Wiki: Frequently Asked Questions #2792

matu3ba · 2019-06-22T01:12:42Z

The text on support/FAQ is an ideal candidate to for the wiki.

Edit:

New FAQ page here: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions

matu3ba · 2019-06-22T01:17:11Z

content to add for FAQ: #1385, #2046, #2387
[TODO:review]

rusty-snake · 2019-06-22T07:45:03Z

more to add:

https://github.com/netblue30/firejail/projects/1 (some points are better for a new page or for create a profile)
(not all) https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion
(not all) https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation
Firefox cannot open mailto links #2795

rusty-snake · 2019-06-22T09:07:55Z

done

I started translating the FAQ to Markdown: https://gist.github.com/rusty-snake/3b62c4c433320415dee6f1f836887d5f

EDIT: I also add some comments (<!--TODO:) about the content.

rusty-snake · 2019-06-23T07:35:11Z

~~Note: Update the FAQ link in the README when this is Finish.~~ done

netblue30 · 2019-06-24T13:27:33Z

I'll move it in the wiki today!

netblue30 · 2019-06-24T14:33:07Z

New wiki page, thanks @rusty-snake, start editing! I'm not sure what I'll do with the one on the web page, probably I'll redirect it to wiki.

rusty-snake · 2019-06-24T16:13:50Z

done

TODOs I noted in https://gist.githubusercontent.com/rusty-snake/3b62c4c433320415dee6f1f836887d5f/raw/6b3f8cada23e8fa839f239d774c3329e441a7d3c/FAQ.md
1. Firefox crashing on Netflix, AMDGPU PRO, Nvidia closed source drivers
```
Example:
$ firejail --allow-debuggers --ignore=seccomp --ignore=protocol firefox --no-remote
```
  ☑️ Should we add --ignore=noroot --ignore=nonewprivs … ?
2. How do I run two instances of Firefox?
  Then, start the second sandbox:
```
$ firejail --private firefox --no-remote
```
  ☑️ TODO: --private will lose everything, consider an other solution:
  - ~~--private=~/second-ff~~
  - firejail firefox -P "SecondFFprofile" --no-remote
    SecondFFprofile must first be created on about:profiles
3. The best way to handle the command line switch is to place it in a
  custom profile in ~/.config/firejail file in your home directory.
  Create a vlc.profile text file in this directory, with the following content:
```
$ cat ~/.config/firejail/vlc.profile
include /etc/firejail/vlc.profile
net none
```
  ☑️ Consider using vlc.local
> Patched security profiles for are available for Firejail versions 0.9.38.x (LST) and 0.9.52. You can find them in our profile fixes section. Another option is to install Firejail 0.9.54.

Add a link, maybe we should also add/move the instruction.
- https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#firefox-60-problems
- https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#libreoffice-on-ubuntu-1804
"s/–/--/g"

netblue30 · 2019-06-24T17:40:05Z

@rusty-snake - go for it!

Fred-Barclay · 2019-06-25T04:41:26Z

For the PulseAudio FAQ https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#pulseaudio-7080-issue it says

It affects among others Arch, Ubuntu 16.04 and Mint users. This problem was fixed PulseAudio version 9.0.

Since this issue is only present for pulseaudio 7 or 8, and currently on Arch pulseaudio is at version 12.2, any reason to leave Arch in the list?

netblue30 · 2019-06-26T17:15:33Z

Arch removed from PulseAudio issue!

matu3ba · 2019-06-27T01:21:54Z

@rusty-snake https://github.com/netblue30/firejail/projects/1 explains several things. Do you want me to write some tests on that for explanation?
I do not get exactly what the use cases are and would likely write maybe 1 sentence to each functionality.
Regarding https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion, https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation would it maybe not easier to tag them as FAQ or hint a proper searching for the user on github?
Copy-pasting loads of text for uncertain gain does not look super interesting to me.

rusty-snake · 2019-06-27T06:30:17Z

https://github.com/netblue30/firejail/projects/1 explains several things

I think only the Usage section is good for the FAQ, the other are better for a own page.

https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion, https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation

that was rather meant that if you have time / energy you can go through it to see which of them are suitable

#404 Found. 🤣

matu3ba · 2019-06-27T12:47:02Z

~~> > https://github.com/netblue30/firejail/projects/1 explains several things~~

I think only the Usage section is good for the FAQ, the other are better for a own page.

