thunderbird: cannot open links in Firefox: "Your Firefox profile cannot be loaded"

[rsramkis]

Bug

When opening a web link in an e-mail in Thunderbird, Firefox attempts to launch but then reports the error "Your Firefox profile cannot be loaded. It may be missing or inaccessible."

Steps:

1. Open Thunderbird.
2. Open E-mail.
3. Click on weblink in e-mail.
4. Firefox error message shows "Your Firefox profile cannot be loaded. It may be missing or inaccessible.".

Expected Behavior
The previous behavior with firejail enabled (sudo firecfg) a web link in a Thunderbird e-mail would open a new instances of Firefox with a new user profile (none of my bookmarks showing'.

Environment
Kernel: 5.4.74-1-MANJARO x86_64 Up: 1h 07m Mem: 1696.7/11862.6 MiB (14.3%)
Storage: 465.76 GiB (11.4% used) Procs: 197 Shell: Zsh inxi: 3.1.08

Firefox 82.0.3
Thunderbird 68.12.0

Bugs I am trying to find a solution in:

#3579
#2336
#3471 (comment)

[rusty-snake]

Firefox must be already running for all of these to work. If firefox is open, it should work out-of-the-box with firejail 0.9.64 and thunderbird.

[rsramkis]

Previously Firefox did not already need to be open. It would spawn its own instance on demand. This was ideal not only for web links in an e-mail but also clicking on links in ebooks.

I already verified that if I open Firefox before hand, then click on link in e-mail in Thunderbird that the link opens correctly.

Do we have documentation which mentions this is the expected behavior? Thanks.

[rusty-snake]

The issue is that firefox then runs inside the other sandbox (e.g. thunderbirds). That something we simply don't support. Since thunderbird and firefox have very similar profiles, it's maybe enough to add whitelist ${HOME}/.mozilla. However some thing will still break in firefox (e.g. web-cam, local documentation, ...) and it's less secure as firefox has full D-Bus access and can read and write in ~/.gnupg.

[rsramkis]

Thanks for providing your feedback.

Based on your observations, if my default web browser in Gnome was not Firefox but Vivaldi (which does not have a firefox\thunderbird profile), then should my expectation then be that Vivaldi will automatically launch when I click on a link in Thunderbird?

[rusty-snake]

If your default browser is vivaldi/chromium/opera/... this would not work unless you drastically weaken your thunderbird.profile. IDK if/how it works with a running vivaldi/… since I (and the most other firejai users) use firefox.

[rsramkis]

Thanks for the information. It does not bother me to manually launch a web browser.

But from a usability stand point I would have bugged this. The competition (Mac OS) does not behave this way and it has some sophisticated Apparmor setup on its own for security. An end user seeing a "no profile" error is misleading. Espcially since it never behaved this way a couple months ago.

Closing this issue.

[rsramkis]

Just noticed something. I ran the following command from terminal to change my default web browser in Gnome to vivaldi:

"xdg-settings set default-web-browser vivaldi-stable.desktop"

Then I rebooted, launched Thunderbird, and clicked on an e-mail which had a web link. Vivaldi launched with no errors in sandbox mode (because it did not show any of my bookmarks). This is exactly how Firefox used to behave.

[rusty-snake]

open a new instances of Firefox with a new user profile (none of my bookmarks showing'.

Uhh, somehow over read this. nowhitelist ${HOME}/.mozilla/firefox/profiles.ini should work I think. However, keep in mind that this can still make trouble.

[rsramkis]

Hi Rusty,

I'm not sure what I should do with the string "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini". I assume it needs to go into a configuration file?

Note I did read bug:
#3482

[rsramkis]

I was able to find the a file /etc/firejail/thunderbird.profile. It contained these lines:

`# These lines are needed to allow Firefox to load your profile when clicking a link in an email
noblacklist ${HOME}/.mozilla
whitelist ${HOME}/.mozilla/firefox/profiles.ini
read-only ${HOME}/.mozilla/firefox/profiles.ini

noblacklist ${HOME}/.cache/thunderbird
noblacklist ${HOME}/.gnupg
`

It looks like it is already setup to allow for web links to be open based on the comment line.

Source:
#3291

[rusty-snake]

I'm not sure what I should do with the string "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini". I assume it needs to go into a configuration file?

Short: add the nowhitelist to your thunderbird.local

mkdir ~/.config/firejail
echo "nowhitelist ${HOME}/.mozilla/firefox/profiles.ini" >> ~/.config/firejail/thunderbird.local

It looks like it is already setup to allow for web links to be open based on the comment line.

Long: out of #3291 support to open firefox from thunderbird was added by default. But firefox must be running. Your old never supported behaviour was broken by this because ~/.mozilla now appear in the sandbox.

[rsramkis]

Thanks for your feed back. I will go with the recommended configuration.