Firejail: Steam on Fedora fails to open with firejail

[clara2g]

The error is "glXChooseVisual failed". It works without Firejail so I assume is a Firejail issue.

I'm running up to date Fedora 30 KDE with Firejail 0.9.56 and default Steam profile. My laptop has integrated Intel UHD Graphics 620.

Loving Firejail. Thank you :)

[rusty-snake]

@clara2g does one of the following work?
firejail --noprofile steam
firejail --ignore=private-etc --ignore=private-dev --ignore=private-tmp steam

[clara2g]

@rusty-snake the first one works, the second does not (fails with the same message)

[rusty-snake]

@clara2g OK. can you then comment all lines in your steam.profile and uncomment line for line and try after every uncomment. As an suggestion: start uncommenting with the includes or the options (caps.drop all to shell none).

[clara2g]

@rusty-snake is the "include disable-common.inc" line. That's a long file, I will test it tomorrow to find the problem there and post it. Thank you :)

[rusty-snake]

@clara2g first check journalctl -r.

If you realy try to find something in disable-common, search binary. I think that is may in one of this sections:

systemd
var
etc
system directories
system management

[clara2g]

Hi again, I've digged into this issue, the problem was the line blacklist /usr/sbin in the disable-common.inc but that's a whole directory so I created a new include file for all _/usr/sbin/_ files in order to track the specific binary and it is _/usr/sbin/ldconfig_.

I noticed that the Firejail's Steam profile already has a noblacklist /sbin. Adding the line noblacklist /usr/sbin below fixes the issue.

Is it possible to whitelist only this specific file instead of the removing the whole blacklinsting on _/usr/sbin_ and _/sbin_ sensitive folders?

I hope this is useful. Thank you.

[rusty-snake]

@clara2g

Adding the line noblacklist /usr/sbin below fixes the issue.

Your welcome to open a PR, to fix this.

Is it possible to whitelist only this specific file instead of the removing the whole blacklinsting on /usr/sbin and /sbin sensitive folders?

Yes, some very sensitve binary should still be blacklisted (I don't look which), for whitelisting:
https://github.com/netblue30/firejail/blob/0330e04ec3eab46bb4150dbb593ca7d4ff1665cd/etc/steam.profile#L61-L66

_Please do whitelisting only local on your machine with steam.local and don't include it in a PR._