claws-mail: seahorse pinentry is blocked

[Xunil73]

I use claws-mail with the PGP/core PGP/inline and PGP/mime plugins. To pass the pinentry password prompt of the keys i use the "remember password" function of seahorse and the option "use gpg-agent" of claws-mail. The standard firejail profile for claws-mail blocks the pinentry function.
I searched all .profiles for entries like "pinentry" and found things like:
/etc/firejail/psi.profile:# Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for GPG
...i guess this is the right way to force claws-mail.profile to accept a pinentry function but i wasn't able to implement it to the profile, i don't know how to enable this.
Is there a way to solve this?

[glitsj16]

Thank you for opening this ticket. Your use case isn't something we've considered when originally creating the claws-mail profile, so we'll need to do some trial-and-error work to get this covered and functioning properly. It's a bit more complicated than usual for me to test this, due to not having 'real world' PGP-encrypted email traffic at hand. But with your help and some Q&A we'll get there.

Looking at the profile the private-bin which mentions some of these pinentry-X options isn't enabled, so those commands are not being blocked. My first guess is it might be something from the seahorse end we need to explicitly allow. Can you try adding the below to a claws-mail.local or email-common.local and report back your findings?

whitelist ${RUNUSER}/keyring

[Xunil73]

Thank you for your reply and help! I addend the line above in a .local and the error changed. The original error was "pinentry error" and after adding the line the error switched to (translated) :
"digital signature error: data signing failed, inappropriate IOCTL (I/O-Control) for the device."

[glitsj16]

Aha, I've seen that error before. Do you export GPG_TTY=$(tty) on your machine? See this for more info.
Can you post the full output you get from claws-mail, regardless of errors? I happen to read (some) German, very kind and thoughtful of you to provide the translation :-)

[Xunil73]

Until now i have not set the environment. After setting GPG_TTY the error changed again to "Error with signature, data signature failed, file or directory not found".
Regardless of the previous measure names, the output is always the same:

$ firejail claws-mail
Reading profile /etc/firejail/claws-mail.profile
Reading profile /etc/firejail/claws-mail.local
Reading profile /etc/firejail/email-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 2437, child pid 2438
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Blacklist violations are logged to syslog
Child process initialized in 259.92 ms

(claws-mail:4): dbind-WARNING **: 08:36:59.840: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-Dtw3D1Ma9y: Datei oder Verzeichnis nicht gefunden

** (claws-mail:4): WARNING **: 08:36:59.842: Unable to connect to dbus: Verbindung ist gescheitert: Keine Berechtigung

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.009: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.009: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.009: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.144: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.144: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.144: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.145: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.145: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:00.145: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): Claws-Mail-WARNING **: 08:37:00.493: While connecting to session manager: Authentication Rejected, reason : None of the authentication protocols specified are supported and host-based authentication failed.
Created directory /home/harry/.bogofilter .
Can't open file 'wordlist.db' in directory '/home/harry/.bogofilter'.
error #2 - No such file or directory.

Remember to register some spam and ham messages before you
use bogofilter to evaluate mail for its probable spam status!

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:06.006: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:06.006: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:06.006: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:31.939: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:31.939: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:31.939: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): Gtk-CRITICAL **: 08:37:51.564: IA__gtk_toggle_tool_button_set_active: assertion 'GTK_IS_TOGGLE_TOOL_BUTTON (button)' failed

(claws-mail:4): Gtk-CRITICAL **: 08:37:53.012: IA__gtk_toggle_tool_button_set_active: assertion 'GTK_IS_TOGGLE_TOOL_BUTTON (button)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:54.141: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:54.141: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:54.141: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): Gtk-WARNING **: 08:37:57.257: Failed to set text from markup due to error parsing markup: Fehler in Zeile 6, Zeichen 1: »[email protected]« ist kein gültiger Name: »@«

(claws-mail:4): Gtk-WARNING **: 08:37:57.257: Failed to set text from markup due to error parsing markup: Fehler in Zeile 6, Zeichen 1: »[email protected]« ist kein gültiger Name: »@«

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:57.298: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:57.298: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:57.298: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): Gtk-WARNING **: 08:37:57.299: Failed to set text from markup due to error parsing markup: Fehler in Zeile 6, Zeichen 1: »[email protected]« ist kein gültiger Name: »@«

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:59.664: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:59.664: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 08:37:59.664: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 09:35:51.975: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 09:35:51.975: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

(claws-mail:4): GLib-GIO-CRITICAL **: 09:35:51.975: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed

as you can see, there is no prompt in console after closing claws-mail.
This error happens if i try to perform a signature and encryption operation on claws-mail in the sandbox.
After CLOSING the claws-mail GUI the console startet from hangs and
two threads of claws-mail persist:

$ ps -ax | grep firejail
   2437 pts/0    S+     0:00 firejail claws-mail
   2438 pts/0    S+     0:00 firejail claws-mail
   2973 pts/1    S+     0:00 grep firejail

---

Edit by @kmk3: Fix formatting.

[kmk3]

(Offtopic)

@Xunil73 See the following links for how to format code blocks in markdown:

• https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks
• https://github.github.com/gfm/#fenced-code-blocks

[glitsj16]

Can't open file 'wordlist.db' in directory '/home/harry/.bogofilter'.
error #2 - No such file or directory.

Do you have that wordlist.db file? The profile makes ${HOME}/.bogofilter accessible so this could just be a matter of not (yet) having used/configured the bogofilter plugin. Anyway, this doesn't seem to be related to pinentry being blocked.

