goldendict: clicking tray icon creates another tray icon instead of opening a program window

[jose1711]

Description

When goldendict is running and tray icon is enabled clicking the icon duplicates it.

https://user-images.githubusercontent.com/1406222/153288802-24ba0c28-71e1-493e-9917-54ad3064ed97.mp4

Steps to Reproduce

1. Install Tray Icons: Reloaded Gnome extension (https://extensions.gnome.org/extension/2890/tray-icons-reloaded/)
2. Install Goldendict, enable tray icon in program settings
3. Exit Goldendict
4. Run Goldendict via firejail with the predefined profile
5. Left-click the icon

Expected behavior

Goldendict window should open.

Actual behavior

No new window opens, but instead an icon is duplicated.

Behavior without a profile

Works without the profile, but to fix the issue all what is needed is to remove private-tmp.

Additional context

Similar issues were reported already:

• https://github.com/netblue30/firejail/issues/4508 (mix of multiple issues)
• https://github.com/netblue30/firejail/issues/1137 (only mentions chrome applications, goldendict is a Qt app)

Environment

• Arch Linux, x86_64
• Firejail-git a6672757d1d884d02538ac3f92b13f997ee3efbb

Checklist

• [x] The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
• [x] I can reproduce the issue without custom modifications (e.g. globals.local).
• [x] The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• [x] The profile (and redirect profile if exists) hasn't already been fixed upstream.
• [x] I have performed a short search for similar issues (to avoid opening a duplicate).
  • [ ] I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
• [ ] I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

[rusty-snake]

If you ignore private-tmp which file does it create/access in /tmp?

[jose1711]

$ strace -f  /usr/bin/goldendict 2>&1 | grep /tmp
connect(3, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0
getpeername(3, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0
[pid 62476] connect(6, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0
[pid 62476] getpeername(6, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0
[pid 62476] connect(10, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, 20) = 0
[pid 62476] getpeername(10, {sa_family=AF_UNIX, sun_path=@"/tmp/.X11-unix/X0"}, [124 => 20]) = 0
[pid 62476] connect(10, {sa_family=AF_UNIX, sun_path="/tmp/dbus-HA15SEvcI2"}, 22) = 0
[pid 62476] connect(15, {sa_family=AF_UNIX, sun_path=@"/tmp/.ICE-unix/1490"}, 22) = 0
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] read(16, "\0\4XSMP\0\0\0\37unix/myhost:/tmp/.ICE-"..., 4096) = 318
[pid 62476] readlink("/tmp", 0x7ffdd1bc6090, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] openat(AT_FDCWD, "/tmp/qtsingleapp-Golden-86bf-3e8-lockfile", O_RDWR|O_CREAT|O_CLOEXEC, 0666) = 16
[pid 62476] readlink("/tmp", 0x7ffdd1bc6000, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] bind(17, {sa_family=AF_UNIX, sun_path="/tmp/qtsingleapp-Golden-86bf-3e8"}, 110) = -1 EADDRINUSE (Address already in use)
[pid 62476] readlink("/tmp", 0x7ffdd1bc6150, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] unlink("/tmp/qtsingleapp-Golden-86bf-3e8") = 0
[pid 62476] readlink("/tmp", 0x7ffdd1bc6000, 1023) = -1 EINVAL (Invalid argument)
[pid 62476] bind(17, {sa_family=AF_UNIX, sun_path="/tmp/qtsingleapp-Golden-86bf-3e8"}, 110) = 0
[pid 62480] connect(25, {sa_family=AF_UNIX, sun_path="/tmp/dbus-HA15SEvcI2"}, 22) = 0

[rusty-snake]

/tmp/qtsingleapp-Golden*

Mutex is stored in /tmp without subdir, we need to ~remove private-tmp from the profile~ use join-or-start goldendict.

Can you test if adding join-or-start goldendict works.

[jose1711]

Can you test if adding join-or-start goldendict works.

Yup, I can confirm. That really fixes it!

[jose1711]

flameshot.profile suffers from the same issue (and join-or-start flameshot fixes that too)

[rusty-snake]

That's because Qt uses it's own socket instead of D-Bus (like GTK) for instance management.

To continue the list:

• keepassxc
• maybe vlc?
• maybe qtox?
• ...

[jose1711]

Tried both keepassxc and vlc and cannot reproduce the same problem for those.

[rusty-snake]

keepassxc already has j-o-s and for vlc I'm not sure (maybe depending on the config?).

[jose1711]

keepassxc already has j-o-s

ah, true..