Firejail: I feel like I don't know anything.
So, I read that using firejail will keep my data safe from malicious things on the internet. I absolutely don't know what I'm doing and feel like I would need a four year degree to understand a lot of this. I've been using ubuntu 20.04 on an hp laptop.
I followed the installation instructions and used the command: firejail firefox. I received the following along with an open firefox window:
Reading profile /usr/local/etc/firejail/firefox.profile
Reading profile /usr/local/etc/firejail/whitelist-usr-share-common.inc
Reading profile /usr/local/etc/firejail/firefox-common.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-exec.inc
Reading profile /usr/local/etc/firejail/disable-interpreters.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/whitelist-common.inc
Reading profile /usr/local/etc/firejail/whitelist-var-common.inc
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 7760, child pid 7764
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: not remounting /run/user/1000/gvfs
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 168.50 ms
* (process:7762): WARNING *: 15:47:24.460: Error writing credentials to socket: Error sending message: Broken pipe
I don't know if this is even a bug at all. I tried doing websearches for process 7762, Broken pipe, and the whole line. I didn't find anything that I could understand. This is the only place I could find to contact someone who might know, so I'm asking here. Is there anything here I should worry about?
Mathalor
All 6 comments
I don't know if this is even a bug at all. [...]. Is there anything here I should worry about?
Short answer.
IMO your Firefox looks to be properly sandboxed, all good, no bug.
You can confirm/deny this by running one of the commands below after you've started firefox the way you did.
firejail --list prints a list of all _active_ sandboxes; if you see firefox in there it's working, if not it isn't.
firejail --list | grep firefox - print the same output as with the former command, this time limited to firefox only; again, if you see output, it's working, if not it isn't.
The longer road home.
As you might expect, if someone mentions a _short_ answer, there's bound to be a _longer_ one too. There usually is and firejail is no exception. In what follows I'll try to outline a few basics, without - hopefully - getting (too) technical. Please feel free to ask for clarification wherever you feel its needed.
So, I read that using firejail will keep my data safe from malicious things on the internet. I absolutely don't know what I'm doing and feel like I would need a four year degree to understand a lot of this.
I sure recognize that feeling! One can get easily overwhelmed by seeing all those technicalities scroll by, while all one wants to do is protect oneself on the internet. Security these days is extremely complex and it's not bound to get any easier. Such is life, we all have to deal with this fact one way or another, sooner _and_ later. Using firejail is only one way to reduce the risks involved, but it cannot offer 100% guarantees. Leave that to PR slogans, sales pitches and the likes.
I followed the installation instructions [...]
I'm assuming you mean the Compile and install section, correct?
Noticing several lines like 'Reading profile /usr/local/etc/firejail/firefox.profile' suggests as much. Ubuntu 20.04 also offers another way to install firejail, by using its native package management system or GUI apps to install software. Installed that way the paths would be different (/etc/firejail/xxx.profile instead of /usr/local/etc/...).
The difference is important. The former (and what I think you're currently running) is the development version. The latter is a stable release version. Whatever option you choose, don't mix them up, that's bound to break stuff.
If these are your first steps in firejailing applications, I'd recommend using the stable release version offered natively by your OS. For starters you'd be in a better position when searching and reading blogs/forum posts/introductions related to using firejail on Ubuntu/Debian. Another plus would be that you don't have to rebuild and install firejail each and every time the development code changes (which happens frequently). The Ubuntu repositories will take care of that as long as you upgrade regularly (which is another way to keep as secure as possible).
But in the end the choice is yours, just be aware of the differences involved and act accordingly. If you decide to change away from the dev version to the repo one, don't forget to uninstall/undo what you did before doing so.
Do you get confirmation on Firefox being sandboxed by firejail?
We can touch on a few other points to make your firejail life easier later, but for now it would be nice if you can tell us the result of checking the Firefox sandbox status if that's okay with you.
glitsj16
on 21 May 2020
You can also press Ctrl+o or open file://home/user to chek that there are only Downloads, .mozilla and a few subdirectories of .config, .local/share, ... available. Maybe also interesting for you: #2986.
rusty-snake
on 21 May 2020
I used the command line with git clone.
I typed firejail list in a separate terminal window. I don't see firefox by name:
firejail list
Reading profile /usr/local/etc/firejail/default.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-passwdmgr.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
* Note: you can use --noprofile to disable default.profile *
Parent pid 12548, child pid 12549
Warning: cleaning all supplementary groups
Child process initialized in 169.03 ms
/bin/bash: list: command not found
If I am using the development branch, are there instructions somewhere for uninstalling / reinstalling?