Will look into that.

https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Aquestion, https://github.com/netblue30/firejail/issues?&q=is%3Aissue+label%3Ainformation

> that was rather meant that if you have time / energy you can go through it to see which of them are suitable > I did request a search option for duplicates in github and will do it by that means. Aside hopefully soon the related options are searchable/usable to group issues.

#404 Found. rofl

xD

matu3ba · 2019-06-27T16:49:37Z

@netblue30
What do you want to do with all the questions/comments on the support page?
Are there tools for extracting the comments and importing them into another github repo?
Or do you think it is even worth the effort?

matu3ba · 2019-06-27T17:51:50Z

@rusty-snake I was thinking of explaining one profile, but after a while I realized
that it is more useful to integrate that into the profile creation (for the part Usage).

So the overall idea is to change name of "Wiki: creating profile" to "Wiki: Usage and Profiles".
I have several duplicate stuff already and generally the shell parameters are quite the same as the profile options.
dirty idea thingy to be integrated:
https://gist.github.com/matu3ba/2fe10dc599d1f0671a23cce8aeb0a975
What do you think?

rusty-snake · 2019-06-27T18:56:27Z

i think that creating profiles should contain all information that makes writing your own profiles easier, so what about spliting a small usage out of your Idea and add it to FAQ and the rest to Creating profiels

netblue30 · 2019-06-28T00:41:29Z

What do you want to do with all the questions/comments on the support page?

Maybe we can extract some of the questions/solutions they come up with, but other than that is not worth the trouble importing them.

netblue30 · 2019-06-30T16:34:37Z

#2812

Quite a common question, I'll added to the FAQ.

SkewedZeppelin · 2019-07-01T14:27:26Z

$ firejail --allow-debuggers --ignore=seccomp --ignore=protocol --ignore=noroot --ignore=nogroups --ignore=nonewprivs firefox --no-remote

I don't like recommending this, nor have I seen it necessary. Where is it from?

rusty-snake · 2019-07-01T14:29:21Z

@SkewedZeppelin from the wordpress FAQ.

line 135: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions/_compare/edf31690da5d6fe123482a3b7d21aef013f53b54

I add only --ignore=noroot --ignore=nogroups --ignore=nonewprivs.

SkewedZeppelin · 2019-07-01T14:33:55Z

Netflix (Widevine CDM) should only need browser-allow-drm yes.
The only time ptrace is used with with Widevine CDM under Chromium in certain edge cases iirc.

and I thought ignore noroot was all that was needed for NVIDIA proprietary drivers?

I haven't tested AMDGPU PRO in a while but I don't think it uses any SUID binaries like the NVIDIA ones, so it can be removed from there.

matu3ba · 2019-07-08T11:31:46Z

Last update of tasks 2019-07-02
Last update of work 2019-07-09

Common problem
1.Symlink fixing(installation path in /usr/local #1995 #2629
2. whitelist and blacklist #2419 whitelist-blacklist discussion #1569
3. allowing specific profiles #2097

Guidelines

server Unable to run a C executable in firejail: Permission denied error. #1521

cgroup Limit the memory size used by the jailed process #593

wlan interfaces Is there a recommended workaround for using wlan interfaces with firejail? #1600, ip tables filter

strace Improved strace syscall editing instructions #404

~~Xephyr ??? Odd behaviour with --x11=xorg under GNOME 3 / gdm #1652~~

SkewedZeppelin · 2019-07-08T17:45:12Z

Can we please not use the hide/resolve comment feature?
I know it can be handy, but evil GitHub prevents non-logged in users from reading hidden comments (even ones that aren't spam and are simply outdated/resolved) for whatever crazy reason.

