{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/2137","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/2137/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/2137/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/2137/events","html_url":"https://github.com/netblue30/firejail/issues/2137","id":366951179,"node_id":"MDU6SXNzdWUzNjY5NTExNzk=","number":2137,"title":"Browser trouble - whitelisting ${HOME}-directories issue","user":{"login":"varfoer","id":43862301,"node_id":"MDQ6VXNlcjQzODYyMzAx","avatar_url":"https://avatars0.githubusercontent.com/u/43862301?v=4","gravatar_id":"","url":"https://api.github.com/users/varfoer","html_url":"https://github.com/varfoer","followers_url":"https://api.github.com/users/varfoer/followers","following_url":"https://api.github.com/users/varfoer/following{/other_user}","gists_url":"https://api.github.com/users/varfoer/gists{/gist_id}","starred_url":"https://api.github.com/users/varfoer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/varfoer/subscriptions","organizations_url":"https://api.github.com/users/varfoer/orgs","repos_url":"https://api.github.com/users/varfoer/repos","events_url":"https://api.github.com/users/varfoer/events{/privacy}","received_events_url":"https://api.github.com/users/varfoer/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-10-04T20:11:19Z","updated_at":"2018-10-05T18:43:37Z","closed_at":"2018-10-05T18:43:37Z","author_association":"NONE","body":"Hello,\r\nfor some days now Chromium as well as Firefox, Netsurf and Midori are not starting with firejail (guess I did an update). I am using the default profiles. Problem seems to be with whitelisting folders in the home-directory (.cache/, .config/ and Downloads/). Commenting those lines in the profile starts the Browsers (with complete access to the home-directory). `--noprofile` also works. This is the error-message I get:\r\n```Reading profile /etc/firejail/midori.profile\r\nReading profile /etc/firejail/disable-common.inc\r\nReading profile /etc/firejail/disable-devel.inc\r\nReading profile /etc/firejail/disable-interpreters.inc\r\nReading profile /etc/firejail/disable-programs.inc\r\nReading profile /etc/firejail/whitelist-common.inc\r\nParent pid 3573, child pid 3574\r\nError: invalid whitelist path /home/foo//Downloads\r\nError: proc 3573 cannot sync with peer: unexpected EOF\r\nPeer 3574 unexpectedly exited with status 1\r\n```\r\nSame error for Chroumium and Firefox with the `.cache/` and `.config/` dirs.\r\n`firejail --version` gives:\r\n```\r\nfirejail version 0.9.56\r\n\r\nCompile time support:\r\n\t- AppArmor support is disabled\r\n\t- AppImage support is enabled\r\n\t- chroot support is enabled\r\n\t- file and directory whitelisting support is enabled\r\n\t- file transfer support is enabled\r\n\t- networking support is enabled\r\n\t- overlayfs support is enabled\r\n\t- private-home support is enabled\r\n\t- seccomp-bpf support is enabled\r\n\t- user namespace support is enabled\r\n\t- X11 sandboxing support is enabled\r\n```\r\n`firejail --debug midori`:\r\n```\r\nReading profile /etc/firejail/midori.profile\r\nAutoselecting /bin/zsh as shell\r\nBuilding quoted command line: 'midori' \r\nCommand name #midori#\r\nFound midori profile in /etc/firejail directory\r\nReading profile /etc/firejail/disable-common.inc\r\nReading profile /etc/firejail/disable-devel.inc\r\nReading profile /etc/firejail/disable-interpreters.inc\r\nReading profile /etc/firejail/disable-programs.inc\r\nReading profile /etc/firejail/whitelist-common.inc\r\nDISPLAY=:0 parsed as 0\r\nParent pid 6849, child pid 6850\r\nUsing the local network stack\r\nDebug 405: new_name #/home/foo//Downloads#, whitelist\r\nDebug 