Show tray icons doesn’t work

[Anonymous]

Helpful

Up

0

::

the following AppArmor libraries are installed, when I installed Firejail. May be they are dependencies.

Don’t settle for maybe. You can view the dependencies from commandline, or from within synaptic package manager UI…
or, for any package supplied from debian repository, you can view package details online.
(details: dependencies, list of installed files, links to pkg bug reporting page, etc)
https://packages.debian.org/buster/firejail

In this case, we can see the firejail package depends on “libapparmor1”
and that libapparmor1 would have installed (only) these 2 files:
/lib/x86_64-linux-gnu/libapparmor.so.1
/lib/x86_64-linux-gnu/libapparmor.so.1.6.0
ref: https://packages.debian.org/buster/amd64/libapparmor1/filelist
FWIW, I don’t expect that the presence of these on the system would be causing any problem(s).

$sudo service –status-all
Is apparmor listed in the output? (probably not, but worth checking as a troubleshooting step)

[[[ during shutdown ]]]
Startpar: Services returned failure … apparmor failed

$sudo grep -inr apparmor /etc
If any matches are returned, use nano (or vim, or leafpad or) to inspect the content of the affected files.
(we can probably ignore /etc/init/network-interface-security.conf ~~ it mentions apparmor by default)
?somewhere along the way, some installer may have modified /etc/rc.local or /etc/init.d/rc.local or /etc/rc2.d/S0*rc.local or…)

[Member anilkagi]

Helpful

Up

0

::

Thanks Skidoo,

You have opened up a new world before me. I have never filed a bug report before, never occurred to me as to how to check dependencies. Is the debian.org, ‘Other Packages Related to any-package’ exhaustive? I thought it just gives some main or important dependency list. What actually is the method to find all the dependencies of a package.

I had been pushing aside studying ‘grep’ for a while. You get busy with some more important things at hand that you keep pushing aside other things for later and one day that other thing becomes so important that you have to study it before you do important things at hand. I read about grep now. It is a nice command.

I will go through all the troubleshooting steps you suggested first, before discussing on filing a bug report.

Thanks a lot for trying to help me troubleshoot my issue, Skidoo, and for all the information that you gave. This is education.

I’ll report back after going through all the steps.

[Anonymous]

Helpful

Up

0

::

What actually is the method to find all the dependencies of a package.

replied here: https://www.antixforum.com/forums/topic/how-to-find-allall-depdencies-of-a-package/

[Member Xecure]

Helpful

Up

0

::

I think we need to go way back, instead oif continue with wrong assumptions.

My experience:
From installed system (antiX 19 base), launching clipit from the terminal doesn’t launch firejail at all. (clipit works)
From live antiX 19.2.1 base, launching clipit from the terminal doesn’t launch firejail at all. (clipit works)
From frugal antiX 19.2 full, launching clipit from the terminal doesn’t launch firejail at all. (clipit works)

My conclusion: We were assuming that your frugal install had no modifications, but we are probably wrong.

Are you launching antiX entirely inside a firejail x11 new instance? Are you using firejail in any other application that lanches at boot? Have you changed firejail or the system in any special way?
If the answer to all these questions is NO, then clipit configuration has changed somehow and it is calling firejail without your permission. You could purge it, delete the ~/.config/clipit folder and reinstall it again.

sudo apt purge clipit
rm -r ~/.config/clipit
sudo apt update && sudo apt install clipit

Then, launch clipit from the terminal and see if the issue persist. if it does, then we will have to explore different paths to resolve the connection between clipit and firejail.

antiX Live system enthusiast.
General Live Boot Parameters for antiX.

[Member anilkagi]

Helpful

Up

0

::

Hello there,

The issue is partially solved.

I blindly threw a handful of stones taking suggestions from the web on the errors I was getting and some hit the target. Now you guys need to elaborate on, what had happened and how things got resolved.

What I did was;

Installed apparmor, apparmor-profiles, because the terminal was asking me to ‘aa-enforce’ and when I gave the command, it returned, ‘command not found’. Also there was an error regarding ‘apparmor-profiles’.

