search

netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.83k stars 568 forks source link

`--join-or-start=program` shouldn't create `program-PID` sandboxes if multiple instances try to start simultaneously. #4543

Open crocket opened 3 years ago

crocket commented 3 years ago

If my bookmark manager tries to open multiple bookmarks by launching multiple invocations of firejail --join-or-start=librewolf librewolf URL simultaneously, the first invocation creates librewolf sandbox and some of subsequent invocations end up creating librewolf-PID sandboxes.

If multiple firejail invocations are trying to launch simultaneously with --join-or-start=program, the first invocation should reserve a named sandbox which subsequent invocations wait for before joining the named sandbox.

Because not all invocations of librewolf join the same sandbox, I had to insert

ignore private-tmp
ignore dbus-user

into librewolf.local in order to launch multiple bookmarks simultaneously on librewolf.

If --join-or-start was good at putting all simultaneous invocations of firejail in one named sandbox, I didn't need to make all librewolf instances share /tmp and dbus with programs outside sandbox.

rusty-snake commented 3 years ago

Previous discussion: #4538

rusty-snake commented 2 years ago

firejail 0.9.70 has improved join code, can you test if this still happens with it when it is released.

crocket commented 2 years ago

I will test. Just notify me on this issue when it's released.

kmk3 commented 2 years ago

I will test. Just notify me on this issue when it's released.

It has been released.

Note that you can subscribe to new releases through the Watch button (next to the Fork button).

crocket commented 2 years ago

I installed 0.9.70 and rebooted. I tested librewolf with join-or-start librewolf in librewolf.local.

The issue was reproduced reliably. I still need to ignore private-tmp and dbus-user.

Stoxis commented 1 year ago

This fix for librewolf doesn't work

Screenshot_2023-05-22_02-09-28

How do I fix this? I don't receive the error when I launch tabs using the commandline with firefox, only librewolf. Both are using firejail.

rusty-snake commented 1 year ago

@Stoxis did you got that will bulk opening link or with only one link? If you got it with only one link, it has a different cause. Open a new Discussion then. (There are already a lot for Firefox).

Stoxis commented 1 year ago

@Stoxis did you got that will bulk opening link or with only one link? If you got it with only one link, it has a different cause. Open a new Discussion then. (There are already a lot for Firefox).

If I run the command librewolf google.com/ it'll work the first time, but if I try to run the command a second time while the previous instance is still open I'll get the "Firefox is already running" error.

If I do the same thing firefox google.com/ I can do it as many times as I want to open new tabs without encountering the error.

Both Firefox and Librewolf are using Firejail.