Commenting here since this issue has the most hidden comments.

matu3ba · 2019-07-09T12:46:38Z

@SkewedZeppelin

Summary

```js const x = 1 ```

explained in here could be used or can you think of a better way?
I dont like the need to write the annoying tags, so I requested a github functionality for this.

rusty-snake · 2019-07-09T12:58:33Z

@matu3ba

I dont like the need to write the annoying tags, so I requested a github functionality for this.

Easyer: GH allow all users to show the comments.

@SkewedZeppelin OK, that's real evil from GH. I will not use it for now, but one questions. Do you mean that also for the profile request issue or just for the wiki issues?

matu3ba · 2019-07-09T14:28:33Z

TODO
1.allowing specific profiles #2097
2. LD_PRELOAD, once finished

rusty-snake · 2019-07-11T19:28:45Z

@matu3ba I don't really understand what your new "A program does not start with firejail" point is about. starts the program fine, but not in firejail or firejail breaks the program from starting.

matu3ba · 2019-07-13T00:21:34Z

@rusty-snake It is the description of the problem.
Do you have a better idea how to reformulate?
Or shall I leave it out?

rusty-snake · 2019-07-13T09:10:37Z

firejail --list does not show the running program to be inside a firejail sandbox.

There is no firejail profile

@matu3ba that makes no sense, becausefirejail PROGRAM_WITHOUT_PROFILE will load the default profile.

rusty-snake · 2019-09-09T14:19:26Z

~~#2953~~
#2880

rusty-snake · 2020-01-25T12:44:50Z

#3173
#3185

matu3ba · 2020-04-10T00:35:13Z

#3224 zombies
#3100 common signalling problems in applications

rusty-snake · 2020-07-09T06:04:13Z

@NetSysFire

- First make sure you have run `sudo firecfg`.
+ First make sure you have run `firecfg` as root.

There is a huge difference between running firecfg as root and sudo firecfg:
firecfg does only perform a desktop-file fix-up if it is started with sudo.

IMHO: The explicit note for firejail /opt/foo/bar was easier for unskilled users.

NetSysFire · 2020-07-31T04:41:23Z

For some reason I did not see this.
Fixed: https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions/_compare/a45691b053a8e7431dd4574b0c426c6b4eb85de3...bc30985c2ee1e2d65dce375652757c687a317dd3

NetSysFire · 2020-08-16T03:10:33Z

I made some relatively small changes to the page.

One thing that is still missing imo is a section or even a page on how to debug errors.

matu3ba · 2020-08-17T21:25:52Z

@NetSysFire You find this here. Probably the name should be Debugging Tips instead of Developing Firejail renamed, since there was no activity on that wiki page for a long time

NetSysFire · 2020-08-18T19:35:46Z

This will not help the average user to debug common issues, like a broken profile. I would like to add something like this:

run it in your terminal if you have not done that already, the output may contain relevant errors
- also try to increase the verbosity of the affected application because it may report that it can not access a specific file or directory
- if it segfaults, check your syslog for audit messages which indicate a blocked syscall
try using the default profile (--profile=default)
use the --debug* arguments
...

I will probably add this to the debugging page later but the list is not complete yet.

Hints on how to debug a specific error message would also be very useful. Error: proc 30891 cannot sync with peer: unexpected EOF for example is not that easy to understand.

rusty-snake · 2020-08-24T17:21:50Z

We need to change all the dbus stuff.

kmk3 · 2021-03-05T17:21:31Z

@SkewedZeppelin commented on Jul 8, 2019:

Can we please not use the hide/resolve comment feature?

I know it can be handy, but evil GitHub prevents non-logged in users from
reading hidden comments (even ones that aren't spam and are simply