Then removed firecfg with the following command, because I was repeatedly getting the error like “the application is already sandboxed” when I used to issue the command ‘firejail firefox’.

sudo firecfg --clean

Next gave the following comannd;

sudo aa-enforce firejail-default

As this was suggested by the terminal.

Next I took suggestion from the web to reload AppArmor.

sudo service apparmor reload

Then remastered.

By this the “AppArmor service failed” error disappeared while shutting down.

And then I could also start, virtuabox in firejail without any errors.

I checked with;

firejail --list

and

firejail --top

Both show VB to be running in Firejail.

Further, now both Clipit and Connman are showing in the tray.

However, I cannot run FF & Chromium in Firejail.

For firefox I get the following error;

$ firejail firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 24451, child pid 24452
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Post-exec seccomp protector enabled
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 121.43 ms

Parent is shutting down, bye...

And for Chromium I get the following error;

$ firejail chromium
Reading profile /etc/firejail/chromium.profile
Reading profile /etc/firejail/chromium-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 24592, child pid 24595
Child process initialized in 100.65 ms
[6:6:0905/195127.996048:ERROR:browser_dm_token_storage_linux.cc(100)] Error: /etc/machine-id contains 0 characters (32 were expected).
[6:39:0905/195127.998875:ERROR:zygote_host_impl_linux.cc(261)] Failed to adjust OOM score of renderer with pid 43: Permission denied (13)
[6:35:0905/195128.019826:ERROR:database.cc(1632)] History sqlite error 8, errno 0: attempt to write a readonly database, sql: DELETE FROM meta WHERE key=?
[6:41:0905/195128.035832:ERROR:bus.cc(393)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[6:41:0905/195128.035901:ERROR:bus.cc(393)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[43:43:0905/195128.082187:ERROR:sandbox_linux.cc(374)] InitializeSandbox() called with multiple threads in process gpu-process.
[6:41:0905/195128.198344:ERROR:bus.cc(393)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[6:41:0905/195128.198411:ERROR:bus.cc(393)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[6:39:0905/195128.248059:ERROR:zygote_host_impl_linux.cc(261)] Failed to adjust OOM score of renderer with pid 70: Permission denied (13)
[6:39:0905/195128.260037:ERROR:zygote_host_impl_linux.cc(261)] Failed to adjust OOM score of renderer with pid 71: Permission denied (13)
[6:94:0905/195128.412024:ERROR:object_proxy.cc(632)] Failed to call method: org.freedesktop.DBus.Properties.Get: object_path= /org/freedesktop/UPower: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.UPower was not provided by any .service files
[6:94:0905/195128.412317:ERROR:object_proxy.cc(632)] Failed to call method: org.freedesktop.UPower.GetDisplayDevice: object_path= /org/freedesktop/UPower: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.UPower was not provided by any .service files
[6:94:0905/195128.412844:ERROR:object_proxy.cc(632)] Failed to call method: org.freedesktop.UPower.EnumerateDevices: object_path= /org/freedesktop/UPower: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.UPower was not provided by any .service files
[6:39:0905/195128.428306:ERROR:zygote_host_impl_linux.cc(261)] Failed to adjust OOM score of renderer with pid 96: Permission denied (13)
[6:39:0905/195129.289058:ERROR:zygote_host_impl_linux.cc(261)] Failed to adjust OOM score of renderer with pid 112: Permission denied (13)
[6:39:0905/195129.521108:ERROR:zygote_host_impl_linux.cc(261)] Failed to adjust OOM score of renderer with pid 116: Permission denied (13)

I think I should start a new thread to seek answers to these errors because the topic of this thread is regarding “Showing Clipit & Connman in the tray”. AppArmor was connected to this issue but the issue of running FF & Chromium in Firejail is not related to this thread.

Thanks, everybody for being with me, specially @Skidoo and @Xecure for your persistent efforts to troubleshoot the issue. Love you guys.

[Member anilkagi]

Helpful

Up

0

::

Xecure,

Xecure wrote:

the connection between clipit and firejail

Since the issue got resolved by making changes to AppArmor, I suppose they were connected.

Xecure wrote:

Are you launching antiX entirely inside a firejail x11 new instance? Are you using firejail in any other application that lanches at boot?

AFAIK, no, but how do I figure out?

