Open ShellCode33 opened 9 months ago
nvim: error while loading shared libraries: libluajit-5.1.so.2: cannot open shared object file: Permission denied
Lua is blacklisted in disable-interpreters.inc
(as are others):
You probably just need to allow it in the man sandbox. Try include allow-lua.inc
in your man.local
.
It's better now, thanks a lot !
However I have new errors now, the man page opens, but is not displayed properly :
Here's the error I have:
Error detected while processing /etc/xdg/nvim/sysinit.vim:
line 2:
E484: Can't open file /usr/share/nvim/archlinux.vim
E484: Can't open file /usr/share/nvim/syntax/syntax.vim
E886: System error while opening ShaDa file /home/shellcode/.local/state/nvim/shada/main.shada for reading: permission denied
E303: Unable to create directory "/home/shellcode/.local/state/nvim/swap" for swap file, recovery impossible: permission denied
E303: Unable to open swap file for "[No Name]", recovery impossible
In man.local
I tried to include nvim.profile
but it doesn't seem to work. Any idea ?
In man.local I tried to include nvim.profile but it doesn't seem to work. Any idea ?
Yeah that won't work, but you're on the right track. You only need to cherrypick the nvim configuration paths and add those into man.local:
$ cat ~/.config/firejail/man.local
include allow-lua.inc
noblacklist ${HOME}/.vim
noblacklist ${HOME}/.vimrc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
What does that do?
Still no luck, the error is different and doesn't give much information unfortunately:
/usr/bin/man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page sendfile(2) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page sendfile(2) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$ MAN_PN=sendfile(2) nvim +Man!
Here's what my man.local
looks like:
private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim,nvim
include allow-lua.inc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.dotfiles/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
Is there a way to know exactly what is being denied ? I tried to use something like:
MANPAGER='nvim +Man!' firejail --allow-debuggers --profile=man strace /usr/bin/man sendfile
With no luck.
Here's the output of MANPAGER='nvim +Man!' firejail --debug /usr/bin/man sendfile
:
I tried to copy the whole nvim.profile
into man.local
and tweak it a bit:
private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim,nvim,strace
include allow-lua.inc
noblacklist ${HOME}/.vim
noblacklist ${HOME}/.vimrc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.dotfiles/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
include whitelist-runuser-common.inc
ipc-namespace
machine-id
net none
no3d
nodvd
nogroups
noinput
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6
seccomp
seccomp.block-secondary
tracelog
x11 none
private-dev
dbus-user none
dbus-system none
read-only ${HOME}/.config
read-only ${HOME}/.dotfiles
read-only ${HOME}/.dotfiles/.config
read-write ${HOME}/.config/nvim
read-write ${HOME}/.dotfiles/config/nvim
read-write ${HOME}/.local/share/nvim
read-write ${HOME}/.local/state/nvim
read-write ${HOME}/.vim
read-write ${HOME}/.vimrc
restrict-namespaces
Still the same error
@glitsj16 on Nov 30:
Yeah that won't work, but you're on the right track. You only need to cherrypick the nvim configuration paths and add those into man.local:
$ cat ~/.config/firejail/man.local include allow-lua.inc noblacklist ${HOME}/.vim noblacklist ${HOME}/.vimrc noblacklist ${HOME}/.cache/nvim noblacklist ${HOME}/.config/nvim noblacklist ${HOME}/.local/share/nvim noblacklist ${HOME}/.local/state/nvim whitelist /usr/share/nvim
What does that do?
I managed to get it working with the following in man.local:
ignore memory-deny-write-execute
# Allow lua (blacklisted by disable-interpreters.inc)
include allow-lua.inc
noblacklist ${HOME}/.vim
noblacklist ${HOME}/.vimrc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
read-write ${HOME}/.local/state/nvim
Note: The read-write
entry is only needed to avoid warnings.
@ShellCode33 Does that work for you?
Works like a charm, thanks a lot ! The key thing seems to be ignore memory-deny-write-execute
, I'd be glad to know why w+x memory is required though.
Small additional note, I had errors you apparently didn't have which seem to be related to my/your nvim config.
The first one I had to solve was related to nvim swap mechanism, I don't want them anyway so instead of changing the firejail profile, I disabled it in my nvim config:
vim.opt.swapfile = false
The second one I've been unable to solve for now is related to treesitter:
Error detected while processing User Autocommands for "VeryLazy":
Parser dir ' /home/shellcode/.local/share/nvim/lazy/nvim-treesitter/parser ' should be read/write (see README on how to configure an alternative install location) /home/shellcode/.local/share
/nvim/lazy/nvim-treesitter/parser '
I'm not sure why the write permission is required for ~/.local/share/nvim/lazy/nvim-treesitter/parser
as it only contains .so
files.
I tried to add read-write ${HOME}/.local/share/nvim/lazy/nvim-treesitter/parser
to man.local
but it doesn't work. Still the same error.
This is not an error that prevents me from reading the man page, but the warning is annoying:
@ShellCode33 on Nov 30:
Works like a charm, thanks a lot !
No problem.
The key thing seems to be
ignore memory-deny-write-execute
, I'd be glad to know why w+x memory is required though.
Probably for executing Vimscript, Lua, etc.
Small additional note, I had errors you apparently didn't have which seem to be related to my/your nvim config.
The first one I had to solve was related to nvim swap mechanism, I don't want them anyway so instead of changing the firejail profile, I disabled it in my nvim config:
vim.opt.swapfile = false
With the default configuration, if the swapfile and shada file are disabled in
the command line, then it should work without any read-write
entries:
MANPAGER='nvim -n -i NONE +Man!' firejail /usr/bin/man sendfile
The second one I've been unable to solve for now is related to treesitter:
Error detected while processing User Autocommands for "VeryLazy": Parser dir ' /home/shellcode/.local/share/nvim/lazy/nvim-treesitter/parser ' should be read/write (see README on how to configure an alternative install location) /home/shellcode/.local/share /nvim/lazy/nvim-treesitter/parser '
I tried to add
read-write ${HOME}/.local/share/nvim/lazy/nvim-treesitter/parser
toman.local
but it doesn't work. Still the same error.This is not an error that prevents me from reading the man page, but the warning is annoying:
Note that there are multiple read-only
nvim entries:
$ grep -R '^read-only .*nvim' /etc/firejail/
/etc/firejail/disable-common.inc:read-only ${HOME}/.config/nvim
/etc/firejail/disable-common.inc:read-only ${HOME}/.local/share/nvim
/etc/firejail/disable-common.inc:read-only ${HOME}/.local/state/nvim
In this case the read-write
command might need to match the existing
read-only
command:
read-write ${HOME}/.local/share/nvim
Thanks for your reply. I tried to add all these read-write statements but it doesn't seem to work. I think the issue might be that man.profile
first include man.local
and THEN include disable-common.inc
. Therefore the read-write directive is overridden by the read-only one. Any advice on how to workaround that ?
Thanks for your reply. I tried to add all these read-write statements but it doesn't seem to work. I think the issue might be that
man.profile
firstinclude man.local
and THENinclude disable-common.inc
. Therefore the read-write directive is overridden by the read-only one. Any advice on how to workaround that ?
Good catch; though the read-write
entries did remove the warnings when I was
testing, so maybe something changed in 0.9.73.
How about the following?
# ignore entries from disable-common.inc
ignore read-only ${HOME}/.local/share/nvim
ignore read-only ${HOME}/.local/state/nvim
# because of read-only ${HOME}
read-write ${HOME}/.local/share/nvim
read-write ${HOME}/.local/state/nvim
Nop still doesn't work :/
Here's what my man.local
looks like so far:
ignore memory-deny-write-execute
# Allow lua (blacklisted by disable-interpreters.inc)
include allow-lua.inc
noblacklist ${HOME}/.cache/nvim
noblacklist ${HOME}/.config/nvim
noblacklist ${HOME}/.local/share/nvim
noblacklist ${HOME}/.local/state/nvim
whitelist /usr/share/nvim
# ignore entries from disable-common.inc
ignore read-only ${HOME}/.local/share/nvim
ignore read-only ${HOME}/.local/state/nvim
read-write ${HOME}/.local/share/nvim
read-write ${HOME}/.local/state/nvim
restrict-namespaces
Nop still doesn't work :/
Is the error still about treesitter read/write?
What is the neovim and treesitter plugin version?
How is treesitter configured in neovim?
Does it still happen with firejail-git?
If you join the sandbox, what are the permissions in the treesitter directories?
Can you create files in them?
Example:
MANPAGER='nvim -n -i NONE +Man!' firejail --name=nvim /usr/bin/man sendfile
# in another shell
firejail --join=nvim
ls -l ~/.local/share/nvim/lazy/nvim-treesitter/parser
mkdir -p ~/.local/share/nvim/lazy/nvim-treesitter/parser
touch ~/.local/share/nvim/lazy/nvim-treesitter/parser/test
ls -l ~/.local/share/nvim/lazy/nvim-treesitter/parser
Is the error still about treesitter read/write?
Yes it is
What is the neovim and treesitter plugin version?
Neovim up to date with ArchLinux repo
$ nvim --version
NVIM v0.9.4
Build type: Release
LuaJIT 2.1.1700008891
I don't know what is the version of Treesitter but it is built into Neovim, so for reproducibility purposes, having neovim 0.9.4
would give the same Treesitter version.
However I use the nvim-treesitter plugin which - from what I understand - is a common interface for other plugins to build onto. And I'm on b41bbcb (almost the head). I might be wrong but I don't think this plugin is relevant.
How is treesitter configured in neovim?
I use LazyVim which configures it for me, its Treesitter configuration can be found here ("Full spec" must be selected)
My whole neovim config can be found here.
Does it still happen with firejail-git?
Yes it does, the exact same error
$ firejail --version
firejail version 0.9.73
Can you create files in them?
No
$ touch ~/.local/share/nvim/lazy/nvim-treesitter/parser/test
touch: cannot touch '/home/shellcode/.local/share/nvim/lazy/nvim-treesitter/parser/test': Read-only file system
Process tree in case that's useful:
shellco+ 9053 1.1 1.9 2765948 231148 ? Sl 19:13 0:36 /usr/bin/wezterm-gui
shellco+ 9060 0.0 0.0 14132 10396 pts/0 Ss 19:13 0:01 \_ /usr/bin/zsh
shellco+ 28999 0.0 0.0 4472 2816 pts/0 S+ 20:03 0:00 | \_ firejail /usr/bin/man sendfile
shellco+ 29000 0.0 0.0 6096 3304 pts/0 S+ 20:03 0:00 | \_ firejail /usr/bin/man sendfile
shellco+ 29013 0.0 0.0 8776 4416 pts/0 S+ 20:03 0:00 | \_ /usr/bin/man sendfile
shellco+ 29023 0.0 0.0 13720 8192 pts/0 Sl+ 20:03 0:00 | \_ nvim -n -i NONE +Man!
shellco+ 29029 0.7 0.2 29672 25088 ? Ssl 20:03 0:02 | \_ nvim --embed -n -i NONE +Man!
Note: my man.local
hasn't changed between my last comment and this one
Again, thanks a lot for your help
Description
I'm unable to use nvim as man pager.
Steps to Reproduce
Expected behavior
To show the man page.
Actual behavior
Behavior without a profile
Works fine.
Additional context
I tried to create a
man.local
with the following content with no luck (I'm not familiar at all with Firejail):(notice the
nvim
at the end of theprivate-bin
statement)Not sure it's relevant but just in case:
Environment
Checklist
/usr/bin/vlc
) "fixes" it).https://github.com/netblue30/firejail/issues/1139
)Log
Output of
LC_ALL=C firejail /path/to/program
``` See above ```
Output of
LC_ALL=C firejail --debug /path/to/program
``` Leaks a lot, I can send it in private if need be ```