meld: cannot start application (standalone binary)

[Rosika2]

Info:

OS: Linux Lite 6.2.
firejail version 0.9.72

Hi all, 👋

I want to run meld within firejail. There´s a dedicated meld.profile for it, so it should run without any problems.

For personal reasons I didn´t want to install meld from the official repos but I´d rather run it as a standalone binary.
So I did the following:

git clone https://github.com/GNOME/meld.git
cd meld
firejail --profile=/etc/firejail/meld.profile ./bin/meld

The respective folder is:

/media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld.

So I issued the command:

firejail /media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/bin/meld

But it didn´t work.
I got this:

Reading profile /etc/firejail/meld.profile
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/allow-ssh.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 9032, child pid 9033
23 programs installed in 296.00 ms
Child process initialized in 539.47 ms
Cannot start application: No such file or directory

Parent is shutting down, bye....

Adding

whitelist /media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/bin/

and

noblacklist /media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/bin/

to the profile didn´t help.

What can I do ❓
Any help is highly appreciated.

Thanks in advance and many greetings from Rosika. 🙂

[glitsj16]

The meld executable from git might have a different shebang than the one distributed by OS packages:

#!/usr/bin/env python3

And env isn't in private-bin in the meld.profile, so you would need to explicitly add that. This breakage might also be caused by disable-exec.inc. Combined test override:

$ cat ~/.config/firejail/meld.local
ignore include disable-exec.inc
private-bin env

HTH

[Rosika2]

Hi @glitsj16, 👋

thanks a lot for your quick answer.

You´re right. I looked at the executable. The shebang is:

#!/usr/bin/env python3

I created meld.local in /home/rosika/.config/firejail with the contents you provided. Alas it still doesn´t work:

Reading profile /home/rosika/.config/firejail/meld.profile
Reading profile /home/rosika/.config/firejail/meld.local
Reading profile /etc/firejail/allow-python3.inc
Reading profile /etc/firejail/allow-ssh.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 30541, child pid 30542
25 programs installed in 64.01 ms
Child process initialized in 103.28 ms
Gtk-Message: 15:21:57.470: Failed to load module "xapp-gtk3-module"
GLib-GIO-Message: 15:21:57.478: Adding GResources overlay '/org/gnome/meld=/media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/meld/resources'

(meld:30): dbind-WARNING **: 15:21:57.522: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: No such file or directory
Traceback (most recent call last):
  File "/media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/bin/meld", line 463, in <module>
    sys.exit(main())
  File "/media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/bin/meld", line 458, in main
    setup_settings()
  File "/media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/bin/meld", line 313, in setup_settings
    subprocess.call(["glib-compile-schemas", meld.conf.DATADIR],
  File "/usr/lib/python3.10/subprocess.py", line 345, in call
    with Popen(*popenargs, **kwargs) as p:
  File "/usr/lib/python3.10/subprocess.py", line 971, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
  File "/usr/lib/python3.10/subprocess.py", line 1863, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'glib-compile-schemas'

Parent is shutting down, bye...

Never mind. In the meantime I installed meld via the ubuntu repository after all.
sudo apt install meld.

It works nicely this way. firejail handles it well.

Nevertheless there´s still a problem even here:

Let´s say I want to load the file /home/rosika/.config/firejail/meld.profile (just as an example). It first seems to get loaded but an error mesage pops up:

There was a problem opening the file “/home/rosika/.config/firejail/meld
Error opening file /home/rosika/.config/firejail/meld.profile: Permission denied

Running meld outside of firejail, access to this file is granted.

I need to solve this problem.

Many thanks and many greetings from Rosika 🙂

[glitsj16]

Firejail hardcodes some paths as inaccessable by default for security reasons. Pretty sure ~/.config/firejail is one of those. I can see how this would be awkward for a diff tool like meld, but perhaps you can temporarily move whatever you need to diff out of ~/.config/firejail into ~/Downloads for example. The latter (or a subdir) should pose no access problems for meld.

Not the nicest workaround, but there we are :)

[Rosika2]

Hi @glitsj16, 👋

thanks a lot for your reply. ❤️

Firejail hardcodes some paths as inaccessable by default for security reasons. Pretty sure ~/.config/firejail is one of those.

Ah, I see. That´s certainly the explanation of it.

Yes, of course moving (or copying) the files I need to diff into another directory is possible.

So I´ll use the installed version of meld then. It poses less difficulties than the standalone executable from git.
It´s a bit of a shame though that we couldn´t get the former one to work at all with firejail.

BTW:

The --noprofile command worked:

firejail --noprofile /media/rosika/f14a27c2-0b49-4607-94ea-2e56bbf76fe1/DATEN-PARTITION/Dokumente/Ergänzungen_zu_Programmen/zu_meld/meld/bin/meld.

But of course that wouldn´t be good enough for daily usage. 😉
Was just as an experiment.

Thanks a lot and have a nice Sunday.

Many greetings from Rosika 🙂