Firejail: Wiki: Frequently Asked Questions

[matu3ba]

The text on support/FAQ is an ideal candidate to for the wiki.

Edit:

New FAQ page here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions

[matu3ba]

content to add for FAQ: #1385, #2046, #2387
[TODO:review]

[matu3ba]

(keyword "help" and "tip", searching for open issues)
Tips to add for FAQ: #404, #1652
GUI stuff: #2707
[mark as outdated]

[rusty-snake]

more to add:

• https://github.com/netblue30/firejail/projects/1 (some points are better for a new page or for create a profile)
• (not all) https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion
• (not all) https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation
• #2795

[rusty-snake]

done

I started translating the FAQ to Markdown: https://gist.github.com/rusty-snake/3b62c4c433320415dee6f1f836887d5f

EDIT: I also add some comments (<!--TODO:) about the content.

[rusty-snake]

~Note: Update the FAQ link in the README when this is Finish.~ done

[netblue30]

I'll move it in the wiki today!

[netblue30]

New wiki page, thanks @rusty-snake, start editing! I'm not sure what I'll do with the one on the web page, probably I'll redirect it to wiki.

[rusty-snake]

done

• [x] TODOs I noted in https://gist.githubusercontent.com/rusty-snake/3b62c4c433320415dee6f1f836887d5f/raw/6b3f8cada23e8fa839f239d774c3329e441a7d3c/FAQ.md

  1. > Firefox crashing on Netflix, AMDGPU PRO, Nvidia closed source drivers
     > > Example: >$ firejail --allow-debuggers --ignore=seccomp --ignore=protocol firefox --no-remote >
     :ballot_box_with_check: Should we add --ignore=noroot --ignore=nonewprivs … ?
  2. > How do I run two instances of Firefox?
     > Then, start the second sandbox:
     > > $ firejail --private firefox --no-remote >
     :ballot_box_with_check: TODO: --private will lose everything, consider an other solution:
     
     
     
     • ~--private=~/second-ff~
     
     
     • firejail firefox -P "SecondFFprofile" --no-remote
       
       SecondFFprofile must first be created on about:profiles
     
     
  3. >
     > The best way to handle the command line switch is to place it in a
     > custom profile in ~/.config/firejail file in your home directory.
     > Create a vlc.profile text file in this directory, with the following content:
     > > $ cat ~/.config/firejail/vlc.profile > include /etc/firejail/vlc.profile > net none >
     :ballot_box_with_check: Consider using vlc.local

• [x] > Patched security profiles for are available for Firejail versions 0.9.38.x (LST) and 0.9.52. You can find them in our profile fixes section. Another option is to install Firejail 0.9.54.

  Add a link, maybe we should also add/move the instruction.

  • https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#firefox-60-problems
  • https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#libreoffice-on-ubuntu-1804
• [x] "s/–/--/g"

[netblue30]

@rusty-snake - go for it!

[Fred-Barclay]

For the PulseAudio FAQ https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#pulseaudio-7080-issue it says

It affects among others Arch, Ubuntu 16.04 and Mint users. This problem was fixed PulseAudio version 9.0.

Since this issue is only present for pulseaudio 7 or 8, and currently on Arch pulseaudio is at version 12.2, any reason to leave Arch in the list?

[netblue30]

Arch removed from PulseAudio issue!

[matu3ba]

#404 defines improved strace hint, which belongs to the guide and does not make sense to seperate

1652 is a gnome guide for xephyr, does anybody use that frequently/is that not already discussed in a guide?

2707 used a reference to overlayfs, which is described in another guide

[matu3ba]

@rusty-snake https://github.com/netblue30/firejail/projects/1 explains several things. Do you want me to write some tests on that for explanation?
I do not get exactly what the use cases are and would likely write maybe 1 sentence to each functionality.
Regarding https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion, https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation would it maybe not easier to tag them as FAQ or hint a proper searching for the user on github?
Copy-pasting loads of text for uncertain gain does not look super interesting to me.

[rusty-snake]

https://github.com/netblue30/firejail/projects/1 explains several things

I think only the Usage section is good for the FAQ, the other are better for a own page.

https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion, https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation

that was rather meant that if you have time / energy you can go through it to see which of them are suitable

---

404 Found. :rofl:

[matu3ba]

> > https://github.com/netblue30/firejail/projects/1 explains several things

I think only the Usage section is good for the FAQ, the other are better for a own page.

