vscodium: missing profile redirect: vscodium was renamed to codium #3871

mYnDstrEAm · 2021-01-05T17:05:32Z

I had a problem of not getting updates for the way to get Visual Studio Code on Debian via a repository instead of the GitHub releases: https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo/-/issues/50

I did not get any error or alike and "solved" it by going through that repo's guide in the readme again which I installed VsCodium another time, now not called vscodium but "codium" and the latest version (now I have two VSCodiums installed).

However, when I run firejail --profile=/etc/firejail/vscodium.profile codium I now get this error message:

Unable to write program user data.

Please make sure the following directories are writeable:

/home/username/.config/VSCodium
/home/username/.vscode-oss/extensions
/run/user/1000

I already created a /home/username/.config/firejail/code.local with:

noblacklist ${HOME}/.config/VSCodium
noblacklist ${HOME}/.vscode-oss/extensions

At least two issues remain:

The vscodium profile (that's /etc/firejail/code.profile and /etc/firejail/vscodium.profile) seems to be broken/outdated
How to solve the problem with /run/user/1000?

echo $DBUS_SESSION_BUS_ADDRESS returns unix:path=/run/user/1000/bus

Also from the default vscodium profile it looks like it's not possible to install extensions. Is that correct? If so that should be changed too but it would be a separate issue.

System: Debian10/KDE
Firejail: 0.9.64 (latest from backports)

The text was updated successfully, but these errors were encountered:

rusty-snake · 2021-01-05T17:22:47Z

Please make sure the following directories are writeable:
/run/user/1000

I did not read futher, but firejail --writable-run-user … shoulde solve at least this message.

mYnDstrEAm · 2021-01-05T17:34:12Z

It's solved now, sorry. Was a problem with local profiles.

mYnDstrEAm · 2021-01-05T17:54:03Z

Reopening because if the VsCodium is now called codium the profile's name needs to be changed to be used automatically when running firejail codium. One could also just copy the vscodium.profile to codium.profile.

(Currently it needs to be run like this: firejail --profile=/etc/firejail/vscodium.profile /usr/bin/codium.

firejail --profile=/etc/firejail/vscodium.profile /usr/share/codium/codium --unity-launch %F and firejail --profile=/etc/firejail/vscodium.profile /usr/share/codium/codium --new-window %F don't work because of:

FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /usr/share/codium/chrome-sandbox is owned by root and has mode 4755.

See here for what seems to be the best improvised solution for this currently; I'm not sure how this could be implemented here and if it needs to be as it also runs without --no-sandbox when not adding any parameters. That part is probably unrelated to firejail but please comment if you know a way to make firejail work when using --new-window)

rusty-snake · 2021-01-05T18:18:31Z

FATAL:setuid_sandbox_host.cc(158)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /usr/share/codium/chrome-sandbox is owned by root and has mode 4755.

See here for what seems to be the best improvised solution for this currently; I'm not sure how this could be implemented here and if it needs to be as it also runs without --no-sandbox when not adding any parameters. That part is probably unrelated to firejail but please comment if you know a way to make firejail work when using --new-window)

See PRs #3688 and #3807. My suggestion sysctl kernel.unprivileged_userns_clone=1.

rusty-snake · 2021-01-05T18:21:14Z

Reopening because if the VsCodium is now called codium the profile's name needs to be changed to be used automatically when running firejail codium.

We should add a redirect/alias profile for it.

EDIT: And if writable-run-user is required, we should add it too.

mYnDstrEAm · 2021-01-05T18:45:55Z

Sounds good! writeable-run-user wasn't required.

Edit: only firejail --profile=/etc/firejail/vscodium.profile /usr/bin/codium works, but not firejail --profile=/etc/firejail/vscodium.profile /usr/share/codium/codium /usr/share/codium/codium is used in the default .desktop file after installation (it was /usr/share/codium/codium --no-sandbox --unity-launch %F).

