing links.

Bonus question. firecfg edits the desktop files. I edited the PATH by exporting it in the .bashrc. Rofi is using the .desktop files that contain e.g.

 exec=firefox %u 

to open applications. This, even tough I edited the $PATH, does not invoke firejail. To make programs started via rofi use firejail, I had to replace all instances of

exec=firefox %u 

with

exec=firejail firefox %u

adventurer

Member

Registered: 2014-05-04

Posts: 128

Re: [SOLVED] firejail list generates no output to show that firejail is on

I'm not familiar with Rofi. As long as it does not call firefox by using its full path it should work once /usr/local/bin is set before /usr/bin.

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: [SOLVED] firejail list generates no output to show that firejail is on

...rofi use firejail, I had to replace all instances of

exec=firefox %u 

with

exec=firejail firefox %u

I'm also unfamiliar with Rofi, but, there must be something blocking this.

I use dmenu instead of Rofi, there is no problem like the need to use 'exec=firejail firefox %u'.
This should be caught by firejail since you ran '#firecfg' the symlinks are in '/usr/local/bin' and PATH is okay, isit?

Then this should happen automatically, else what is the point of using firejail if rofi is in the way?, this is definitely not okay!

edit: I have installed Rofi and used the '-show run' option to start firefox.
Firefox did start jailed without the need to edit 'any' file, so it can't be Rofi.
If you start firefox the 'normal' way, does it get jailed?, if not the problem is still there.

edit: Btw. if you start editing such trivial files like a desktop file to get firejail working, you should ask yourself, what am I doing fix the dyke hole with my finger;-)

Last edited by qinohe (2021-07-15 18:19:41)

Sapiens

Member

Registered: 2021-07-05

Posts: 52

Re: [SOLVED] firejail list generates no output to show that firejail is on

When I start rofi from the terminal, search and execute firefox it starts in a jail. Normally I start rofi via the keybind in ~/.config/i3/config

[...]
# start rofi (a program launcher)
bindsym Mod1+d exec --no-startup-id rofi -show run -cache-dir "/home/sapiens/.cache/rofi" -font "DejaVu Sans Mono 20"
[...]

This somehow does not start firefox in a jail!

Edit: I figure it has to do somehow with i3 starting these programs as root, and root still having the wrong path, since I only changed it in my users .bashrc file? I am unsure how I should fix this properly, this time.

Last edited by Sapiens (2021-07-15 20:52:12)

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,599

Re: [SOLVED] firejail list generates no output to show that firejail is on

When I start rofi from the terminal, search and execute firefox it starts in a jail. Normally I start rofi via the keybind in ~/.config/i3/config

[...]
# start rofi (a program launcher)
bindsym Mod1+d exec --no-startup-id rofi -show run -cache-dir "/home/sapiens/.cache/rofi" -font "DejaVu Sans Mono 20"
[...]

This somehow does not start firefox in a jail!

Edit: I figure it has to do somehow with i3 starting these programs as root, and root still having the wrong path, since I only changed it in my users .bashrc file? I am unsure how I should fix this properly, this time.

It doesn't make much sense so first what is in "/home/sapiens/.cache/rofi"?
Second, what needs to be run as root, that is, non of the programs you mentioned above need root access , for what?

Sapiens

Member

Registered: 2021-07-05

Posts: 52

Re: [SOLVED] firejail list generates no output to show that firejail is on

/home/sapiens/.cache/rofi is a

Directory that is used to place temporary files, like history.

With the rest you are right, I checked with

ps -u sapiens

and i3 as well as all programs invoked by its config run under my user. I thought then they should have the $PATH specified in the .bashrc!

Last edited by Sapiens (2021-07-15 21:23:58)

Sapiens

Member

Registered: 2021-07-05

Posts: 52

Re: [SOLVED] firejail list generates no output to show that firejail is on

I found the solution why rofi did not start applications in a firejail environment!

Make sure you're setting PATH via ~/.profile. Most people run i3 via .xinitrc which, unlike terminals, doesn't source .bashrc. Explains why PATH vars are set when you run rofi from your term. Set PATH via ~/.profile, log out and back in, test it out, and report back. Best of luck friend.

This was actually the issue. I moved the change to $PATH from the .bashrc file to .profile, and now firejail is started correctly!