outdated/resolved) for whatever crazy reason.

Commenting here since this issue has the most hidden comments.

The loginwall is very unfortunate indeed.

I just checked if it also affects Pull Request threads marked as "resolved",
and fortunately it doesn't.

rusty-snake · 2021-08-04T15:02:14Z

#4446

matu3ba mentioned this issue Jun 22, 2019

Can't killall firejailed chromium #1385

Closed

chiraag-nataraj added the wiki Discussions about the wiki label Jun 22, 2019

This comment has been minimized.

Sign in to view

netblue30 changed the title ~~Wiki: Move FAQ from website for easier maintenance (more often changes needed)~~ Wiki: Frequently Asked Questions Jun 24, 2019

This comment has been minimized.

Sign in to view

SkewedZeppelin mentioned this issue Aug 8, 2019

leave Github #2895

Closed

matu3ba mentioned this issue May 3, 2020

Cannot start Libreoffice with the latest Firejail #3360

Closed

rusty-snake closed this as completed Aug 4, 2021

Wiki: Frequently Asked Questions #2792

Wiki: Frequently Asked Questions #2792

Comments

matu3ba commented Jun 22, 2019 • edited by netblue30 Loading

matu3ba commented Jun 22, 2019 • edited Loading

This comment has been minimized.

rusty-snake commented Jun 22, 2019 • edited Loading

rusty-snake commented Jun 22, 2019 • edited Loading

rusty-snake commented Jun 23, 2019 • edited Loading

netblue30 commented Jun 24, 2019

netblue30 commented Jun 24, 2019 • edited Loading

rusty-snake commented Jun 24, 2019 • edited Loading

netblue30 commented Jun 24, 2019

Fred-Barclay commented Jun 25, 2019

netblue30 commented Jun 26, 2019

This comment has been minimized.

matu3ba commented Jun 27, 2019 • edited Loading

rusty-snake commented Jun 27, 2019

matu3ba commented Jun 27, 2019 • edited Loading

matu3ba commented Jun 27, 2019

matu3ba commented Jun 27, 2019

rusty-snake commented Jun 27, 2019

netblue30 commented Jun 28, 2019

netblue30 commented Jun 30, 2019

This comment has been minimized.

This comment has been minimized.

SkewedZeppelin commented Jul 1, 2019

rusty-snake commented Jul 1, 2019 • edited Loading

This comment has been minimized.

SkewedZeppelin commented Jul 1, 2019 • edited Loading

This comment has been minimized.

matu3ba commented Jul 8, 2019 • edited Loading

SkewedZeppelin commented Jul 8, 2019

matu3ba commented Jul 9, 2019 • edited Loading

rusty-snake commented Jul 9, 2019

matu3ba commented Jul 9, 2019

rusty-snake commented Jul 11, 2019

matu3ba commented Jul 13, 2019

rusty-snake commented Jul 13, 2019

rusty-snake commented Sep 9, 2019 • edited Loading

rusty-snake commented Jan 25, 2020

matu3ba commented Apr 10, 2020 • edited Loading

rusty-snake commented Jul 9, 2020

NetSysFire commented Jul 31, 2020

NetSysFire commented Aug 16, 2020

matu3ba commented Aug 17, 2020 • edited Loading

NetSysFire commented Aug 18, 2020

rusty-snake commented Aug 24, 2020

kmk3 commented Mar 5, 2021

rusty-snake commented Aug 4, 2021

matu3ba commented Jun 22, 2019 •

edited by netblue30

Loading

matu3ba commented Jun 22, 2019 •

edited

Loading

rusty-snake commented Jun 22, 2019 •

edited

Loading

rusty-snake commented Jun 22, 2019 •

edited

Loading

rusty-snake commented Jun 23, 2019 •

edited

Loading

netblue30 commented Jun 24, 2019 •

edited

Loading

rusty-snake commented Jun 24, 2019 •

edited

Loading

matu3ba commented Jun 27, 2019 •

edited

Loading

matu3ba commented Jun 27, 2019 •

edited

Loading

rusty-snake commented Jul 1, 2019 •

edited

Loading

SkewedZeppelin commented Jul 1, 2019 •

edited

Loading

matu3ba commented Jul 8, 2019 •

edited

Loading

matu3ba commented Jul 9, 2019 •

edited

Loading

rusty-snake commented Sep 9, 2019 •

edited

Loading

matu3ba commented Apr 10, 2020 •

edited

Loading

matu3ba commented Aug 17, 2020 •

edited

Loading