Don't know about kernel.unprivileged_userns_clone - it seems to be disabled for security reasons and I don't know how it would be useful here.

rusty-snake · 2021-01-06T18:00:36Z

Don't know about kernel.unprivileged_userns_clone - it seems to be disabled for security reasons and I don't know how it would be useful here.

Maybe read #3754.

Edit: only firejail --profile=/etc/firejail/vscodium.profile /usr/bin/codium works, but not firejail --profile=/etc/firejail/vscodium.profile /usr/share/codium/codium /usr/share/codium/codium is used in the default .desktop file after installation (it was /usr/share/codium/codium --no-sandbox --unity-launch %F).

Is /usr/bin/codium a wrapper script for /usr/share/codium/codium?

mYnDstrEAm · 2021-01-06T19:48:53Z

Is /usr/bin/codium a wrapper script for /usr/share/codium/codium?

It points to /usr/share/codium/bin/codium (ln -s says "codium -> /usr/share/codium/bin/codium" so I guess a symbolic link?) which is a very short wrapper script. Strangely, if I read it right that script should only run /usr/share/codium/codium. The relevant part is:

if [ ! -L "$0" ]; then
	# if path is not a symlink, find relatively
	VSCODE_PATH="$(dirname "$0")/.."
else
	if command -v readlink >/dev/null; then
		# if readlink exists, follow the symlink and find relatively
		VSCODE_PATH="$(dirname "$(readlink -f "$0")")/.."
	else
		# else use the standard install location
		VSCODE_PATH="/usr/share/codium"
	fi
fi

ELECTRON="$VSCODE_PATH/codium"

mYnDstrEAm · 2021-01-08T14:52:43Z

There's probably some permissions set that allows /usr/bin/ but not /usr/share - firejail --profile=/etc/firejail/vscodium.profile /usr/share/codium/codium should work with the profile too.

rusty-snake · 2021-01-09T09:27:07Z

Just to be sure, firejail --noprofile /usr/share/codium/codium works?

rusty-snake · 2021-04-06T14:33:26Z

Any progress here?

kmk3 · 2021-10-04T18:53:39Z

@rusty-snake commented on Apr 6:

Any progress here?

I think I got it; will submit a PR later.

kmk3 · 2021-10-05T03:23:19Z

Quoting the first post of the following discussion (as a sort of +1):

Custom Firejail profile as security increase VSCodium/vscodium#776

@henrythebuilder on Jul 26:

Hi,

Following the latest problems detected with marketplace
(VSCodium/vscodium#746), I tried to use Firejail to increase security but in
my computer the default profile does not work, so I tried to create a new
local profile following information/instructions on how to manage
Chromium/Electron applications.
Referring especially on firejail repo (issue 2949 > netblue30/firejail#2946 )
I created the profile I attach stored locally at
~/.config/firejail/codium.profile

I use it from my shell through an alias for the executable codium
(./bin/codium) as:

alias codium='firejail /my/local/installation/path/vscodium/bin/codium'

Not knowing how to share it I used this channel hoping to have help to
correct/extend it to get best result

Enrico

codium.profile:
# Firejail profile for codium
# Description: main entry point for VSCodium from shell (./bin/codium)

# Persistent local customizations
include codium.local

noblacklist ${HOME}/.VSCodium
noblacklist ${HOME}/.config/VSCodium
noblacklist ${HOME}/.vscode-oss

### from https://github.com/netblue30/firejail/issues/2946
#seccomp !chroot
#ignore seccomp
seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice

# Redirect
include ${CFG}/code.profile

It creates the following directories on startup: * ~/.config/VSCodium * ~/.vscode-oss Environment: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 Note: The following entry is already on disable-programs.inc: noblacklist ${HOME}/.vscode-oss It was added on commit de90834 ("Update disable-programs.inc", 2019-03-02). Relates to netblue30#3871.

