keepassxc: issues with browser extension and tray icon (dbus)

[albinou]

Hi,

Since the addition of dbus filters support (firejail version 0.9.64 I think), the keepassxc default profile does not give enough permissions for:

• the KeepassXC-Browser extension to work (tested with firefox)
• the tray icon to be displayed (tested with wayvar under sway / wayland)

Bug and expected behavior

• No systray icon displayed and things should at least be documented to allow the tray icon
• firefox can't connect to keepassxc

Ugly fix ... can we find better?
It works if I add the following lines in a keepassxc.local file:

ignore dbus-user filter

I tried with the following lines without success:

dbus-user.own org.keepassxc.KeePassXC
dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.StatusNotifierItem

Does anyone have an idea of the right DBUS session names to use?

Environment

• ArchLinux (up-to-date as of today)
• firejail version 0.9.64

Additional context
Other context about the problem like related errors to understand the problem.

Checklist

• The upstream profile (and redirect profile if exists) have no changes fixing it.
• The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• Programs needed for interaction are listed in the profile.
• A short search for duplicates was performed.
• If it is a AppImage, --profile=PROFILENAME is used to set the right profile.

---

Related commits:

• ba62f0e ("keepassxc dbus, closes keepassxc: issues with browser extension and tray icon (dbus) #3713 [skip ci]", 2020-10-31)
• a2bed30 ("Update keepassxc.profile dbus comments", 2020-12-29)

[rusty-snake]

For the tray, try dbus-user.own org.kde.StatusNotifierItem-2-2 and dbus-user.talk org.kde.StatusNotifierWatcher, if it works try to omit the own rule.

[albinou]

Thank you very much for your comment. After a few tries, it seems I need the 2 following lines:

dbus-user.talk org.kde.StatusNotifierWatcher
dbus-user.own org.kde.StatusNotifierItem-10-2

I really don't know from where the "10-2" value comes from :D

Note that these two lines also fix the KeepassXC-Browser extension.
I think we can close this issue, except if this needs to be documented somewhere?

[rusty-snake]

2-2 is used be the flatpak, if you need 10-2 then these numbers seem to not be stable.

Note that these two lines also fix the KeepassXC-Browser extension.

LOL

I think we can close this issue, except if this needs to be documented somewhere?

I add a note to the profile.

[albinou]

Note that these two lines also fix the KeepassXC-Browser extension.

LOL

I was wrong, this does not fix the KeepassXC-Browser extension totally.

Explanation of the scenario:

• run keepassxc without firejail
• KeePassXC-Browser works fine (under firefox)
• stop keepassxc
• rerun keepassxc but with firejail this time
• KeePassXC-Browser can reconnect successfully with the same firefox instance (kept opened)
• restart firefox
• KeePassXC-Browser fails to connect with the following error: KeePassXC-Browser has encountered an error: (no more information is given)

Even adding ignore dbus-user filter into the keepassxc firejail config does not fix the issue. So I guess the issue is related to something else.

[rusty-snake]

Has you made and modifications to your firefox/keepassxc profile? (private-bin, wruc, ...)

[albinou]

No, no local modifications on my keepassxc profile and I ran the tests without firejail enabled for firefox .

As a note, I just found this: keepassxreboot/keepassxc#283
So maybe we should add:

dbus-user.own org.keepassxc.MainWindow.openDatabase
dbus-user.own org.keepassxc.MainWindow.closeAllDatabases
dbus-user.own org.keepassxc.MainWindow.appExit

But this does not really helps here.

[rusty-snake]

Can you try to comment include disable-*.inc, private-tmp, private-bin and see if it works then.

If it still fails, comment the hole profile and uncomment it line for line.

EDIT: and try with --noprofile to make sure it's not general issues and try to run with --writable-run-user.

[albinou]

I tried with firejail --noprofile --writable-run-user keepassxc and I can observe the same issue than with the keepassxc profile :-(

Not really sure of what it means?
Thanks for your help.

[rusty-snake]

That's bad, if something is broken with --noprofile, then there is likely no fix for it. However there is still some hope: Because firefox isn't firejailed, keepassxc-proxy is started with it's profile. Maybe it works if you remove the keepassxc-proxy symlink (assuming you execute firecfg).

[albinou]

Well, so sorry, but it was weird ... actually my issue was also happening without enabling firejail at all. I just uninstalled the Keepassxc-browser add-on & re-install it. Everything is working now.

So, we can really close this issue. The only interesting thing to remember is that the following lines must be added to the keepassxc.local file in order to have a tray icon:

dbus-user.own org.keepassxc.KeePassXC
dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.StatusNotifierItem
dbus-user.talk org.kde.StatusNotifierWatcher
dbus-user.own org.kde.StatusNotifierItem-10-2

Thank you very much.