Keepassxc-browser: Extension starts KeepassXC

[mat-m]

Expected Behavior

When my browser starts, I don't want KeepassXC to be started if I didn't do it

Current Behavior

When my browser starts, KeepassXC starts with the last loaded db. So it may not be the db I use for internet logins...

Possible Solution

Just a setting to not start the app if it cannot connect to a db. I don't know how it manages to launch it, actually.

Debug info

KeePassXC - KeepassXC 2.3.3
KeePassXC-Browser Version: 1.2.0
Operating system: Linux Mint 19 with Cinnamon desktop
Browser: Opera 57 & Firefox 61.0.1

[varjolintu]

Please enable the checkbox Use a proxy application between KeePassXC and browser extension from the Browser Integration settings, Advanced tab. It should be enabled by default.

[mat-m]

It is already checked.
My process chain looks like this:

  ├─opera-developer,6418
  │   ├─bwrap,6844 --args 17 command-wrapper.sh chrome-extension://azertyuiopqsdfghhhhhhjjkkkkmwxcc/
  │   │   └─bwrap,6852 --args 17 command-wrapper.sh chrome-extension://azertyuiopqsdfghhhhhhjjkkkkmwxcc/
  │   │       └─sh,6855 /app/bin/command-wrapper.sh chrome-extension://azertyuiopqsdfghhhhhhjjkkkkmwxcc/
  │   │           └─keepassxc,6856 chrome-extension://azertyuiopqsdfghhhhhhjjkkkkmwxcc/
  │   │               ├─{keepassxc},6857
  │   │               ├─{keepassxc},6858
  │   │               ├─{keepassxc},6864
  │   │               ├─{keepassxc},6865
  │   │               ├─{keepassxc},6866
  │   │               └─{keepassxc},6868

If it could help

[mat-m]

Same applies for firefox

  │   │   │   │       ├─firefox,8362
  │   │   │   │       │   ├─Web Content,8602 -contentproc -childID 3 -isForBrowser -prefsLen 15008 -schedulerPrefs 0001,2 -parentBuildID 20180912013803 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 8362 true tab
  │   │   │   │       │   │   ├─{Web Content},8605
  │   │   │   │       │   │   ├─{Web Content},8607
  │   │   │   │       │   │   └─{Web Content},8623
  │   │   │   │       │   ├─bwrap,8497 --args 29 command-wrapper.sh /home/mm/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json [email protected]
  │   │   │   │       │   │   └─bwrap,8507 --args 29 command-wrapper.sh /home/mm/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json [email protected]
  │   │   │   │       │   │       └─sh,8509 /app/bin/command-wrapper.sh /home/mm/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json [email protected]
  │   │   │   │       │   │           └─keepassxc,8510 /home/mm/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json [email protected]
  │   │   │   │       │   │               ├─{keepassxc},8511
  │   │   │   │       │   │               ├─{keepassxc},8518
  │   │   │   │       │   │               ├─{keepassxc},8545
  │   │   │   │       │   │               ├─{keepassxc},8546
  │   │   │   │       │   │               ├─{keepassxc},8547
  │   │   │   │       │   │               └─{keepassxc},8551

[varjolintu]

So you are using Bubblewrap sandbox? That explains a lot. It's known that these kind of wrappers can cause issues. If you open the /home/mm/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json what's the path variable?

[mat-m]

I don't use bubblewrap, firefox packaged on Mint does.

path is "/var/lib/flatpak/exports/bin/org.keepassxc.KeePassXC"

[varjolintu]

That path should point to keepassxc-proxy, not to KeePassXC directly. Please see this thread for additional info with flatpak: https://github.com/flathub/org.keepassxc.KeePassXC/issues/13#issuecomment-400784869

[mat-m]

Hello

I defined custom proxy in keepassxc to be /var/lib/flatpak/app/org.keepassxc.KeePassXC/x86_64/stable/active/files/bin/keepass-proxy which was resolved to /run/user/1000/doc/b02b76cc/keepassxc-proxy

Keepassxc did not start automatically, but Firefox could not connect to keepass neither.

[varjolintu]

This is because flatpak needs some extra configuration so it could access the Unix socket. Does it help if you enable the checkbox from Browser Integration Advanced settings that updates to manifest files each time at startup? Or use a custom proxy directory.

[mat-m]

With these settings, KeepassXC auto-starts with Firefox and Opera.

[varjolintu]

This happens because of flatpak. I need to do some testing.

[varjolintu]

Found the solution for this. You need some manual work.
Create a wrapper script /var/lib/flatpak/exports/bin/org.keepassxc.KeePassXC.proxy with the following content:

#!/bin/sh
exec /usr/bin/flatpak run --command=keepassxc-proxy org.keepassxc.KeePassXC "$@"

Make the script executable with chmod +x and then change the Use a custom proxy location to point this script.

[mat-m]

Fix is working, thanks.
Could you opened an issue to flatpak for a root-cause fix ?

[rugk]

@varjolintu Okay, but this only works if KeePassXC runs on the host, does not it?

[varjolintu]

Haven't tried it with any other way.

[rugk]

Okay, so to add one other theoretical workaround you may need to use if both use flatpaks:
You can "hole-pinch" a flatpak and allow it to to execute flatpak-spawn just like in this example.

But possibly, when building the flatpak you can do more and securely limit it to one command to be able to run.

Actually though, this all seems to be solved (as per https://github.com/flathub/org.keepassxc.KeePassXC/issues/13), so I'll need to test it.

[rugk]

FYI, for everyone following: I have found a working around involving some manual steps you need to do though for KeePassXC<->Firefox communication, if Firefox is flatpaked/sandboxed (works if KeePassXC is sandboxed or not). Read the full write-up/tutorial here.