Why does firejail block multiple invocations of librewolf?

[crocket]

Because librewolf is a distribution of firefox, this issue applies to firefox as well.

My bookmark manager opens each of multiple chosen bookmarks with an invocation of librewolf --new-tab URL. Thus, it calls librewolf --new-tab URL multiple times simultaneously if I try to open multiple bookmarks in the bookmark manager.

This librewolf.local allows me to open one new tab at a time.

dbus-user.own org.mozilla.librewolf.*

# enable native notifications
dbus-user.talk org.freedesktop.Notifications

# Allow disabling screensaver
dbus-user.talk org.freedesktop.ScreenSaver

# screensharing under wayland
whitelist ${RUNUSER}/pipewire-0
whitelist /usr/share/pipewire/client.conf
dbus-user.talk org.freedesktop.portal.*

But, if I try to open several new tabs at a time, librewolf becomes unresponsive and quits with an error after a while. This is the error.

LibreWolf is already running, but is not responding. To use LibreWolf, you must first close the existing LibreWolf process, restart your device, or use a different profile.

If I don't sandbox librewolf with firejail, there is no error when opening multiple new librewolf tabs at once.

Disabling dbus filter in a sandbox doesn't fix the issue. Is there anything else that I have to whitelist?

[kmk3]

@crocket on Sep 13:

Because librewolf is a distribution of firefox, this issue applies to firefox
as well.

My bookmark manager opens each of multiple chosen bookmarks with an
invocation of librewolf --new-tab URL. Thus, it calls librewolf --new-tab URL multiple times simultaneously if I try to open multiple bookmarks in the
bookmark manager.

[...]

But, if I try to open several new tabs at a time, librewolf becomes
unresponsive and quits with an error after a while. This is the error.

LibreWolf is already running, but is not responding. To use LibreWolf, you must first close the existing LibreWolf process, restart your device, or use a different profile.

If I don't sandbox librewolf with firejail, there is no error when opening
multiple new librewolf tabs at once.

Disabling dbus filter in a sandbox doesn't fix the issue. Is there anything
else that I have to whitelist?

Does the following help?

--join-or-start=name
      Join the sandbox identified by name or start a new one.  Same as
      "firejail --join=name" if sandbox with specified name exists, otherwise
      same as "firejail --name=name ..." Note that in contrary to other join
      options there is respective profile option.

Example:

firejail --join-or-start=librewolf123 librewolf --new-tab URL

Note: If you have multiple librewolf profiles, you can use a different sandbox
name for each one.

[crocket]

An existing librewolf instance gets new tab URLs on org.mozilla.librewolf.PROFILE-ID. Thus, DBus is necessary for using librewolf with bookmark manager.

[rusty-snake]

Firefox uses D-Bus (org.mozilla.<PROGRAM>.Base64(<PROFILE-NAME>)) as IPC backend if it is a native Wayland client. If it is a native X11 client, it uses some X11 magic based IPC.

https://searchfox.org/mozilla-central/source/toolkit/components/remote

[crocket]

For now, I have

ignore dbus-user
ignore private-tmp

in librewolf.local as a workaround.

[crocket]

I think --join-or-start=librewolf shouldn't create librewolf-PID sandboxes if multiple instances of librewolf are trying to start simultaneously, but if I wanted to work around the issue, I may create firejail-named-sandbox.

firejail-named-sandbox sandbox-name arguments-to-firejail...

This accepts commands on $XDG_RUNTIME_DIR/firejail-named-sandbox and sequentially processes firejail commands.

If there is no named sandbox, it creates one. If there is already the specified named sandbox, it joins the named sandbox.

[rusty-snake]

I think --join-or-start=librewolf shouldn't create librewolf-PID sandboxes if multiple instances of librewolf are trying to start simultaneously

https://github.com/netblue30/firejail/issues/new

Maybe follow https://github.com/netblue30/firejail/blob/7b3cd31cfe77d5c4083ba38291567ea48effb1cb/.github/ISSUE_TEMPLATE/feature_request.md (not merged yet).

[rusty-snake]

I can not reproduce this using

i=0; while [[ $((i++)) -lt 100 ]]; do firefox --new-tab about:blank; done

but I can reproduce it using

firefox --new-tab about:blank & firefox --new-tab about:blank & firefox --new-tab about:blank & firefox --new-tab about:blank & firefox --new-tab about:blank & firefox --new-tab about:blank & firefox --new-tab about:blank & firefox --new-tab about:blank
# or
cmd=(firefox --new-tab about:blank); ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]}

For me this looks like a deadlock, maybe caused by a race condition or broken/missing synchronization.

---

I can not reproduce this using

$ bwrap --dev-bind / / --tmpfs $HOME --unshare-all /bin/bash
% /usr/bin/firefox >/dev/null 2>/dev/null & { sleep 20s; cmd=(/usr/bin/firefox --new-tab about:blank); ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]}; }
# or
$ firejail --noprofile --private
% /usr/bin/firefox >/dev/null 2>/dev/null & { sleep 20s; cmd=(/usr/bin/firefox --new-tab about:blank); ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]} & ${cmd[@]}; }

[crocket]

This discussion is moved to #4543

[kmk3]

@crocket on Sep 13:

dbus-user.own org.mozilla.librewolf.*

Could you open a PR to add this to librewolf.profile?

[rusty-snake]

FWIW: I've it already in my local list with profile fixes.

[crocket]

@rusty-snake Will you submit the PR?

[crocket]

I submitted the PR.

[kmk3]

Link for reference: #4546