-
Notifications
You must be signed in to change notification settings - Fork 558
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
surf browser from suckless doesn't start #3441
Comments
Why is firejail started when you run Can you try |
|
Why did that fix the issue and how could've known better to fix it myself? I see that it reported |
That's not easy to answer in a few sentences, but I'll try. Generally speaking, the more you familiarize yourself with all the firejail options, the Linux filesystem layout etc., the better your chances become to detect potential issues in sandbox profiles. Logging output is key, which implies starting applications from terminal, which not all users do or are willing to do. As you know, security is always a matter of degrees, certainties are urban myths at best. In this particular case, seeing the failure to open /var/lib/dbus/machine-id is one clue that D-Bus was involved in breaking surf. Another clue is present in the filesystem, as that path is symlinked to /etc/machine-id. Finally, seeing that the surf.profile limits access to /etc via the private-etc option, a trained and experienced collaborator as @rusty-snake can put these pieces of information together quickly and suggest a fix. Like with so many things in life, the more you put yourself into this 'behind-the-scenes' position, the easier it gets. Practice helps in other words. Give it a try, most if not all information is out there. Fine-tuning firejail profiles to your own particular workflow is almost always possible (via the .local override files).
Now that's a very good question indeed. It seems to be related to having access to the audio layer. If you don't need audio in the surf web browser, it's possible to add firejail's Let's hope this brief attempt to answer your questions enables you to improve your firejail sandboxing skills, regards! |
Access to /etc/machine-id (see |
Bug and expected behavior
surf
browser from suckless doesn't startsurf
browser from suckless startsNo profile or disabling firejail
firejail --noprofile PROGRAM
in a shell?works as expected
whereis PROGRAM
,firejail --list
,stat $programpath
)?firejail
callssurf
from/usr/local/bin
instead of/usr/bin/
Reproduce
Steps to reproduce the behavior:
firejail surf
Environment
lsb_release -a
)firejail --version
) exclusive or used git commit (git rev-parse HEAD
)None.
No.
Additional context
Other context about the problem like related errors to understand the problem.
None required.
Checklist
find / -name 'firejail' 2>/dev/null
/fd firejail
to locate profiles ie in/usr/local/etc/firejail/PROGRAM.profile
)The text was updated successfully, but these errors were encountered: