glitsj16
commented
5 months ago Relevant /etc/sysctl.d/99-userns.conf that might be responsible for the Issue
Is this a file installed by your OS? Or did you add it yourself? Also, please add your OS and firejail version to the report.
For now I see a few ways to try to get chromium to work as expected. Please test the below chromium-common.local overrides one by one and report back the result of each attempt.
- test 1 [use the dedicated AppArmor profile created by user]
$ cat ~/.config/firejail/chromium-common.local
apparmor /usr/bin/chromium- test 2 [disable apparmor]
$ cat ~/.config/firejail/chromium-common.local
ignore apparmor- test 3 [allow userns_create capability]
$ cat ~/.config/firejail/chromium-common.local
caps.keep sys_admin,sys_chroot,userns_create
ignore caps.keep
luckylinux
gcqmkm02
Description
Trying to run Chromium results in a AppArmor "DENIED" Message in
dmesg.Steps to Reproduce
Run in BASH
firejail /usr/bin/chromium. Result:I also tried to add a Custom AppArmor Profile in
/etc/apparmor.d/chromiumand Issueingsystemctl restart apparmorbut this does NOT solve the Issue:Expected behavior
Chromium starting normally.
Actual behavior
Chromium refuses to start.
Behavior without a profile
_What changed calling
LC_ALL=C firejail --noprofile /path/to/programin a terminal?_It actually works (or at least starts ...)
Additional context
Any other detail that may help to understand/debug the problem
Relevant
/etc/sysctl.d/99-userns.confthat might be responsible for the Issue:Relevant
dmesgOutput:Environment
Compile time support:
Package: firejail
Version: 0.9.72-2ubuntu3 State: installed Automatically installed: no Priority: optional Section: universe/utils Maintainer: Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com Architecture: amd64 Uncompressed Size: 1.675 k Depends: libapparmor1 (>= 2.10.95), libc6 (>= 2.38), libselinux1 (>= 3.1~) Recommends: firejail-profiles, iproute2, iptables, xauth, xdg-dbus-proxy, xpra | xserver-xephyr | xvfb Conflicts: firejail:i386 Description: sandbox to restrict the application environment Firejail is a SUID security sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table. Homepage: https://firejail.wordpress.com Tags: implemented-in::c, interface::commandline, role::program, scope::utility, security::privacy, use::filtering, works-with::software:running
Package: firejail-profiles
Version: 0.9.72-2ubuntu3 State: installed Automatically installed: no Priority: optional Section: universe/utils Maintainer: Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com Architecture: all Uncompressed Size: 1.708 k Depends: firejail Breaks: firejail (< 0.9.46~rc1-1), firejail:i386 (< 0.9.46~rc1-1) Replaces: firejail (< 0.9.46~rc1-1), firejail:i386 (< 0.9.46~rc1-1) Description: profiles for the firejail application sandbox Firejail is a SUID security sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces and seccomp-bpf. It allows a process and all its descendants to have their own private view of the globally shared kernel resources, such as the network stack, process table, mount table.
This package contains firejail profiles for various applications. Homepage: https://firejail.wordpress.com Tags: role::app-data
output goes here
output goes here