search

netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.83k stars 568 forks source link

geary: crash when showing email contents #6103

Closed triallax closed 11 months ago

triallax commented 1 year ago

Description

Geary crashes when it tries to show an email's contents (at least that's the trigger as far as I can tell).

Steps to Reproduce

  1. Run LC_ALL=C firejail /bin/geary
  2. If the opened Geary window is large enough, it will crash almost instantly when it tries to show an email's contents, otherwise pressing on any email in the email list is sufficient to cause the crash as well

Expected behavior

Geary doesn't crash.

Actual behavior

Geary crashes.

Behavior without a profile

Nothing changes, the same crash happens.

Environment

Checklist

Log

Output of LC_ALL=C firejail /bin/geary

``` Reading profile /etc/firejail/geary.profile Reading profile /etc/firejail/allow-bin-sh.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-shell.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 1900, child pid 1907 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping alternatives for private /etc Warning: skipping crypto-policies for private /etc Warning: skipping ld.so.preload for private /etc Warning: skipping machine-id for private /etc Warning: skipping mailcap for private /etc Warning: skipping mime.types for private /etc Private /etc installed in 42.25 ms Private /usr/etc installed in 0.00 ms Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Child process initialized in 187.91 ms *[wrn] 20:11:03.0600 dbind:AT-SPI: Error retrieving accessibility bus address: org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown libEGL warning: wayland-egl: could not open /dev/dri/renderD128 (No such file or directory) *[wrn] 20:11:03.0693 geary:application-certificate-manager.vala:71: No GCR store found, GCR certificate pinning unavailable *[wrn] 20:11:03.0693 geary:application-certificate-manager.vala:75: GCR store is not RW, GCR certificate pinning unavailable *[wrn] 20:11:03.0783 folks:backend-store.vala:435: Error preparing Backend 'telepathy': org.freedesktop.DBus.Error.ServiceUnknown Could not determine the accessibility bus address ![err] 20:11:04.0389 [no domain]:Failed to start dbus proxy: Failed to spawn child process “/usr/bin/bwrap” (Permission denied) Parent is shutting down, bye... ```

Output of LC_ALL=C firejail --debug /bin/geary

https://gist.github.com/mhmdanas/70568d0b47f8c0546ee4a13fff24aa10

rusty-snake commented 1 year ago

Behavior without a profile Nothing changes, the same crash happens.

Try with --profile=noprofile.

triallax commented 1 year ago

Sorry, I messed up the comment body, I did test with firejail --profile=noprofile and the crash also happened.

triallax commented 1 year ago

Never mind my last comment, I just tested again and it seems like Geary hangs with --profile=noprofile when it tries to show an email's contents.

glitsj16 commented 1 year ago

Thanks for reporting.

![err] 20:11:04.0389 [no domain]:Failed to start dbus proxy: Failed to spawn child process “/usr/bin/bwrap” (Permission denied)

bwrap is blacklisted in disable-common.inc:

https://github.com/netblue30/firejail/blob/d91d430fb992bbb2187d8fc489812058eccc2745/etc/inc/disable-common.inc#L657-L658

You can try adding noblacklist ${PATH}/bwrap in a geary.local. But you might have hit another incompatibility between firejail and bubblewrap cfr. https://github.com/netblue30/firejail/issues/2995.

rusty-snake commented 1 year ago

That's the answer. We should remove it from firecfg for now.

glitsj16 commented 1 year ago

That's the answer. We should remove it from firecfg for now.

Agreed. There are probably more apps affected by webkit2gtk 4.x using bubblewrap (cfr. #3647). According to 'required by' info available here these need to be checked: