Firejail: can't open Calibre ebook-viewer with net none

[omega3]

I can't open Calibre ebook-viewer 4.1.0-1 on Manjaro.

firejail --net=none /usr/bin/ebook-viewer
Reading profile /etc/firejail/ebook-viewer.profile
Reading profile /etc/firejail/calibre.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 5481, child pid 5482
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Blacklist violations are logged to syslog
Child process initialized in 188.81 ms
qt.core.logging: Ignoring malformed logging rule: '’*=false’'
Qt: Session management error: Could not open network socket
WebEngineContext used before QtWebEngine::initialize() or OpenGL context creation failed.
QGLXContext: Failed to create dummy context

Parent is shutting down, bye...

Operating System: Manjaro Linux
KDE Plasma Version: 5.16.5
KDE Frameworks Version: 5.62.0
Qt Version: 5.13.1
Kernel Version: 4.19.78-1-MANJARO
OS Type: 64-bit

[Vincent43]

Can'r reproduce on Arch Linux, there are warnings but app opens just fine:

firejail --net=none /usr/bin/ebook-viewer
Reading profile /etc/firejail/ebook-viewer.profile
Reading profile /etc/firejail/calibre.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 12252, child pid 12253
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Blacklist violations are logged to syslog
Child process initialized in 308.77 ms
libGL error: MESA-LOADER: failed to retrieve device information
libGL error: Version 4 or later of flush extension not found
libGL error: failed to load driver: i915
libGL error: failed to open drm device: No such file or directory
libGL error: failed to load driver: i965
[4:17:1011/161746.087431:ERROR:address_tracker_linux.cc(158)] Could not create NETLINK socket: Operation not supported (95)
[4:18:1011/161746.093553:ERROR:udev_linux.cc(21)] Failed to initialize udev, possibly due to an invalid system configuration. Various device-related browser features may be broken.

[omega3]

Which version of firejail you have installed? I use
firejail-git r5602.b35c000f-1
from
https://aur.archlinux.org/packages/firejail-git

But I can open epub when I use:
firejail --net=none --noprofile /usr/bin/ebook-viewer

Is there something in profile that I need to change? Maybe I should somehow update profiles? I don't know how? Aren't they updated along with firejail?

I don't have package firejail-profiles installed.

[rusty-snake]

Manjaro test VM: confirming @omega3 results.
With Fedora it works.

[rusty-snake]

To start ebook-viewer with firejail under Manjaro without issues

diff --git a/etc/ebook-viewer.profile b/etc/ebook-viewer.profile
index b2fd635b..1e8fc00a 100644
--- a/etc/ebook-viewer.profile
+++ b/etc/ebook-viewer.profile
@@ -1,8 +1,14 @@
 # Firejail profile alias for calibre
 # This file is overwritten after every install/update
+# Persistent local customizations
+include ebook-viewer.local
+
+ignore tracelog

 net none
 nodbus
+protocol unix,netlink
+seccomp !chroot

 # Redirect
 include calibre.profile

EDIT: We can remove inet,inet6 if we have net none

[omega3]

I edited
/etc/firejail/ebook-viewer.profile
to

# Firejail profile alias for calibre
# This file is overwritten after every install/update
# Persistent local customizations
include ebook-viewer.local

ignore tracelog

net none
nodbus
protocol unix,inet,inet6,netlink
seccomp !chroot

# Redirect
include calibre.profile

Is this correct? I am not an ITdeveloper, so I can only guess that this green colour should be added.

I get:

firejail --net=none /usr/bin/ebook-viewer
Reading profile /etc/firejail/ebook-viewer.profile
Reading profile /etc/firejail/calibre.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: two protocol lists are present, "unix,inet,inet6,netlink" will be installed
Parent pid 1355, child pid 1356
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Post-exec seccomp protector enabled
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 207.89 ms
qt.core.logging: Ignoring malformed logging rule: '’*=false’'
Qt: Session management error: Could not open network socket
WebEngineContext used before QtWebEngine::initialize() or OpenGL context creation failed.
QGLXContext: Failed to create dummy context
Failed to create OpenGL context for format QSurfaceFormat(version 2.0, options QFlags<QSurfaceFormat::FormatOption>(), depthBufferSize 24, redBufferSize -1, greenBufferSize -1, blueBufferSize -1, alphaBufferSize -1, stencilBufferSize 8, samples 0, swapBehavior QSurfaceFormat::DefaultSwapBehavior, swapInterval 1, colorSpace QSurfaceFormat::DefaultColorSpace, profile  QSurfaceFormat::NoProfile) 

Parent is shutting down, bye...

Should I wait for repository update?

[rusty-snake]

Is this correct?

yes

I get

Hmm, then are there more issues.

Should I wait for repository update?

Probably there won't be any updates in the near future. https://aur.archlinux.org/cgit/aur.git/log/?h=firejail-git

[rusty-snake]

@omega3 when do you install firejail?

[omega3]

Can you clarify your question?

Here is screenshot from pamac
https://i.imgur.com/Ts4blgC.png

firejail --version
firejail version 0.9.61

Compile time support:
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - file and directory whitelisting support is enabled
        - file transfer support is enabled
        - firetunnel support is enabled
        - networking support is enabled
        - overlayfs support is enabled
        - private-home support is enabled
        - seccomp-bpf support is enabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled


which firejail
/bin/firejail

[rusty-snake]

"Data instalacji" means install date? So you installed it yesterday.

Since there are error logs about OpenGL, maybe ignore no3d is a fix. With --no-profile it works?

[omega3]

"Data instalacji" means install date?
Correct. Actually, updated yesterday.

Added:
ignore no3d
and it is a fix.

firejail --net=none /usr/bin/ebook-viewer
Reading profile /etc/firejail/ebook-viewer.profile
Reading profile /etc/firejail/calibre.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: two protocol lists are present, "unix,inet,inet6,netlink" will be installed
Parent pid 1374, child pid 1375
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Post-exec seccomp protector enabled
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 197.52 ms
qt.core.logging: Ignoring malformed logging rule: '’*=false’'
Qt: Session management error: Could not open network socket

and the rest (just for the record) when I open an epub is:

org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
org.kde.solid.udisks2: Failed enumerating UDisks2 objects: "org.freedesktop.DBus.Error.Disconnected" 
 "Not connected to D-Bus server"
qt.core.logging: Ignoring malformed logging rule: '’*=false’'
kf5.kio.kio_tags: tag fetch failed: "Failed to open the database"
kf5.kio.kio_tags: "tags:/" list() invalid url
kf5.kio.core: "Cannot enter folder tags:/."
qt.core.logging: Ignoring malformed logging rule: '’*=false’'
qt.core.logging: Ignoring malformed logging rule: '’*=false’'
Qt: Session management error: networkIdsList argument is NULL

Solved. Thank you very much.

[rusty-snake]

IMHO the org.kde.solid.udisks2 warnings can be ignored.