Fails to sandbox an app

[netblue30]

Fails to sandbox an app

[rusty-snake]

Issue can be closed.

[rusty-snake]

How do you start it? How do you detect that it is not running in firejail?

What shows firejail --tree | grep clipgrab after starting clipgrab?

[DurtyDev]

On Wed, Jan 22, 2020, 8:36 AM rusty-snake ***@***.***> wrote: How do you start it? How do you detect that it is not running in firejail? —

I start try to start it like I would any other app. I choose the app from a list as it doesn't have a predefined rule like Gimp and Firefox do. Only when I choose the app image firetools promptly informs me that the image isn't executable. ( I luauched Clipgrab 3 times hoping the system would catch on. ) I even resorted to command line sudo firejail clipgrab , sudo this sudo that. Nothing worked. I wanted that app in jail as when I attempted to close Clipgrab it went right to my system tray were it stayed while I opened my tasker to see 86 threads and 302 mb memory and fkill it. I played with the apps all night. Clipgrab works but weather you give it permission by checking the box or not it goes right to sys tray. I emailed the dev on that also as a former Windows user apps that force themselves in to the tray usually have bad intentions. If you would like to video conference to see I would be more than happy.

…

[rusty-snake]

I just tried with firejail git-master, Fedora 31, ClipGrab 3.8.9 and the following firejail profile (firejail 0.9.62+).

clipgrab.profile

# Firejail profile for clipgrab
# Description: DESCRIPTION
# This file is overwritten after every install/update
# Persistent local customizations
include clipgrab.local
# Persistent global definitions
#include globals.local

noblacklist ${HOME}/.config/Philipp Schmieder
noblacklist ${HOME}/.pki
noblacklist ${VIDEOS}

include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc

include whitelist-usr-share-common.inc
include whitelist-var-common.inc

apparmor
caps.drop all
machine-id
netfilter
nodbus
nodvd
nogroups
nonewprivs
noroot
nosound
notv
nou2f
novideo
protocol unix,inet,inet6,netlink
seccomp !chroot
shell none

disable-mnt
private-cache
private-dev
private-tmp

• nodbus will break the tray function.
• seccomp blocks chroot (syscall, not program) which is needed by QtWebengie. You will have something like … SECCOMP … comm="QtWebEngineProc" exe="/usr/lib64/qt5/libexec/QtWebEngineProcess" sig=31 arch=c000003e syscall=161 … in your journal.

Solutions: Allow chroot by not using seccomp or adding an exception (firejail 0.9.62)/using seccomp.drop (firejail <0.9.62).

[DurtyDev]

Thanks I'm fixing to give that a try. That's why I'm not a dev. I can't write a lick of code. I can build a sweet website. Thanks 😊 I'm fixing to see if it works. Hat's off to you. I still haven't heard from the dev of the offending app. I will let you know the outcome .

…

On Wed, Jan 22, 2020, 9:46 AM rusty-snake ***@***.***> wrote: I just tried with firejail git-master, Fedora 31, ClipGrab 3.8.9 and the following firejail profile (firejail 0.9.62+). clipgrab.profile # Firejail profile for clipgrab # Description: DESCRIPTION # This file is overwritten after every install/update # Persistent local customizations include clipgrab.local # Persistent global definitions #include globals.local noblacklist ${HOME}/.config/Philipp Schmieder noblacklist ${HOME}/.pki noblacklist ${VIDEOS} include disable-common.inc include disable-devel.inc include disable-exec.inc include disable-interpreters.inc include disable-passwdmgr.inc include disable-programs.inc include disable-xdg.inc include whitelist-usr-share-common.inc include whitelist-var-common.inc apparmor caps.drop all machine-id netfilter nodbus nodvd nogroups nonewprivs noroot nosound notv nou2f novideo protocol unix,inet,inet6,netlink seccomp !chroot shell none disable-mnt private-cache private-dev private-tmp - nodbus will break the tray function. - seccomp blocks chroot (syscall, not program) which is needed by QtWebengie. You will have something like … SECCOMP … comm="QtWebEngineProc" exe="/usr/lib64/qt5/libexec/QtWebEngineProcess" sig=31 arch=c000003e syscall=161 … in your journal. *Solutions:* Allow chroot by not using seccomp or adding an exception (firejail 0.9.62)/using seccomp.drop (firejail <0.9.62). — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#47?email_source=notifications&email_token=AOERGYEKN757XF56UWHHP5TQ7BL43A5CNFSM4KJ2HTPKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEJTZQTY#issuecomment-577214543>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOERGYDGI5N6TVRHP2R27ULQ7BL43ANCNFSM4KJ2HTPA> .

[rusty-snake]

If this profile works for you I can bring it upstream.

[DurtyDev]

It works on my end. Manjaro KDE desktop. Thank you. Sorry it took so long. I'm a night owl 🦉. The dev from Clipgrab messaged me saying that my window manager was the problem. 👀🧐 Nahhhh. Lol

…

On Wed, Jan 22, 2020, 10:03 AM rusty-snake ***@***.***> wrote: If this profile works for you I can bring it upstream. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#47?email_source=notifications&email_token=AOERGYA7LUBVMXFTESCTJTLQ7BN53A5CNFSM4KJ2HTPKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEJT4WQY#issuecomment-577227587>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AOERGYF6WEMSBUAEH53ZKK3Q7BN53ANCNFSM4KJ2HTPA> .

[DurtyDev]

The response I got from Clipgrab. Wow.

…

---------- Forwarded message --------- From: Joe Durt <[email protected]> Date: Wed, Jan 22, 2020, 5:14 PM Subject: Fwd: Clipgrab Permissions To: <[email protected]>

---------- Forwarded message --------- From: Joe Durt <[email protected]> Date: Wed, Jan 22, 2020, 5:13 PM Subject: Re: Clipgrab Permissions To: Philipp from ClipGrab <[email protected]> Bro , it sits in the sys tray with 86 background threads and you haveto fkill it...It refused firejail sandbox. I have no problem removing or closing any other app in the system tray. Sir wish all due respect , while the program does download and convert like it says , it's not supposed to refuse being closed out, or sandboxing On Wed, Jan 22, 2020, 4:57 PM Philipp from ClipGrab <[email protected]> wrote:

Hey Joe, this is odd … ClipGrab is just using the regular systray features provided by Qt … All the best Philipp On 22.01.20 22:54, Joe Durt wrote: > Manjaro KDE . It's not my window manager. I even tried to make rules to > no . Firejail dev came up with a way to jail the app and keep it out of > the tray > > On Wed, Jan 22, 2020, 4:42 PM Philipp from ClipGrab > ***@***.*** ***@***.***>> wrote: > > Hey there, > > thank you for your message. > > This sounds like an issue with the window manager you’re using. May I > ask which system you’re on? > > All the best > Philipp > > On 22.01.20 07:19, Joe Durt wrote: > > First off I would like to say that clipgrab works like a charm. does > > what it says. Fast too. > > That being said. There is one major issue. Whether you check the > box or > > not it minimizes to the system tray from whence it refuses to close > > unless you open a shell and fkill it. > > I tried containing the app in Firejail sandbox to no avail. With 86 > > threads running in the background its not something to leave > sitting in > > the sys tray . > > respectfully > > Cheif > > -- > ClipGrab is an Open Source project and only made possible by the kind > support of users like you. If you would like to make a one-time donation > via PayPal, credit card or wire transfer, you can find more information > on https://clipgrab.org/donate > > ClipGrab is brought to you by Philipp Schmieder Medien, Hauptstraße 10, > 95517 Seybothenreuth, Germany, VAT Reg No: DE815236863, [phone] > -- ClipGrab is an Open Source project and only made possible by the kind support of users like you. If you would like to make a one-time donation via PayPal, credit card or wire transfer, you can find more information on https://clipgrab.org/donate ClipGrab is brought to you by Philipp Schmieder Medien, Hauptstraße 10, 95517 Seybothenreuth, Germany, VAT Reg No: DE815236863, [phone]