Will look into that.

https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion, https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation

that was rather meant that if you have time / energy you can go through it to see which of them are suitable

I did request a search option for duplicates in github and will do it by that means. Aside hopefully soon the related options are searchable/usable to group issues.

404 Found. rofl

xD

[matu3ba]

@netblue30
What do you want to do with all the questions/comments on the support page?
Are there tools for extracting the comments and importing them into another github repo?
Or do you think it is even worth the effort?

[matu3ba]

@rusty-snake I was thinking of explaining one profile, but after a while I realized
that it is more useful to integrate that into the profile creation (for the part Usage).

So the overall idea is to change name of "Wiki: creating profile" to "Wiki: Usage and Profiles".
I have several duplicate stuff already and generally the shell parameters are quite the same as the profile options.
dirty idea thingy to be integrated:
https://gist.github.com/matu3ba/2fe10dc599d1f0671a23cce8aeb0a975
What do you think?

[rusty-snake]

i think that creating profiles should contain all information that makes writing your own profiles easier, so what about spliting a small usage out of your Idea and add it to FAQ and the rest to Creating profiels

[netblue30]

What do you want to do with all the questions/comments on the support page?

Maybe we can extract some of the questions/solutions they come up with, but other than that is not worth the trouble importing them.

[netblue30]

https://github.com/netblue30/firejail/issues/2812

Quite a common question, I'll added to the FAQ.

[matu3ba]

>

more to add:

* https://github.com/netblue30/firejail/projects/1 (some points are better for a new page or for create a profile)

I did write the usage to the Wiki:Create profile in #2748.
Could you elaborate which points are useful to explicitly mention besides the README.md regarding the command line?

* (not all)

• [ ] https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion

TODO-list
FAQ questions
Symlink fixing (installation path in /usr/local ie #1995, #2629
Apparmor activation/deactivation/integration testing #1987,
Allowing specific profiles #2097,
Whitelist and Blacklist bugs?`#2419

maybe (User could easily search for that in FAQ)/other place might be better
Running inside Docker not supported #1956,

404 defines improved strace hint, which belongs to the guide and does not make sense to seperate

1652 is a gnome guide for xephyr, does anybody use that frequently/is that not already discussed in a guide?

[Mark as outdated]

[matu3ba]

* (not all) https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation

* #2795

TODO:

2812 tor browser fix, should be already done, but I do not see that (yet)

2795 firefox mailto, #1718 mailto for chromium,

2579 #692 adding information of incompability of running firejail inside docker (no virtualization as goal of firejail)

2291 apparmor local customizations (fixing apparmor)

1521 root permission crash/using firejail on root users server (seperate guideline?)

833 read-only well known inconsistency, #402 #158

maybe (elsewhere)

2480 is related to read-only (missing tests and documentation)

1569 whitelist blacklist discussion

593 cgroup guideline

1600 wlan interfaces with firejail guideline?

[Mark as outdated]

[SkewedZeppelin]

$ firejail --allow-debuggers --ignore=seccomp --ignore=protocol --ignore=noroot --ignore=nogroups --ignore=nonewprivs firefox --no-remote

I don't like recommending this, nor have I seen it necessary. Where is it from?

[rusty-snake]

@SkewedZeppelin from the wordpress FAQ.

line 135: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions/_compare/edf31690da5d6fe123482a3b7d21aef013f53b54

I add only --ignore=noroot --ignore=nogroups --ignore=nonewprivs.

[matu3ba]

FAQ killing process
ip tables filter (better guideline, no FAQ)
Did you identify any further useful FAQs?

[Mark as Outdated]

[SkewedZeppelin]

Netflix (Widevine CDM) should only need browser-allow-drm yes.
The only time ptrace is used with with Widevine CDM under Chromium in certain edge cases iirc.

and I thought ignore noroot was all that was needed for NVIDIA proprietary drivers?

I haven't tested AMDGPU PRO in a while but I don't think it uses any SUID binaries like the NVIDIA ones, so it can be removed from there.

