Open ShellCode33 opened 9 months ago
glitsj16
commented
9 months ago nvim: error while loading shared libraries: libluajit-5.1.so.2: cannot open shared object file: Permission denied
Lua is blacklisted in disable-interpreters.inc (as are others):
You probably just need to allow it in the man sandbox. Try include allow-lua.inc in your man.local.
ShellCode33
commented
9 months ago It's better now, thanks a lot !
However I have new errors now, the man page opens, but is not displayed properly :
Here's the error I have:
Error detected while processing /etc/xdg/nvim/sysinit.vim:
line 2:
E484: Can't open file /usr/share/nvim/archlinux.vim
E484: Can't open file /usr/share/nvim/syntax/syntax.vim
E886: System error while opening ShaDa file /home/shellcode/.local/state/nvim/shada/main.shada for reading: permission denied
E303: Unable to create directory "/home/shellcode/.local/state/nvim/swap" for swap file, recovery impossible: permission denied
E303: Unable to open swap file for "[No Name]", recovery impossibleIn man.local I tried to include nvim.profile but it doesn't seem to work. Any idea ?
glitsj16
commented
9 months ago In man.local I tried to include nvim.profile but it doesn't seem to work. Any idea ?
Yeah that won't work, but you're on the right track. You only need to cherrypick the nvim configuration paths and add those into man.local:
$ cat ~/.config/firejail/man.local
include allow-lua.inc
noblacklist ${HOME}/.vim
noblacklist ${HOME}/.vimrc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvimWhat does that do?
ShellCode33
commented
9 months ago Still no luck, the error is different and doesn't give much information unfortunately:
/usr/bin/man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page sendfile(2) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page sendfile(2) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=sendfile(2) nvim +Man!Here's what my man.local looks like:
private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim,nvim
include allow-lua.inc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.dotfiles/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvimIs there a way to know exactly what is being denied ? I tried to use something like:
MANPAGER='nvim +Man!' firejail --allow-debuggers --profile=man strace /usr/bin/man sendfileWith no luck.
Here's the output of MANPAGER='nvim +Man!' firejail --debug /usr/bin/man sendfile :
ShellCode33
commented
9 months ago I tried to copy the whole nvim.profile into man.local and tweak it a bit:
private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim,nvim,strace
include allow-lua.inc
noblacklist ${HOME}/.vim
noblacklist ${HOME}/.vimrc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.dotfiles/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
include whitelist-runuser-common.inc
ipc-namespace
machine-id
net none
no3d
nodvd
nogroups
noinput
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
seccomp.block-secondary
tracelog
x11 none
private-dev
dbus-user none
dbus-system none
read-only ${HOME}/.config
read-only ${HOME}/.dotfiles
read-only ${HOME}/.dotfiles/.config
read-write ${HOME}/.config/nvim
read-write ${HOME}/.dotfiles/config/nvim
read-write ${HOME}/.local/share/nvim
read-write ${HOME}/.local/state/nvim
read-write ${HOME}/.vim
read-write ${HOME}/.vimrc
restrict-namespacesStill the same error
kmk3
commented
9 months ago @glitsj16 on Nov 30:
Yeah that won't work, but you're on the right track. You only need to cherrypick the nvim configuration paths and add those into man.local:
$ cat ~/.config/firejail/man.local include allow-lua.inc noblacklist ${HOME}/.vim noblacklist ${HOME}/.vimrc noblacklist ${HOME}/.cache/nvim noblacklist ${HOME}/.config/nvim noblacklist ${HOME}/.local/share/nvim noblacklist ${HOME}/.local/state/nvim whitelist /usr/share/nvimWhat does that do?
I managed to get it working with the following in man.local:
ignore memory-deny-write-execute
# Allow lua (blacklisted by disable-interpreters.inc)
include allow-lua.inc
noblacklist ${HOME}/.vim
noblacklist ${HOME}/.vimrc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
read-write ${HOME}/.local/state/nvimNote: The read-write entry is only needed to avoid warnings.
