Firejail: Teamspeak3 doesn't work

[Lemm99]

Linux Mint 19.3

I can't get Teamspeak3 to run through firejail. I downloaded the 64-bit linux client from here https://www.teamspeak.com/en/downloads/# and verified the sha256 hash. I ran the installer and extracted the files to /home/user/TeamSpeak3-Client-linux_amd64. I ran ts3client_runscript.sh and Teamspeak3 opens but it's not firejailed, confirmed by running htop and filtering by the word "firejail". So then I closed Teamspeak and tried something else that didn't work:
$ cd /home/user/TeamSpeak3-Client-linux_amd64
$ firejail ./ts3client_runscript.sh
Reading profile /usr/local/etc/firejail/default.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc

* Note: you can use --noprofile to disable default.profile *

Parent pid 16015, child pid 16016
Warning: cleaning all supplementary groups
Child process initialized in 76.49 ms
QCoreApplication::applicationDirPath: Please instantiate the QApplication object first

Parent is shutting down, bye...

then a Teamspeak error pops up: TeamSpeak 3 cannot write to the configuration file: /home/user/.ts3client/settings.db You can use TeamSpeak 3, but all settings will be lost!" with options Abort or Ignore.

Any ideas?

[rusty-snake]

If you use a custom installation in your home-directory with a special starter script, you must specify a profile and allow execution in $HOME: firejail '--ignore=noexec ${HOME}' --profile=teamspeak3 ./ts3client_runscript.sh

[Lemm99]

Is there a different way to install Teamspeak? I use the official installer. I see a different error now

firejail --version
firejail version 0.9.63

user@box:~/TeamSpeak3-Client-linux_amd64$ ls -la | grep ts3client
drwxrwxr-x 5 user user 4096 Mar 15 16:36 .ts3client
-rwx------ 1 user user 19227736 Aug 25 2019 ts3client_linux_amd64
-rwx------ 1 user user 1328 Aug 25 2019 ts3client_runscript.sh

user@box:~/TeamSpeak3-Client-linux_amd64$ firejail '--ignore=noexec ${HOME}' --profile=teamspeak3 ./ts3client_runscript.sh
Reading profile /usr/local/etc/firejail/teamspeak3.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-exec.inc
Reading profile /usr/local/etc/firejail/disable-interpreters.inc
Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/whitelist-common.inc
Parent pid 5380, child pid 5381
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Post-exec seccomp protector enabled
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 56.99 ms
Error: no suitable ./ts3client_runscript.sh executable found

Parent is shutting down, bye...

[rusty-snake]

TeamSpeak3-Client-linux_amd64 need to be whitelisted:
firejail '--ignore=noexec ${HOME}' --profile=teamspeak3 '--whitelist=${HOME}/TeamSpeak3-Client-linux_amd64' ./ts3client_runscript.sh

[rusty-snake]

Only a few (mostly Arch based) distributions have teamspeak(3) in their repos [1] [2]. Therefore the most users (Fedora, Debian, Ubuntu, Mint, Gentoo, ...) will need to use the official install script or use flatpak or snap?. We should modify the relevant parts of the profile.

[1] https://repology.org/project/teamspeak/versions
[2] https://repology.org/project/teamspeak3/versions

[rusty-snake]

@Lemm99 can you test this profile.

ts3client_runscript.sh.profile:

# Firejail profile alias for teamspeak3
# Description: TeamSpeak is software for quality voice communication via the Internet
# This file is overwritten after every install/update
# Persistent local customizations
include ts3client_runscript.sh.local
# Persistent global definitions
# added by included profile
#include globals.local

ignore noexec ${HOME}

whitelist ${HOME}/TeamSpeak3-Client-linux_x86
whitelist ${HOME}/TeamSpeak3-Client-linux_amd64

# Redirect
include teamspeak3.profile

1. Create ~/.config/firejail
2. copy it to ~/.config/firejail/ts3client_runscript.sh.profile
3. reset teamspeak3 if you made changes
4. firejail ~/TeamSpeak3-Client-linux_amd64/ts3client_runscript.sh