Xecure wrote:

Have you changed firejail or the system in any special way?

I don’t think so.

I would appreciate, if you can analyze now, what could have happened. I need you to analyze, if I have messed up with my system. I would appreciate any elaboration regarding this.

Thank you.

[Anonymous]

Helpful

Up

0

::

When you install apparmor, its installation sets a default policy configuration (application profiles).
You may not (probably will not) wish keep all of the as-shipped settings.
https://wiki.debian.org/AppArmor/HowToUse
I haven’t often used apparmor, so cannot offer further coaching on this.

“this is education”
AppArmor administration is not trivial. For example:
https://www.lynda.com/Linux-tutorials/AppArmor/618702/802563-4.html
^— this is described as a 12hour long course.

apparmor… firejail… virtualbox

Virtualbox running under firejail? Nope, I have never tried that & can’t guess whatall might go awry in that scenario. When mix-n-matching redundant layers of isolation, it’s important to keep careful notes describing steps taken. If you have not kept adequate notes (which seems to be the case), my “compassionate” recommendation now is: abandon the wrecked system, reinstall.

[Member anilkagi]

Helpful

Up

0

::

Thanks for your post Skidoo, this is the reason why requested elaboration.

Anonymous wrote:

When you install apparmor

I don’t use AA. I don’t even know how and why it is used. Is it a system program to harden the system or an user program like an anti-virus? The AA wiki says;

AppArmor is a Mandatory Access Control (MAC) system which is a kernel (LSM) enhancement to confine programs to a limited set of resources. 

So may be it is a system program. I read this on HowToGeek;

AppArmor is an important security feature that’s been included by default with Ubuntu since Ubuntu 7.10. However, it runs silently in the background, so you may not be aware of what it is and what it’s doing.

Installing AppArmor (AA), was not my personal necessity. It is certain now that Firejail (FJ) needs AA as a dependency. Without AA, FJ cannot function. However, before this episode, I thought, FJ just needs some libraries of AA. This not so. Proper functioning of FJ needs the entire AA, AA-utils, AA-profiles and all its dependencies. So FJ holds that AA is installed.

Thanks for the link on AA, Skidoo.

AFAIK, the culprit here seemed to be ‘firecfg’. It sets system-wide sandboxing for all the apps. This is probably what happened in my case. Mostly the Clipit app was being sandboxed when startup launched it, so was being held back. Cleaning ‘firecfg’, released it. Is that possible?

Anonymous wrote:

If you have not kept adequate notes (which seems to be the case), my “compassionate” recommendation now is: abandon the wrecked system, reinstall.

🙂

Thanks for your compassionate recommendation.

Skidoo, even I was thinking on those terms. However, the beauty of Frugal-Install (I can’t thank @Olsztyn enough, for initiating me into Frugal install.), is that whatever you do to your system, how much ever you may wreck it, it won’t affect, unless you remaster it.

What I am doing here is I have kept a copy of the good working Linuxfs in another partition, whenever there is an issue, I tweak the system and remaster and study the effects and when I am totally satisfied that the issue is resolved and I have one final set of steps to carry out, to resolve the issue, I discard the Linuxfs and then replace it with the previous working Linuxfs and carry out all the remedial steps and remaster. By this way, I don’t have to start from scratch. I have even kept copies of remastered Linuxfs, at different stages of customizations. I can restart from any stage. Frugal is a beauty. Hope I am not going off topic. I will talk about it later.

[Member Xecure]

Helpful

Up

0

::

Having VBox running over firejail is waaaaaaaay out of my league. If launching a browser inside the frugal VM, better only load it normally, as I am not sure how fijail inside VM inside firejail may work.

What you are doing here is probably uncharted territory. I don’t know if anyone here has any experience with this.

For sure, troubleshooting will be a nightmare.

antiX Live system enthusiast.
General Live Boot Parameters for antiX.

[Member anilkagi]

Helpful

Up

0

::

Xecure,

It is VM inside firejail inside frugal install.

I wish to install GSconnect in the VM. Launch the VB in firejail. Connect the GSconnect in VM to KDEconnect in my Android phone.

I understand it is complex. I want to give it a try.

[Author]

Posts