@ShellCode33 Does that work for you?
ShellCode33
commented
9 months ago Works like a charm, thanks a lot ! The key thing seems to be ignore memory-deny-write-execute, I'd be glad to know why w+x memory is required though.
Small additional note, I had errors you apparently didn't have which seem to be related to my/your nvim config.
The first one I had to solve was related to nvim swap mechanism, I don't want them anyway so instead of changing the firejail profile, I disabled it in my nvim config:
vim.opt.swapfile = falseThe second one I've been unable to solve for now is related to treesitter:
Error detected while processing User Autocommands for "VeryLazy":
Parser dir ' /home/shellcode/.local/share/nvim/lazy/nvim-treesitter/parser ' should be read/write (see README on how to configure an alternative install location) /home/shellcode/.local/share
/nvim/lazy/nvim-treesitter/parser 'I'm not sure why the write permission is required for ~/.local/share/nvim/lazy/nvim-treesitter/parser as it only contains .so files.
I tried to add read-write ${HOME}/.local/share/nvim/lazy/nvim-treesitter/parser to man.local but it doesn't work. Still the same error.
This is not an error that prevents me from reading the man page, but the warning is annoying:
kmk3
commented
9 months ago @ShellCode33 on Nov 30:
Works like a charm, thanks a lot !
No problem.
The key thing seems to be
ignore memory-deny-write-execute, I'd be glad to know why w+x memory is required though.
Probably for executing Vimscript, Lua, etc.
Small additional note, I had errors you apparently didn't have which seem to be related to my/your nvim config.
The first one I had to solve was related to nvim swap mechanism, I don't want them anyway so instead of changing the firejail profile, I disabled it in my nvim config:
vim.opt.swapfile = false
With the default configuration, if the swapfile and shada file are disabled in
the command line, then it should work without any read-write entries:
MANPAGER='nvim -n -i NONE +Man!' firejail /usr/bin/man sendfileThe second one I've been unable to solve for now is related to treesitter:
Error detected while processing User Autocommands for "VeryLazy": Parser dir ' /home/shellcode/.local/share/nvim/lazy/nvim-treesitter/parser ' should be read/write (see README on how to configure an alternative install location) /home/shellcode/.local/share /nvim/lazy/nvim-treesitter/parser 'I tried to add
read-write ${HOME}/.local/share/nvim/lazy/nvim-treesitter/parsertoman.localbut it doesn't work. Still the same error.This is not an error that prevents me from reading the man page, but the warning is annoying:
Note that there are multiple read-only nvim entries:
$ grep -R '^read-only .*nvim' /etc/firejail/
/etc/firejail/disable-common.inc:read-only ${HOME}/.config/nvim
/etc/firejail/disable-common.inc:read-only ${HOME}/.local/share/nvim
/etc/firejail/disable-common.inc:read-only ${HOME}/.local/state/nvimIn this case the read-write command might need to match the existing
read-only command:
read-write ${HOME}/.local/share/nvimThanks for your reply. I tried to add all these read-write statements but it doesn't seem to work. I think the issue might be that man.profile first include man.local and THEN include disable-common.inc. Therefore the read-write directive is overridden by the read-only one. Any advice on how to workaround that ?
kmk3
commented
9 months ago Thanks for your reply. I tried to add all these read-write statements but it doesn't seem to work. I think the issue might be that
man.profilefirstinclude man.localand THENinclude disable-common.inc. Therefore the read-write directive is overridden by the read-only one. Any advice on how to workaround that ?
Good catch; though the read-write entries did remove the warnings when I was
testing, so maybe something changed in 0.9.73.
How about the following?