Both base names are valid: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 $ pacman -Qlq vscodium-bin | grep -v -e '/$' -e /resources/ | grep /bin/ /usr/bin/codium /usr/bin/vscodium /usr/share/vscodium-bin/bin/codium Note: The first two paths are symlinks to the third one. Fixes netblue30#3871.

kmk3 · 2021-10-05T05:56:00Z

vscodium was renamed to codium

Potentially caused by:

Launch the IDE with codium (instead of vscodium) VSCodium/vscodium#176

Kind of relates to:

Rename VSCodium to Codium VSCodium/vscodium#293

mYnDstrEAm closed this as completed Jan 5, 2021

mYnDstrEAm reopened this Jan 5, 2021

mYnDstrEAm changed the title ~~Firejail profile for VsCodium doesn't work: /run/user/1000 & 2 directories not writable~~ Firejail profile for VsCodium doesn't work: vscodium was renamed to codium Jan 5, 2021

mYnDstrEAm mentioned this issue Jan 12, 2021

Getting "Permission denied" when running Electron apps with --no-sandbox #3883

Closed

rusty-snake mentioned this issue Apr 12, 2021

vscodium: missing profile redirect for codium #4183

Closed

rusty-snake added this to the 0.9.66 milestone Jun 11, 2021

mYnDstrEAm mentioned this issue Jul 29, 2021

vscodium: crashes due to seccomp #4428

Closed

7 tasks

kmk3 mentioned this issue Oct 5, 2021

profiles: vscodium: add missing paths & codium redirect #4587

Merged

netblue30 closed this as completed in #4587 Oct 9, 2021

kmk3 changed the title ~~Firejail profile for VsCodium doesn't work: vscodium was renamed to codium~~ vscodium: missing profile redirect: vscodium was renamed to codium Sep 3, 2024

kmk3 mentioned this issue Sep 4, 2024

vscodium: missing profile redirect for codium #6461

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

vscodium: missing profile redirect: vscodium was renamed to codium #3871

vscodium: missing profile redirect: vscodium was renamed to codium #3871

mYnDstrEAm commented Jan 5, 2021

rusty-snake commented Jan 5, 2021

mYnDstrEAm commented Jan 5, 2021

mYnDstrEAm commented Jan 5, 2021 •

edited

Loading

rusty-snake commented Jan 5, 2021

rusty-snake commented Jan 5, 2021 •

edited

Loading

mYnDstrEAm commented Jan 5, 2021 •

edited

Loading

rusty-snake commented Jan 6, 2021 •

edited

Loading

mYnDstrEAm commented Jan 6, 2021 •

edited

Loading

mYnDstrEAm commented Jan 8, 2021

rusty-snake commented Jan 9, 2021

rusty-snake commented Apr 6, 2021

kmk3 commented Oct 4, 2021

kmk3 commented Oct 5, 2021 •

edited

Loading

kmk3 commented Oct 5, 2021

vscodium: missing profile redirect: vscodium was renamed to codium #3871

vscodium: missing profile redirect: vscodium was renamed to codium #3871

Comments

mYnDstrEAm commented Jan 5, 2021

rusty-snake commented Jan 5, 2021

mYnDstrEAm commented Jan 5, 2021

mYnDstrEAm commented Jan 5, 2021 • edited Loading

rusty-snake commented Jan 5, 2021

rusty-snake commented Jan 5, 2021 • edited Loading

mYnDstrEAm commented Jan 5, 2021 • edited Loading

rusty-snake commented Jan 6, 2021 • edited Loading

mYnDstrEAm commented Jan 6, 2021 • edited Loading

mYnDstrEAm commented Jan 8, 2021

rusty-snake commented Jan 9, 2021

rusty-snake commented Apr 6, 2021

kmk3 commented Oct 4, 2021

kmk3 commented Oct 5, 2021 • edited Loading

kmk3 commented Oct 5, 2021

mYnDstrEAm commented Jan 5, 2021 •

edited

Loading

rusty-snake commented Jan 5, 2021 •

edited

Loading

mYnDstrEAm commented Jan 5, 2021 •

edited

Loading

rusty-snake commented Jan 6, 2021 •

edited

Loading

mYnDstrEAm commented Jan 6, 2021 •

edited

Loading

kmk3 commented Oct 5, 2021 •

edited

Loading