I just noticed that my error is different this time:
firejail firefox
Reading profile /usr/local/etc/firejail/firefox.profile
Reading profile /usr/local/etc/firejail/whitelist-usr-share-common.inc
Reading profile /usr/local/etc/firejail/firefox-common.profile
Reading profile /usr/local/etc/firejail/disable-common.inc
Reading profile /usr/local/etc/firejail/disable-devel.inc
Reading profile /usr/local/etc/firejail/disable-exec.inc
Reading profile /usr/local/etc/firejail/disable-interpreters.inc
Reading profile /usr/local/etc/firejail/disable-programs.inc
Reading profile /usr/local/etc/firejail/whitelist-common.inc
Reading profile /usr/local/etc/firejail/whitelist-var-common.inc
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 12228, child pid 12231
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: not remounting /run/user/1000/gvfs
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 334.86 ms
firejail --list
(firefox:7): dconf-WARNING **: 15:07:59.263: failed to commit changes to dconf: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown
I foolishly attempted to type firejail --list in the active terminal window. The error at the end is probably because of that.
Mathalor
on 21 May 2020
The first time you did firejail list, which is incorrect syntax. The second time you used the correct syntax firejail --list, but in the active terminal, which indeed explains the new error. So try this:
Terminal window (A): $ `firejail firefox`
Open a new terminal window (B)
Terminal window (B): $ `firejail --list | grep firefox`
If I am using the development branch, are there instructions somewhere for uninstalling / reinstalling?
You can use the exact same instructions as you did when you first installed firejail after git cloning the repo. To uninstall you have to add one more step. But there's a catch. If you deleted the original directory from where you first installed firejail you will have to repeat * installation* again and when that has finished you can proceed with uninstalling it.
$ git clone https://github.com/netblue30/firejail.git
$ cd firejail
$ ./configure && make && sudo make install-strip
# uninstall
$ sudo make uninstall
Now you can install firejail (stable release) via your OS tools (CLI or GUI). Ubuntu splits-out the firejail files into two seperate packages. You'll need both:
$ sudo apt-get update && sudo apt-get install firejail firejail-profiles
still need help?
rusty-snake
on 16 Jul 2020
I think that it's working correctly. Thank you.
Mathalor
on 16 Jul 2020
Related issues
crass
路
3Comments
kmotoko
路
3Comments
fl-chris
路
4Comments
Vincent43
路
3Comments
ghost
路
3Comments
Most helpful comment
Short answer.
IMO your Firefox looks to be properly sandboxed, all good, no bug.
You can confirm/deny this by running one of the commands below after you've started firefox the way you did.
firejail --listprints a list of all _active_ sandboxes; if you see firefox in there it's working, if not it isn't.firejail --list | grep firefox- print the same output as with the former command, this time limited to firefox only; again, if you see output, it's working, if not it isn't.The longer road home.
As you might expect, if someone mentions a _short_ answer, there's bound to be a _longer_ one too. There usually is and firejail is no exception. In what follows I'll try to outline a few basics, without - hopefully - getting (too) technical. Please feel free to ask for clarification wherever you feel its needed.
I sure recognize that feeling! One can get easily overwhelmed by seeing all those technicalities scroll by, while all one wants to do is protect oneself on the internet. Security these days is extremely complex and it's not bound to get any easier. Such is life, we all have to deal with this fact one way or another, sooner _and_ later. Using firejail is only one way to reduce the risks involved, but it cannot offer 100% guarantees. Leave that to PR slogans, sales pitches and the likes.
I'm assuming you mean the Compile and install section, correct?
Noticing several lines like 'Reading profile
/usr/local/etc/firejail/firefox.profile' suggests as much. Ubuntu 20.04 also offers another way to install firejail, by using its native package management system or GUI apps to install software. Installed that way the paths would be different (/etc/firejail/xxx.profile instead of /usr/local/etc/...).The difference is important.The former (and what I think you're currently running) is the development version. The latter is a stable release version. Whatever option you choose, don't mix them up, that's bound to break stuff.If these are your first steps in firejailing applications, I'd recommend using the stable release version offered natively by your OS. For starters you'd be in a better position when searching and reading blogs/forum posts/introductions related to using firejail on Ubuntu/Debian. Another plus would be that you don't have to rebuild and install firejail each and every time the development code changes (which happens frequently). The Ubuntu repositories will take care of that as long as you upgrade regularly (which is another way to keep as secure as possible).
But in the end the choice is yours, just be aware of the differences involved and act accordingly. If you decide to change away from the dev version to the repo one, don't forget to uninstall/undo what you did before doing so.
Do you get confirmation on Firefox being sandboxed by firejail?
We can touch on a few other points to make your firejail life easier later, but for now it would be nice if you can tell us the result of checking the Firefox sandbox status if that's okay with you.