# ignore entries from disable-common.inc
ignore read-only ${HOME}/.local/share/nvim
ignore read-only ${HOME}/.local/state/nvim
# because of read-only ${HOME}
read-write ${HOME}/.local/share/nvim
read-write ${HOME}/.local/state/nvimNop still doesn't work :/
Here's what my man.local looks like so far:
ignore memory-deny-write-execute
# Allow lua (blacklisted by disable-interpreters.inc)
include allow-lua.inc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
# ignore entries from disable-common.inc
ignore read-only ${HOME}/.local/share/nvim
ignore read-only ${HOME}/.local/state/nvim
read-write ${HOME}/.local/share/nvim
read-write ${HOME}/.local/state/nvim
restrict-namespacesNop still doesn't work :/
Is the error still about treesitter read/write?
What is the neovim and treesitter plugin version?
How is treesitter configured in neovim?
Does it still happen with firejail-git?
If you join the sandbox, what are the permissions in the treesitter directories?
Can you create files in them?
Example:
MANPAGER='nvim -n -i NONE +Man!' firejail --name=nvim /usr/bin/man sendfile
# in another shell
firejail --join=nvim
ls -l ~/.local/share/nvim/lazy/nvim-treesitter/parser
mkdir -p ~/.local/share/nvim/lazy/nvim-treesitter/parser
touch ~/.local/share/nvim/lazy/nvim-treesitter/parser/test
ls -l ~/.local/share/nvim/lazy/nvim-treesitter/parserIs the error still about treesitter read/write?
Yes it is
What is the neovim and treesitter plugin version?
Neovim up to date with ArchLinux repo
$ nvim --version
NVIM v0.9.4
Build type: Release
LuaJIT 2.1.1700008891I don't know what is the version of Treesitter but it is built into Neovim, so for reproducibility purposes, having neovim 0.9.4 would give the same Treesitter version.
However I use the nvim-treesitter plugin which - from what I understand - is a common interface for other plugins to build onto. And I'm on b41bbcb (almost the head). I might be wrong but I don't think this plugin is relevant.
How is treesitter configured in neovim?
I use LazyVim which configures it for me, its Treesitter configuration can be found here ("Full spec" must be selected)
My whole neovim config can be found here.
Does it still happen with firejail-git?
Yes it does, the exact same error
$ firejail --version
firejail version 0.9.73Can you create files in them?
No
$ touch ~/.local/share/nvim/lazy/nvim-treesitter/parser/test
touch: cannot touch '/home/shellcode/.local/share/nvim/lazy/nvim-treesitter/parser/test': Read-only file systemProcess tree in case that's useful:
shellco+ 9053 1.1 1.9 2765948 231148 ? Sl 19:13 0:36 /usr/bin/wezterm-gui
shellco+ 9060 0.0 0.0 14132 10396 pts/0 Ss 19:13 0:01 \_ /usr/bin/zsh
shellco+ 28999 0.0 0.0 4472 2816 pts/0 S+ 20:03 0:00 | \_ firejail /usr/bin/man sendfile
shellco+ 29000 0.0 0.0 6096 3304 pts/0 S+ 20:03 0:00 | \_ firejail /usr/bin/man sendfile
shellco+ 29013 0.0 0.0 8776 4416 pts/0 S+ 20:03 0:00 | \_ /usr/bin/man sendfile
shellco+ 29023 0.0 0.0 13720 8192 pts/0 Sl+ 20:03 0:00 | \_ nvim -n -i NONE +Man!
shellco+ 29029 0.7 0.2 29672 25088 ? Ssl 20:03 0:02 | \_ nvim --embed -n -i NONE +Man!Note: my man.local hasn't changed between my last comment and this one
Again, thanks a lot for your help
Description
I'm unable to use nvim as man pager.
Steps to Reproduce
Expected behavior
To show the man page.
Actual behavior
Behavior without a profile
Works fine.
Additional context
I tried to create a
man.localwith the following content with no luck (I'm not familiar at all with Firejail):(notice the
nvimat the end of theprivate-binstatement)Not sure it's relevant but just in case:
Environment
Checklist
/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)Log
Output of
LC_ALL=C firejail /path/to/program``` See above ```
Output of
LC_ALL=C firejail --debug /path/to/program``` Leaks a lot, I can send it in private if need be ```