505: fname #/home/foo/Downloads#, cfg.homedir #/home/foo/#\r\nError: invalid whitelist path /home/foo//Downloads\r\nUsing the local network stack\r\nInitializing child process\r\nPID namespace installed\r\nMounting tmpfs on /run/firejail/mnt directory\r\nCreating empty /run/firejail/mnt/seccomp.protocol file\r\nCreating empty /run/firejail/mnt/seccomp.postexec file\r\nBuild protocol filter: unix,inet,inet6,netlink\r\nsbox run: /usr/lib/firejail/fseccomp protocol build unix,inet,inet6,netlink /run/firejail/mnt/seccomp.protocol (null) \r\nMounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var\r\nMounting tmpfs on /var/lock\r\nMounting tmpfs on /var/tmp\r\nMounting tmpfs on /var/log\r\nCreate the new utmp file\r\nMount the new utmp file\r\nCleaning /home directory\r\nSanitizing /etc/passwd, UID_MIN 1000\r\nSanitizing /etc/group, GID_MIN 1000\r\nDisable /run/firejail/network\r\nDisable /run/firejail/bandwidth\r\nDisable /run/firejail/name\r\nDisable /run/firejail/x11\r\nRemounting /proc and /proc/sys filesystems\r\nRemounting /sys directory\r\nDisable /sys/firmware\r\nDisable /sys/hypervisor\r\nDisable /sys/power\r\nDisable /sys/kernel/debug\r\nDisable /sys/kernel/vmcoreinfo\r\nDisable /proc/sys/fs/binfmt_misc\r\nDisable /proc/sys/kernel/core_pattern\r\nDisable /proc/sys/kernel/modprobe\r\nDisable /proc/sysrq-trigger\r\nDisable /proc/sys/vm/panic_on_oom\r\nDisable /proc/irq\r\nDisable /proc/bus\r\nDisable /proc/config.gz\r\nDisable /proc/sched_debug\r\nDisable /proc/timer_list\r\nDisable /proc/kcore\r\nDisable /proc/kallsyms\r\nDisable /usr/lib/modules (requested /lib/modules)\r\nDisable /boot\r\nDisable /dev/port\r\nDisable /run/user/1000/gnupg\r\nDisable /run/user/1000/systemd\r\nDisable /dev/kmsg\r\nDisable /proc/kmsg\r\nDisable /mnt\r\nDisable /run/mount\r\nDirectory ${DOWNLOADS} resolved as Downloads\r\nError: proc 6849 cannot sync with peer: unexpected EOF\r\nPeer 6850 unexpectedly exited with status 1\r\n```\r\n**OS:** Arch\r\nMany thanks!"},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/427462615","html_url":"https://github.com/netblue30/firejail/issues/2137#issuecomment-427462615","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/2137","id":427462615,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzQ2MjYxNQ==","user":{"login":"varfoer","id":43862301,"node_id":"MDQ6VXNlcjQzODYyMzAx","avatar_url":"https://avatars0.githubusercontent.com/u/43862301?v=4","gravatar_id":"","url":"https://api.github.com/users/varfoer","html_url":"https://github.com/varfoer","followers_url":"https://api.github.com/users/varfoer/followers","following_url":"https://api.github.com/users/varfoer/following{/other_user}","gists_url":"https://api.github.com/users/varfoer/gists{/gist_id}","starred_url":"https://api.github.com/users/varfoer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/varfoer/subscriptions","organizations_url":"https://api.github.com/users/varfoer/orgs","repos_url":"https://api.github.com/users/varfoer/repos","events_url":"https://api.github.com/users/varfoer/events{/privacy}","received_events_url":"https://api.github.com/users/varfoer/received_events","type":"User","site_admin":false},"created_at":"2018-10-05T18:43:37Z","updated_at":"2018-10-05T18:43:37Z","author_association":"NONE","body":"> If there is a trailing `/`, removing it should fix this issue. Maybe this was also the background of #2123.\r\n\r\nDamn, that really did it. Thanks for this. I have already been on that but seems it was not enough effort (\"double slashes work in bash-scripts, why should it be any different here\" I thought...). Anyways, thanks and closed!"}}
{"actor":{"display_login":"varfoer"}}