Create Xscreensaver

[bdantas]

http://files.dantas.airpost.net/public/Xscreensaver-x86_64.AppImage

[probonopd]

Hi @bdantas how did you make the AppImage?

Possibly you may be running into netblue30/firejail#2690 here.

[bdantas]

Hi @bdantas how did you make the AppImage?

Hi @probonopd I made the AppImage this way:

• Manually-created AppDir
• AppRun is a simple shell script (shebang is #!/bin/sh) marked as executable
• appimagetool-x86_64.AppImage version 12 (available here: https://github.com/AppImage/AppImageKit/releases) used to create AppImage from AppDir

[probonopd]

Thank you very much for your analysis @bdantas.

[probonopd]

Actually, we are already using --noprofile:

appimage.github.io/code/worker.sh

Line 242 in 53ca882

firejail --quiet --noprofile --net=none --appimage ./"$FILENAME" &

What gives?

[bdantas]

@probonopd For AppImages that have the "Permission denied" issue, --noprofile cannot be combined with --appimage:

$ firejail --appimage ./Xscreensaver-x86_64.AppImage # doesn't work ("Permission denied")
$ firejail --noprofile ./Xscreensaver-x86_64.AppImage # works
$ firejail --noprofile --appimage ./Xscreensaver-x86_64.AppImage # doesn't work

Firejail contributor glitsj16 could reproduce this. See netblue30/firejail#3249 (comment)

I documented how to fix the "Permission denied" issue here: AppImage/AppImageKit#1032 (comment)

--appimage and --noprofile can be combined after the AppImage has been repaired. However, combining --appimage with a specific profile (e.g., --appimage --profile=/etc/firejail/firefox.profile) is better because it results in a stronger sandbox.

[probonopd]

Thanks for your investigation @bdantas, what do you suggest I should do? Change the automated test to use --noprofile rather than --appimage?

[bdantas]

You're welcome, @probonopd. Yes, until this "Permission denied" issue becomes ancient history, I'd use the --noprofile flag without the --appimage flag in the automated system.

[probonopd]

Now that we know the reason for the Firejail incompatibility with some AppImages, would it be possible that you please make it so that all directories in your AppImage (including the AppDir itself) are 0755? Once done just ping me here so that I will re-run the test. Then I hope this error disappears. Thank you so very much!