[matu3ba]

Last update of tasks 2019-07-02
Last update of work 2019-07-08
FAQ
information
#2812 tor browser fix
#2795 firefox mailto, #1718 mailto for chromium,
#2579 #692 adding information of incompability of running firejail inside docker (no virtualization as goal of firejail)
#2291 apparmor local customizations (fixing apparmor)
#833 read-only well known inconsistency, #402 #158
#1521 root permission crash/using firejail on root users server ((new) server guideline, hint)

question
Apparmor activation/deactivation/integration testing #1987
Symlink fixing (installation path in /usr/local ie #1995, #2629 [common problem]
Allowing specific profiles #2097
Whitelist and Blacklist bugs? #2419

elsewhere
information
#2480 is related to read-only

1569 whitelist blacklist discussion [add infos to profiles]

593 cgroup guideline [new guideline]

1600 wlan interfaces with firejail [new guideline]

questions
Running inside Docker not supported #1956,

404 defines improved strace hint [add infos to guideline or/and move guideline from website]

1652 is a gnome guide for xephyr [??? lately no bug requests on xephyr]

FAQ killing process [addition of example to FAQ?]
[ip tables filter (better guideline, no FAQ)](https://firejail.wordpress.com/support/comment-page-1/#comment-293) [new/better guideline]

Outdated and apparmor should be sufficiently explained in man page.

[matu3ba]

Last update of tasks 2019-07-02
Last update of work 2019-07-09

Common problem
1.Symlink fixing(installation path in /usr/local #1995 #2629

1. whitelist and blacklist #2419 whitelist-blacklist discussion #1569
2. allowing specific profiles #2097

Guidelines

1. server #1521
2. cgroup #593
3. wlan interfaces #1600, ip tables filter
4. strace #404
5. Xephyr ??? #1652

[SkewedZeppelin]

Can we please not use the hide/resolve comment feature?
I know it can be handy, but evil GitHub prevents non-logged in users from reading hidden comments (even ones that aren't spam and are simply outdated/resolved) for whatever crazy reason.

Commenting here since this issue has the most hidden comments.

[matu3ba]

@SkewedZeppelin

Summary

const x = 1

explained in here could be used or can you think of a better way?
I dont like the need to write the annoying tags, so I requested a github functionality for this.

[rusty-snake]

@matu3ba

I dont like the need to write the annoying tags, so I requested a github functionality for this.

Easyer: GH allow all users to show the comments.

@SkewedZeppelin OK, that's real evil from GH. I will not use it for now, but one questions. Do you mean that also for the profile request issue or just for the wiki issues?

[matu3ba]

TODO
1.allowing specific profiles #2097

1. LD_PRELOAD, once finished

[rusty-snake]

@matu3ba I don't really understand what your new "A program does not start with firejail" point is about. starts the program fine, but not in firejail or firejail breaks the program from starting.

[matu3ba]

@rusty-snake It is the description of the problem.
Do you have a better idea how to reformulate?
Or shall I leave it out?

[rusty-snake]

firejail --list does not show the running program to be inside a firejail sandbox.

1. There is no firejail profile

@matu3ba that makes no sense, becausefirejail PROGRAM_WITHOUT_PROFILE will load the default profile.

[rusty-snake]

~#2953~

2880

[rusty-snake]

3173

3185

[matu3ba]

3224 zombies

3100 common signalling problems in applications

[rusty-snake]

@NetSysFire

- First make sure you have run `sudo firecfg`.
+ First make sure you have run `firecfg` as root.

There is a huge difference between running firecfg as root and sudo firecfg:
firecfg does only perform a desktop-file fix-up if it is started with sudo.

IMHO: The explicit note for firejail /opt/foo/bar was easier for unskilled users.

[NetSysFire]

For some reason I did not see this.
Fixed: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions/_compare/a45691b053a8e7431dd4574b0c426c6b4eb85de3...bc30985c2ee1e2d65dce375652757c687a317dd3

[NetSysFire]

I made some relatively small changes to the page.

One thing that is still missing imo is a section or even a page on how to debug errors.

[matu3ba]

@NetSysFire You find this here. Probably the name should be Debugging Tips instead of Developing Firejail renamed, since there was no activity on that wiki page for a long time

[NetSysFire]

This will not help the average user to debug common issues, like a broken profile. I would like to add something like this:

• run it in your terminal if you have not done that already, the output may contain relevant errors
  
  
  
  • also try to increase the verbosity of the affected application because it may report that it can not access a specific file or directory
  
  
  • if it segfaults, check your syslog for audit messages which indicate a blocked syscall
  
  
• try using the default profile (--profile=default)
• use the --debug* arguments
• ...

I will probably add this to the debugging page later but the list is not complete yet.

Hints on how to debug a specific error message would also be very useful. Error: proc 30891 cannot sync with peer: unexpected EOF for example is not that easy to understand.

[rusty-snake]

We need to change all the dbus stuff.