Firejail: memory-deny-write-execute breaks several applications

Created on 8 Jul 2019 · 13Comments · Source: netblue30/firejail

At least mumble, galculator and pavucontrol are affected.

Source

setpill

All 13 comments

Fixed in 704fc8b, Thanks for reporting.

rusty-snake on 8 Jul 2019

Thanks for the quick response :)

setpill on 9 Jul 2019

It would be great if we could test graphical programs in our CI to catch errors like this... any ideas if this is possible?

CC: @reinerh since you've been working on our CI recently :smile:

Fred-Barclay on 10 Jul 2019

@Fred-Barclay Yes, it would be possible. I think the tests (in test/ directory) already run some graphical programs.
It would be easy to run all tests also in our CI, but for now I didn't enable it, as it's a bit unrealiable.
See e.g. in Debian CI and Ubuntu CI.

reinerh on 10 Jul 2019

We obviously can't test all graphical apps in CI, especially across various distros. The truth is that mdwe is unreliable in gtk/qt apps and perhaps in all gui apps and shouldn't be used there.

Vincent43 on 10 Jul 2019

@Vincent43 I'm inclined to agree but I'd really like using mdwe as much as possible :smile: . Isn't Arch the distro that usually has issues with it?

Fred-Barclay on 10 Jul 2019

Isn't Arch the distro that usually has issues with it?

_We need ~?IS_ARCH: mdwe~ ?NOT_ARCH: mdwe :smiley_cat:_

Yes if an app works fine with mdwe except on some distors, it is normaly Arch, Manjaro, ...

rusty-snake on 10 Jul 2019

😄1

It would be interesting to find out what's causing the difference there.

Vincent43 on 10 Jul 2019

👍1

$ grep -l "#1803" *
authenticator.profile
autokey-common.profile
baobab.profile
bitwarden.profile
clawsker.profile
d-feet.profile
enpass.profile
eo-common.profile
exfalso.profile
font-manager.profile
galculator.profile
geekbench.profile
mpDris2.profile
mumble.profile
ocenaudio.profile
pavucontrol.profile
QMediathekView.profile
qtox.profile
subdownloader.profile
viewnior.profile
youtube-dl.profile

ytdl not only GUI.

BTW: Should we reopen?

rusty-snake on 10 Jul 2019

If a bug is reopened, it would make more sense to reopen #1803 than this one.

setpill on 11 Jul 2019

👍1

Regarding Arch specific breakage: recently mdwe was enhanced to block also memfd_create() system call. Maybe a library in Arch has started using it?