-
|
Hi all, 👋 I´m trying to create a firejail profile for But it seems to be of no use as the GUI always gives me an "empty" window, as if no VMs were installed in If I use a dedicated profile containing just: and nothing else, the installed VMs can be seen by Plus: closing the
That would also be the case when issuing the command Can anyone help? Many thanks in advance and many greetings from Rosika 🙂 |
Beta Was this translation helpful? Give feedback.
Replies: 6 comments 14 replies
-
|
Hi Rosika, just a few quick pointers.
If it was me I'd try to get some inspiration by looking at a profile for a program that offers That's all for now, need to get the children from school. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @glitsj16: 👋 thanks so much for your advice. ❤️ So I took the virtualbox.profile and looked at the points you mentioned. I added for my purposes and also tried all variations with the other settings by commenting them out. The only thing I didn´t do was:
The options I added are:
Those paths already exist. So would I still need to make mkdir and mkfile for those paths ❓ Thank you very much for your kind help. Cheers from Rosika 🙂 P.S.:
That´s really nice of you. 👍 ❤️ |
Beta Was this translation helpful? Give feedback.
-
|
Previouds attempt #1139 (comment) |
Beta Was this translation helpful? Give feedback.
-
|
Hi @rusty-snake, 👋 Thanks for the link. Cheers from Rosika |
Beta Was this translation helpful? Give feedback.
-
I've installed gnome-boxes on a Ubuntu 22.04 LTS and with Here's a working profile - left it logically ordered for now - and functionally it seems to do the job: $ cat ~/.config/firejail/gnome-boxes
# Firejail profile for gnome-boxes
# Description: Simple GNOME application to access virtual systems
# This file is overwritten after every install/update
# Persistent local customizations
include gnome-boxes.local
# Persistent global definitions
include globals.local
# GNOME Boxes
noblacklist ${HOME}/.cache/gnome-boxes
noblacklist ${HOME}/.config/gnome-boxes
noblacklist ${HOME}/.local/share/gnome-boxes
# libvirt
noblacklist ${HOME}/.cache/libvirt
noblacklist ${HOME}/.config/libvirt
noblacklist ${RUNUSER}/libvirt
noblacklist /var/cache/libvirt
noblacklist /var/lib/libvirt
noblacklist /var/log/libvirt
noblacklist ${HOME}/.local/share/gvfs-metadata
noblacklist /sbin
#noblacklist /usr/local/sbin
noblacklist /usr/sbin
# for @Rosika2 only:
# if you never blacklisted the below path (like in a disable-common.local) the line can be dropped
# otherwise uncomment it
#noblacklist /media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/für_qemu2
include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
# breaks app
#include disable-proc.inc
include disable-programs.inc
include disable-xdg.inc
# GNOME Boxes
mkdir ${HOME}/.cache/gnome-boxes
mkdir ${HOME}/.config/gnome-boxes
mkdir ${HOME}/.local/share/gnome-boxes
whitelist ${HOME}/.cache/gnome-boxes
whitelist ${HOME}/.config/gnome-boxes
whitelist ${HOME}/.local/share/gnome-boxes
# libvirt
mkdir ${HOME}/.cache/libvirt
mkdir ${HOME}/.config/libvirt
whitelist ${HOME}/.cache/libvirt
whitelist ${HOME}/.config/libvirt
whitelist ${RUNUSER}/libvirt
whitelist /run/libvirt
whitelist ${DOWNLOADS}
# for @Rosika2 only:
# uncomment the below while testing this profile
#whitelist /media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/für_qemu2
whitelist /usr/share/gnome-boxes
whitelist /usr/share/libvirt
whitelist /usr/share/qemu
whitelist /usr/share/seabios
whitelist /usr/share/vala*
include whitelist-common.inc
include whitelist-run-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
# For host-only network sys_admin is needed. See https://github.com/netblue30/firejail/issues/2868#issuecomment-518647630
apparmor
caps.keep net_raw,sys_nice
netfilter
nodvd
notv
tracelog
#disable-mnt
#private-bin gnome-boxes,libvirtd,qemu*
private-cache
# uncomment the below if you're on 0.9.72
#private-etc alsa,alternatives,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,localtime,pki,pulse,resolv.conf,ssl
# uncomment the below if you're on 0.9.73 (firejail-git)
#private-etc @network,@sound,@tls-ca,@x11
private-tmp
dbus-user filter
dbus-user.own org.gnome.Boxes
dbus-user.talk ca.desrt.dconf
dbus-system none
deterministic-shutdown
restrict-namespaces
#writable-varI'll do some more testing, but my hardware is limited. HTH! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @glitsj16, 👋 thank you so much for putting a lot of time and effort into helping me. ❤️ I tried the profile you kindly provided and uncommented:
The profile now worked very much better, as it for the first time displayed all of the available VM images. However a new problem came up when trying to fire up any of the Vms. The terminal said: and a lot more of the same kind. It was just the I also took a look at what Such a shame. It almost worked. Thank you so much for your kind help. ❤️ Many greetings from Rosika 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Ohh, we can fix that! I took another shot at it and changed some of the earlier options. If you're still up for another round of testing, please do. I think we nailed it 👯 You can add your specifics for 0.9.72 and /media/rosika/... exactly like above. Here's the $ cat ~/.config/firejail/gnome-boxes.profileHTH Edit: The profile was added in: |
Beta Was this translation helpful? Give feedback.
-
|
Hi @glitsj16, 👋
Of course I am. Thank you so much ❤️ Hooray. The new profile works perfectly. 👍
That I did. Now the firejailed instance of As I was very much interested what the difference between the first profile you provided and the most topical one may be I first sorted the two profiles: I got these differences: To be honest, I´ve no idea which of these entries made it work in the end. That´s well beyond my expertise. 😉 One thing is certain, however: I wouldn´t have been able to solve the problem, not in a thousand years. I admire your immense knowledge, dear @glitsj16 . 👍 Now that you put so much time and effort into coming up with a perfectly working Thank you very much for all the hard work you put into helping me. It´s highly appreciated. ❤️ All the best to you and your family. P.S.: Update:After having used the profile successfully I curiously ran into something weird. I started So I took a look at Even more curious: After that I started So every now then and firejailed gnome boxes doesn´t seem to have access to the already installed VMs. Does the Thanks so much. P.S. 2: Even if |
Beta Was this translation helpful? Give feedback.
-
Aha, that's good news indeed.
It was a combination of things that eventually did it. A few extra paths need
It would and I will add the working profile soonish in a PR. Just wanted to have your feedback before rushing things in. Thank you for being persistent and posting your findings, appreciated!When accepted it will hopefully get into the upcoming 0.9.74 release. Stay tuned, because when it does you'll need to rearrange your gnome-boxes.local accordingly.
The best guesses I have right now on these observations are
Regardless of the above, what you always can do is ensuring your commands to start gnome-boxes all use the There could be other things in play here come to think of it. I never activated the gnome-boxes option to keep VM's I'd really appreciate if you could keep eyes on this during your VM use over a few days and report back if it keeps showing that weird behaviour, regardless of proper shutdown procedures. I'll do the same on my end too and report back here. Thanks for your kind appreciations, keep well! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @glitsj16, 👋 thank you so much for your persistent help. ❤️
Thanks for the info.
You´re very welcome. But it´s rather me who has to be thankful for the great help I´m getting from you. Here´s some new info: When running Still, boxes work as expected this way. Now I modified Alas the outcome seem to be the same. Here are
No idea whether it helps at all... 🤔 But the fact remains: Curious thing: what kind of "timeout" might be at work here? That´s really beyond me. Thank you so much for your kind help, dear @glitsj16 . It´s greatly appreciated. ❤️ Many greetings from Rosika 🙂 P.S.:
Me neither. So we can rule out this one. |
Beta Was this translation helpful? Give feedback.
