i think i just emerged victorious from my 1 hour wrestling cage match with bwrap(1)
Timeline
Post
Remote status
Context
2me when my cli args have meaningful positions
more like chudwrap
Replies
10
@fiore bwrap and gnome, the worst combo: https://github.com/netblue30/firejail/issues/6906
@phnt why would running bwrap inside a firejail ever be expected to work , thats hyper fuarrrky edgecase scenario
@fiore Nothing about this is edge case. If you run any Gtk app sandboxed in firejail and open the file picker, the app will crash because gdk-pixbuf (more precisely glycin) can't handle being sandboxed like that. Gnome released a "fix" that was supposed to check whether the app was already sandboxed to disable bwrap, but that never worked. Gnome learned about the issue, released a fix that didn't work and didn't care beyond that.
Here's Audacity crashing, because I run it sandboxed after the whole network telemetry enabled by default thing: https://github.com/netblue30/firejail/issues/6940
Here's Audacity crashing, because I run it sandboxed after the whole network telemetry enabled by default thing: https://github.com/netblue30/firejail/issues/6940
@phnt dont use firejail as a jail and use bwrap instead ? there , solved it fpr you .
@fiore Break my setup, use something I don't want to, don't have installed and configured and frankly don't even know how to use properly. FOSS in $current_year. 
@fiore Sometimes I wish Linus's "don't break userspace" was taken more seriously.
@phnt > freedom is when two incompatible technologies dont Just Work together
@fiore I'm not even mad that they use bwrap since images are a notorious security vector. But at least put the effort to test it properly before release and fix things when it breaks especially when others report it. Even the release changelog doesn't mention that it might break when sandboxed outside build systems. It's not that unheard of to sandbox various GUI apps, especially when Flatpak heavily popularized it.
Note that this change has some potential for fallout: use of gdk-pixbuf (e.g. for pixdata conversions) will fail if bubblewrap sandboxing is not available (as is the case in many build systems). The recommendation is to simply stop using pixdata as a format for resources, and just use png.https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/releases/2.43.2
