Services preventing firejail from stopping

[valoq]

when agent services like gpg-agent or ssh-agent are started by firejailed applications, firejail will not close because those services will keep running

When gpg-agent is automatically firejailed by firecfg, it will break many things like apt-get update when it is used by install scripts

Is there a way to prevent this? Mabe tell services to close when the application that started them is stopped

[netblue30]

I'll mark it as an enhancement,. The default is keep the sandbox running for as long as there are still processes running in the sandbox. I will probably add a new command line option, where the sandbox monitors a specific process and kills everything else if the process dies. Thanks for suggesting it, it makes sense in some cases.

[valoq]

One idea would be to provide an option in the application profile to start services outside of the sandbox like normally. Might be the cleanest way.

[netblue30]

Yes, this will work if you know what services to start. Most of the time you don't know.

[smitsohu]

It would be great also for #725. Right now unported KDE apps, when they don't run on KDE Plasma 4, launch all kinds of services inside the sandbox which keep running when the sandbox is closed.

[chiraag-nataraj]

@netblue30 Was this ever implemented?

[Nokia808]

Is there any progression about this issue ? Can we expect a fix for this or not ?

One of most critically needed programs to be run under firejail is Thunderbird. Currently, due to this issue it is not working okay .........

[Nokia808]

Hi again. It seem that it is fixed at lest for Thunderbird !! Sorry for my previous comment, I gave it before testing ....

No when I closed Thunderbird after launching it by "firejail thunderbird" I will receive at the end the following in the terminal:

"Parent is shutting down, bye..."

This is very good !

[msva]

@Nokia808 I bet, in your case it closes fine because ~/.gnupg is whitelisted.
But I still have chrome/kmail/tb jails not closing because all of them using custom gpg homes, so all have separated gpg-agents, that keeps running in that jail..

So, that's why I think, we're need a profile option like "kill-remains", which will kill all remainings and close the jail after main process exited.