Transmission crashes in a second

[egor-yudkin]

Description

Running Transmission torrent client with default profile makes it crash in a second.
I'm using default transmission profiles.

Steps to Reproduce

1. Run firejail transmission-gtk

Expected behavior

Transmission should continue to run normally

Actual behavior

1. Application window opens for a second, then disappears

Behavior without a profile

Application works fine with --noprofile

Additional context

I tried to use a trasmission-gtk.local profile with DBus filter as described in #5161, but this makes things even worse - I'm just getting another error Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown and Transmission doesn't even start

Environment

• Ubuntu 22.04 LTS
• Firejail 0.9.70
• Transmission 3.00-2ubuntu2

Checklist

• The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
• I can reproduce the issue without custom modifications (e.g. globals.local).
• The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• The profile (and redirect profile if exists) hasn't already been fixed upstream.
• I have performed a short search for similar issues (to avoid opening a duplicate).
• I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
• I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail transmission-gtk

** (transmission-gtk:12): WARNING **: 10:34:52.072: Failed to create proxy for org.freedesktop.Notifications

Output of LC_ALL=C firejail --debug transmission-gtk

[transmission-firejail-debug.log](https://github.com/netblue30/firejail/files/8949953/transmission-firejail-debug.log)

Hmm, your debug log shows this warning on line 26:

Warning: networking feature is disabled in Firejail configuration file

By default that is enabled. Did you make any other changes to your /etc/firejail/firejail.config?

[rusty-snake]

Debian disables it (for unprivileged users) by default (for security reasons).

Ubuntu uses the same package AFAIK.

[egor-yudkin]

@glitsj16 Honestly, I'm not sure if I made this change... I don't recollect touching firejail.config at all. Could it be because I've originally installed firejail from Ubuntu repo, but then updated it from ppa:deki/firejail?
If I can assume that any uncommented lines in that file are changes to defaults, then I have two of them:

cgroup no
restricted-network yes

[rusty-snake]

https://sources.debian.org/patches/firejail/0.9.64.4-2/config-hardening.patch/

[egor-yudkin]

@rusty-snake Ok, this makes some sense to me now... But how I "fix" this?
Can I do something like ignore restricted-network in my local config file for transmission? Or I have to revert that change in firejail.config made by Debian?

@egor-yudkin The special treatment of these specific settings on Debian/Ubuntu is news to me too. In that context the warning is to be expected and might not be relevant to your transmission-gtk issue. I only noticed it in your debug log and that triggered the above question. To make sure you can temporarily change restricted-network by commenting it in your /etc/firejail/firejail.config. Besides trying that you can start commenting lines in /etc/firejail/transmission-{common,gtk}.profile one by one to find the option(s) that seem to cause what you're seeing. A simple debug tip: start TM in a terminal like firejail --ignore=quiet /usr/bin/transmission-gtk so you can follow the loading of profile files and local overrides you might have more easily.

[rusty-snake]

First, if --noprofile works is restricted-network unrelated. Second does firejail --ignore="dbus-user none" /usr/bin/transmission-gtk work?

[egor-yudkin]

First, if --noprofile works is restricted-network unrelated. Second does firejail --ignore="dbus-user none" /usr/bin/transmission-gtk work?

1. True. I tried to follow @glitsj16 advice and temporarily changed it back to default - this didn't help
2. It does not. I'm getting another warning, though. Here is the full output with --ignore=quiet:

firejail --ignore=quiet --ignore="dbus-user none" /usr/bin/transmission-gtk
Reading profile /etc/firejail/transmission-gtk.profile
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/transmission-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 28411, child pid 28412
1 program installed in 1.58 ms
Standard C library installed in 1.06 ms
Firejail libraries installed in 0.59 ms
Program libraries installed in 11.91 ms
GdkPixbuf installed in 3.77 ms
GTK3 installed in 6.23 ms
Pango installed in 0.00 ms
GIO installed in 1.74 ms
Installed 151 libraries and 6 directories
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Blacklist violations are logged to syslog
Warning: cleaning all supplementary groups
Child process initialized in 191.46 ms

(transmission-gtk:12): dbind-WARNING **: 15:29:38.459: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus: No such file or directory

Parent is shutting down, bye...

[rusty-snake]

Ok, then it's not dbus.

Maybe it's seccomp. Can you check your syslog and try --ignore=memory-deny-write-execute.

[rusty-snake]

Do you use Wayland?

[egor-yudkin]

Can you check your syslog and try --ignore=memory-deny-write-execute.

Doesn't work. Same warning as it was originally.

Do you use Wayland?

Yes

[reinerh]

A Debian user also reported a problem with transmission and 0.9.70: https://bugs.debian.org/1012734
Maybe it's the same issue, sorry for not forwarding it earlier, I wanted to confirm/reproduce it first...

@egor-yudkin
Can you please try it with --ignore=private-lib?

[egor-yudkin]

Can you please try it with --ignore=private-lib?

This is it! It works with --ignore=private-lib

[reinerh]

@rusty-snake @glitsj16
We already ignore private-lib in transmission-remote-gtk.profile and transmission-qt.profile. What about disabling it in general (transmission-common.profile)?

[egor-yudkin]

I just tried to do what the person who reported a bug suggested, and it worked.
Add to ~/.config/firejail/transmission-gtk.local:

# A fix for Debian-patched Transmission; Allows using RC4. See https://bugs.debian.org/1012734
private-lib x86_64-linux-gnu/ossl-modules,legacy.so