On 2019-01-29 01:12:36 +0100, Reiner Herrmann wrote:
> Can you maybe change your startup script to check that no firejail with
> your intended name ("firefox") is already running (or wait until it's
> terminated)?
This is what I eventually did, while it was actually more complex,
because when there's an existing sandbox, the script must still
open a URL in the running Firefox.
Now, there's still an issue:
zira:~> firejail --list
4207:vinc17:firefox:/usr/bin/firejail --quiet --name=firefox
--env=BROWSER=firefox-esr firefox-esr
4701:vinc17::/usr/bin/firejail --quiet --join=firefox firefox-esr
but...
zira:~> firejail --join=firefox true
Switching to pid 4223, the first child process inside the sandbox
Error: no valid sandbox
zsh: exit 1 firejail --join=firefox true
zira:~> firejail --debug --join=firefox true
Building quoted command line: 'true'
Extracted command #'true' #
Switching to pid 4223, the first child process inside the sandbox
Error: no valid sandbox
zsh: exit 1 firejail --debug --join=firefox true
zira:~> ps -fC firejail
UID PID PPID C STIME TTY TIME CMD
vinc17 4207 4206 0 02:33 ? 00:00:00 /usr/bin/firejail --quiet
--name=firefox --env=BROWSER=firefox-esr firefox-esr
vinc17 4223 4207 0 02:33 ? 00:00:00 /usr/bin/firejail --quiet
--name=firefox --env=BROWSER=firefox-esr firefox-esr
root 4701 4700 0 02:34 ? 00:00:00 /usr/bin/firejail --quiet
--join=firefox firefox-esr
What is this root process???
Concerning the processes related to firejail:
vinc17 │ ├─> 4206 /bin/sh -c firefox --start
vinc17 │ │ └─> 4207 /usr/bin/firejail --quiet --name=firefox
--env=BROWSER=firefox-esr firefox-esr
vinc17 │ │ └─> 4223 /usr/bin/firejail --quiet --name=firefox
--env=BROWSER=firefox-esr firefox-esr
vinc17 │ ├─> 4700 /bin/sh -c firefox --start
root │ │ └─> 4701 /usr/bin/firejail --quiet --join=firefox
firefox-esr
vinc17 │ │ └─> 4717 firefox-esr
firejail seems to be affected by a race condition.
FYI, my current firefox script:
------------------------------------------------------------------------
#!/usr/bin/env zsh
opt=join
unset env
if [[ $1 == --start ]] then
shift
firejail --list | grep -q '^[^:]*:[^:]*:firefox:'
if [[ $pipestatus == "0 1" ]] then
opt=name
env="--env=BROWSER=firefox-esr"
fi
fi
exec /usr/bin/firejail --quiet --$opt=firefox $env firefox-esr "$@"
------------------------------------------------------------------------
--
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
