Firejail: Flameshot - error while loading shared libraries

[aberja]

[aberja]

When I try to run flameshot with firejail I receive the following error:
flameshot: error while loading shared libraries: libGL.so.1: cannot open shared object file: No such file or directory

I tried adding ld.so.cache to the flameshot.profile, but that does not resolve the issue.

Commenting out the following line does resolve the issue:
#private-etc fonts,ld.so.conf,resolv.conf,ca-certificates,ssl,pki,crypto-policies

g752vs@g752vs:~$ firejail flameshot
Reading profile /usr/local/etc/firejail/flameshot.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-interpreters.inc
Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/disable-xdg.inc
Parent pid 22354, child pid 22355
Warning: skipping crypto-policies for private /etc
Private /etc installed in 13.34 ms
1 program installed in 2.00 ms
Child process initialized in 81.53 ms
flameshot: error while loading shared libraries: libGL.so.1: cannot open shared object file: No such file or directory

[SkewedZeppelin]

@aberja is the following from #2383 still the same?

Mint LMDE 3
Firejail version: 0.9.59
NVIDIA Driver version: 384.130

[Fred-Barclay]

@aberja Also does this actively interfere with using Flameshot? I get a similar message on my system (also LMDE 3) but flameshot itself works well as far as I can tell.

libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: r600

If it doesn't actually interfere it's likely this is just cosmetic.

Cheers!
Fred

[aberja]

@aberja is the following from #2383 still the same?

Mint LMDE 3
Firejail version: 0.9.59
NVIDIA Driver version: 384.130

Yes

[aberja]

Also does this actively interfere with using Flameshot?

Yes, Unfortunately Flameshot will not start unless I comment out the line.

[chiraag-nataraj]

Add alternatives to the private-etc line. This is most likely because you're using a system where there are multiple competing versions of libGL.so, so it ends up being a symlink to /etc/alternatives/libGL.so or something like that (the biggest culprit here is Nvidia, which has their own version of libGL.so).

[aberja]

Add alternatives to the private-etc line.

Appending ,alternatives to the private-etc line resolves the issue

[chiraag-nataraj]

@Fred-Barclay, should we add it to the official profile? Come to think of it, should we add alternatives to all private-etc lines? It _shouldn't_ make anything less secure since they're all symlinks anyway (so as long as the target isn't whitelisted, it'll just be a dangling symlink).

[Fred-Barclay]

@chiraag-nataraj Probably add to all. I'll get on it if you haven't already started :smile:

[chiraag-nataraj]

I'm going to go ahead and close this since the issue seems to be resolved :)