netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.68k stars 556 forks source link

Telegram 2.8.0 not working #4378

Closed dmitryvakulenko closed 2 years ago

dmitryvakulenko commented 3 years ago

I upgraded Telegram and now It can't connect to network. Firejail version 0.9.64.4. Profile I got from issue https://github.com/netblue30/firejail/issues/4377. Telegram write this messages to log

[2021.06.28 20:53:24] Config Error: Failed to parse dns response JSON, error: illegal value
[2021.06.28 20:53:24] Config Error: Bad data size 0 required 344

EDIT by @rusty-snake: fix code-block

rusty-snake commented 3 years ago

Which distro do you use? Do you have any custom modifications (e.g. globals.local or telegram.local)?

I upgraded Telegram and now It can't connect to network.

Only in firejail? or is this a telegram bug? Does it work with --noprofile?

Profile I got from issue #4377.

How exactly? If you mean you use the current git-master, that's wrong because it can no work (can not parse noinput).

[2021.06.28 20:53:24] Config Error: Failed to parse dns response JSON, error: illegal value [2021.06.28 20:53:24] Config Error: Bad data size 0 required 344

What is your DNS setup? dnsmasq? systemd-resolved? unbound? dnscrypt-proxy? ...?

dmitryvakulenko commented 3 years ago

Which distro do you use? Do you have any custom modifications (e.g. globals.local or telegram.local)?

Linux Mint 20.1 Cinnamon. Yes, I use custom usually (use private directory for Telegram). But now I copy profile from that issue.

Only in firejail? or is this a telegram bug? Does it work with --noprofile?

Telegram works fine without firejail or with --noprofile.

How exactly? If you mean you use the current git-master, that's wrong because it can no work (can not parse noinput).

I just remove noinput. All other the same.

What is your DNS setup? dnsmasq? systemd-resolved? unbound? dnscrypt-proxy? ...?

systemd-resolved in default configuration. It forward dns requests to my router and that's all.

rusty-snake commented 3 years ago

I still don't have a real idea what causes this. I mean if you would say all firejailed programs fail ... but only telegram, after an update. :confused: . Looks like you need to comment the profile to find the line that causes this (dbus-system none? wusc? private-etc? ...)

Yes, I use custom usually (use private directory for Telegram). But now I copy profile from that issue.

If you made you cahnged (e.g private ${HOME}/telegram-home) in telegram.local (as you should) they are still included.

dmitryvakulenko commented 3 years ago

Looks like you need to comment the profile to find the line that causes this

I try to do it yesterday but no any results. Looks like trouble more complex. One more things - after I reverted Telegram to old version it drop authorization and all settings. Maybе new version has different directory structure and firejail block access to new one.

rusty-snake commented 3 years ago

I try to do it yesterday but no any results. Looks like trouble more complex.

It's cause by the profile (--noprofile works). If you comment everything, it must work as a consequence. If you now start to uncomment it line for line (and things like whitelisting at once) you could at least narrow it down (e.g. caused by whitelisting, one of the disable-*.inc includes, dbus policy, ...).

I reverted Telegram to old version it drop authorization and all settings. Maybе new version has different directory structure and firejail block access to new one.

That, or it just has a new config format which isn't backward-compatible. Or something else.

To check the directory structure, start it with firejail --private --name=telegram --ignore=privte-bin telegram and run firejail --join=telegram tree -a (or ls -aR) in a second terminal.

dmitryvakulenko commented 3 years ago

The trouble was at include /etc/firejail/disable-shell.inc line. I'm confused...

rusty-snake commented 3 years ago

Try to add include allow-bin-sh.inc.

How can this stop network??! I'm confused... …I'm too.

rusty-snake commented 2 years ago

I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.