At the moment I can't come up with a better strategy than trying to comment lines one by one to find the culprit. One thing you might start with is the apparmor option, but this is pure guessing from my part.

[Xunil73]

I think i have found the solution. Based on your tips, I tried and tried until it finally worked.
With this /etc/firejail/claws-mail.local i can use the signature/encryption plugins with
my keyring and Seahorse's "remember password" function:

$ cat /etc/firejail/claws-mail.local 
   whitelist ${RUNUSER}/keyring
   whitelist ${RUNUSER}/gnupg
   whitelist ${RUNUSER}/gnupg2
   include allow-python2.inc
   include allow-python3.inc
   ignore nonewprivs
   ignore dbus-user none
   ignore dbus-system none

Annotation: only the entry ignore nonewprivs made sure that all associated processes terminated properly when the program was terminated. Without this, two processes always continued to run in the terminal after closing claws-mail.

@glitsj16 many thanks for your help!

[glitsj16]

@Xunil73 Thanks for digging into this! I've been doing some experimenting with claws-mail too here and have some remarks/pointers. I use a custom GTK2 build with support for the plugins I actually use, so your mileage may vary.

whitelist ${RUNUSER}/gnupg2

Does that path exist on your machine? It doesn't on my Arch Linux box, so it might not be needed.

ignore dbus-user none
ignore dbus-system none

If disabling D-Bus restrictions is needed for your use case(s), that's fine. Note that this creates a weaker sandbox though, especially allowing access to the system bus. I managed to get encrypting/signing working without allowing it:

dbus-user.talk org.freedesktop.secrets
dbus-user.talk org.gnome.keyring
dbus-user.talk org.gnome.keyring.PrivatePrompter
dbus-user.talk org.gnome.seahorse
dbus-user.talk org.gnome.seahorse.Application

Maybe you can experiment with these, and hopefully keep a tighter sandbox while using these plugins.

Annotation: only the entry ignore nonewprivs made sure that all associated processes terminated properly when the program was terminated. Without this, two processes always continued to run in the terminal after closing claws-mail.

Ignoring nonewprivs is not something I like to do. Again, it weakens the sandbox considerably. Try adding deterministic-shutdown. That might help with this.

I'll keep an eye on this thread so we can add appropriate comments in the relevant profiles for other users who might face this specific problem. IMO it's an important use case we should support 'out of the box'. Thanks again for bringing it to our attention!

[Xunil73]

ok, thanks for this info! But now i'm really confused, i tried firejail->claws-mail now again with a fresh installed Debian and ArchLinux on an laptop. In both cases all encryption and signing works WITHOUT any workaround on the basic claws-mail.profile . I don't know why, it is the same debian distribution with the same installed packages as on the machine i had the problems with the plugins. Let's see if i can figure it out...

[glitsj16]

@Xunil73 Interesting. These things happen, although I cannot explain. Maybe something stale in claws-mail configuration that is now gone. Anyway, I hope it keeps working as expected, in which case we don't need to change our related profiles. I keep checking this encrypting/signing functionality now too as claws-mail is my default mail program on Arch Linux. I'll keep this issue open for now though, just in case.

[marek22k]

I also get:

Could not queue message for sending:

Signature failed: Data signing failed, pinentry error

Is there a workaround currently? It works without firejail.

Debug logs:

sgpgme.c:594:sgpgme_setup_signers: OpenPGP protocol
sgpgme.c:601:using default gnupg key
prefs_gpg.c:668:unset GPG_AGENT_INFO=/run/user/1000/gnupg/S.gpg-agent:0:1
pgpmime.c:540:gpgme_op_sign error : 5000056
alertpanel.c:253:Creating alert panel dialog...
alertpanel.c:211:called inc_lock (lock count 2)
alertpanel.c:221:called inc_unlock (lock count 1)
compose.c:5430:called inc_unlock (lock count 0)

Adding the following does not help:

   whitelist ${RUNUSER}/keyring
   whitelist ${RUNUSER}/gnupg
   whitelist ${RUNUSER}/gnupg2
   include allow-python2.inc
   include allow-python3.inc
   ignore nonewprivs
   ignore dbus-user none
   ignore dbus-system none

dbus-user.talk org.freedesktop.secrets
dbus-user.talk org.gnome.keyring
dbus-user.talk org.gnome.keyring.PrivatePrompter
dbus-user.talk org.gnome.keyring.SystemPrompter
dbus-user.talk org.gnome.seahorse
dbus-user.talk org.gnome.seahorse.Application
dbus-user.talk org.mozilla.*
dbus-user.talk org.gnome.keyring.SystemPrompter

[glitsj16]

@marek22k

Adding the following does not help:

If you're on Firejail 0.9.72 the following options are already present (either in claws-mail.profile or email-common.profile):

whitelist ${RUNUSER}/gnupg
dbus-user.talk org.freedesktop.secrets
dbus-user.talk org.gnome.keyring
dbus-user.talk org.gnome.keyring.PrivatePrompter
dbus-user.talk org.gnome.keyring.SystemPrompter (BTW, this appears twice in your post)
dbus-user.talk org.gnome.seahorse.Application

Also, 'dbus-user none' isn't used, so ignoring it won't do anything useful.

Assuming you have it working on a non-firejailed claws-mail, what you can try is disabling dbus-user filter, to rule out if what you're seeing is indeed D-Bus related: ignore dbus-user filter.

[marek22k]

That works. Thanks for the help!