-
You're still on 0.9.72 so you will need to use the format for private-etc that is supported in that version. The new format is easy to spot, it has
HTH, enjoy the weekend! |
Beta Was this translation helpful? Give feedback.
-
|
Dear @glitsj16, 👋 thank you very much for your new reply. Those are the In your reply you referred to the first one. The second one has the Seems I´m a bit slow today. Sorry. Have a nice weekend. |
Beta Was this translation helpful? Give feedback.
-
|
Remove or comment the second one with the @ entries, that's not supported in 0.9.72.
Several options here, because private-etc supports globbing and is cumulative. Meaning if you would add On a side-note: I'm getting slightly more familiar with virtualization managers day by day. Shared folder & clipboard support for gnome-boxes should be ready after the weekend, with some hardenings on top. Stay tuned! Ciao |
Beta Was this translation helpful? Give feedback.
-
|
Hi @glitsj16 , 👋 thanks so much again for your help. ❤️ O.K., I did what you suggested and the relevant part of the config file looks like this now: I´m sorry to say nothing seems to have changed. This time I issued the command
for logging purposes to make sure I wouldn´t miss anything. These are the logs referring to the start of No extra logs when shutting down the process. I´m so sorry to give you so much trouble. 😞 Thanks a lot for your kind help. Have a nice weekend. Cheers from Rosika 🙂 Update:Seems we finally got the solution: My good friend Neville (https://itsfoss.community/u/nevj/summary and https://github.com/nevillejackson ), who´s been following our discussion, came up with the solution:
So I did just that in my profile as well. The relevant part looks like this now: Now firejailed gnome-boxes sees all the installed VMs right from the start and has access to them. 😃 🎆 Thank you so much for your persistent help, @glitsj16 ❤️ All the best from Rosika 🙂 |
Beta Was this translation helpful? Give feedback.
-
Indeed it does. The new format makes this a lot easier. It uses saner defaults and groups, see this for reference. Glad you finally got it working! I'll open a PR for adding gnome-boxes.profile shortly, my testing has settled over the weekend. Here's my 'end-result', tightened things down a bit. Feel free to test if with that all the features you expect from the app are working (including sharing a folder and clipboard between host and guest). $ cat ~/.config/firejail/gnome-boxes.profileThanks for all the feed-back! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @glitsj16 👋 Thanks so much for the hard work you put into the new profile. ❤️
O.K. I´ll gladly do that.... O.K. In the meantime I tested it. Here´s your latest profile and I added my personal noblacklist and whitelist path to my VMs: Well, I´m sorry to say I´m back to the initial problem again. 🙍♀️ I diffed the two profiles after having sorted them. Here are the differences:
No idea if it helps. 😐 Thanks again and many greetings from Rosika 🙂 |
Beta Was this translation helpful? Give feedback.
-
|
Got a bit swamped, even with the extra leap year day... If I'm reading your diff correctly it seems something in the Just for the record, the profile does work for me. It got merged and a few hours ago I opened a hardening PR for gnome-boxes. Leave all that out for now and try to post what you needed to change to return to a working profile. I used a voidlinux XFCE/musl during all my testing BTW (wanted to check that distro out anyway, just a personal preference). |
Beta Was this translation helpful? Give feedback.
-
|
Hi @glitsj16 👋 thank you so much.
The relevant part of the profile looks like this now: But Boxes still don´t see the installed VMs. So sorry. 😞 Thanks again and cheers from Rosika 🙂 |
Beta Was this translation helpful? Give feedback.
Ohh, we can fix that! I took another shot at it and changed some of the earlier options. If you're still up for another round of testing, please do. I think we nailed it 👯 You can add your specifics for 0.9.72 and /media/rosika/... exactly like above.
Here's the
improvedversion (downloads are also working properly with this one):$ cat ~/.config/firejail/gnome-boxes.profile