It seems that 8d3d67e8960f87a7592bc3a1623f27b45a52edb5 breaks Firefox

[KOLANICH]

Bug and expected behavior
Firefox cannot access internet after 8d3d67e

No profile and disabling firejail

• What changed calling firejail --noprofile /path/to/program in a terminal?: works
• What changed calling the program by path (e.g. /usr/bin/vlc)?: works

Reproduce
Steps to reproduce the behavior:

1. Run in bash firejail firefox
2. Open any networked website.
3. DNS is not available.

Environment

• Linux distribution and version (ie output of lsb_release -a, screenfetch or cat /etc/os-release) Ubuntu 21.04 hirsute
• Firejail version (output of firejail --version) exclusive or used git commit (git rev-parse HEAD) 8d3d67e

Additional context

Checklist

• The profile (and redirect profile if exists) hasn't already been fixed upstream.
• The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• I have performed a short search for similar issues (to avoid opening a duplicate).
• If it is a AppImage, --profile=PROFILENAME is used to set the right profile.: n/a
• Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
• I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
• This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

Debug output contains nothing useful at the moments I try to open websites from Firefox.

UPD: after manually replacing the files from a good commit with the ones of f4b36e8 it stopped breaking on f4b36e8. Now it breaks on 8d3d67e

[rusty-snake]

Where does your /etc/resolv.conf point?

[KOLANICH]

/run/resolvconf/resolv.conf (127.0.0.53)

[rusty-snake]

Then we should whitelist /run/resolvconf/resolv.conf in whitelist-run-common.inc too.

[KOLANICH]

Thank you.

[mjanonis]

On Arch Linux, /etc/resolv.conf points to /run/systemd/resolve/stub-resolv.conf when systemd-resolved is used, so that needs to get added to the whitelist too. I had the same problem and doing that fixed it.