Firejail: Maximum profile include level was reached

[ferreum]

I seem to have a quite customized setup, and since version 0.9.54 firejail complains (and fails starting) with the above message if I try to start thunderbird (edit: I should say that I linked /usr/local/bin/thunderbird to firejail):

$ thunderbird
Reading profile /home/fe/.config/firejail/thunderbird.profile
Reading profile /home/fe/.local/share/firejail/thunderbird.local
Reading profile /etc/firejail/thunderbird.profile
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-common.local
Reading profile /home/fe/.config/firejail/disable-common.inc.local
Error: maximum profile include level was reached

The file /home/fe/.local/share/firejail/thunderbird.local doesn't include anything, so /home/fe/.config/firejail/disable-common.inc.local is on the 7th include level. This file contains one further include of ~/.local/share/firejail/disable-common.local but the chain ends there.

My guess is that this happens because the thunderbird profile now includes the firefox profile.

Why is the limit so low? I couldn't find any option to increase the maximum include level.

[SkewedZeppelin]

The limit is 6, defined as MAX_INCLUDE_LEVEL https://github.com/netblue30/firejail/blob/dc96a6c6fa677dcad87119bf828f6cea16c8d56d/src/firejail/firejail.h#L107

and it is enforced here
https://github.com/netblue30/firejail/blob/dc96a6c6fa677dcad87119bf828f6cea16c8d56d/src/firejail/profile.c#L1224-L1228

According to git blame it was added back in the early days before we had .local and .global files.
We should probably consider increasing it maybe to 8 or 10.

[Fred-Barclay]

@netblue30 why do we have an include limit?

[reinerh]

Maybe to prevent recursion?

[ferreum]

To prevent (infinite) recursion, the limit doesn't need to be this low - may aswell increase it to 32 or higher. What I'm concerned about is that each recursion may need a hard to determine amout of stack, so this could lead to security issues from stack overflows. This is also why I refrained from patching the limit myself.

[netblue30]

Yes, it was to prevent infinite recursion - increased the level to 16 - https://github.com/netblue30/firejail/commit/bc2a81b29961243bdec88dcbb3cd7e7f88ea50e4