Troubleshooting missing file access?

[Dieterbe]

Hi!
is there a general way to troubleshoot a containerized program, when it needs certain files, but you're not quite sure which?

specifically, i'm trying to fix my visual studio code. it mostly works, but when i launch a terminal inside code, i can tell from my zsh prompt that it's not loading my profile correctly.

i have a decent understanding of which files are needed, so therefore i added these to my code.local:

# for built-in terminal
noblacklist ${HOME}/.zshrc # note, this is a symlink to /home/dieter/.zprezto/runcoms/zshrc
noblacklist ${HOME}/.zprezto
noblacklist ${HOME}/.config/sh
noblacklist ${HOME}/.config/zsh
noblacklist ${HOME}/.dircolors
whitelist ${HOME}/.zshrc
whitelist ${HOME}/.zprezto
whitelist ${HOME}/.config/sh
whitelist ${HOME}/.config/zsh
whitelist ${HOME}/.dircolors

i also found the --keep-shell-rc option, so now instead of running code i run /usr/bin/firejail --keep-shell-rc /usr/bin/code (BTW is there a way to make this option the default, at least for code? so i don't need to run such a complicated command)

but still, my prompt looks like a standard prompt.

what i think would be nice for cases like these is an overview of:

1. files the containerized app tries to load, but fails
2. files the containerized app loads and succeeds, but maybe incorrect (e.g. broken symlinks)

i tried to use strace for this job, but:

strace /usr/bin/firejail --keep-shell-rc /usr/bin/code
(...)
openat(AT_FDCWD, "/proc/1/comm", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
read(3, "systemd\n", 1024)              = 8
close(3)                                = 0
openat(AT_FDCWD, "/proc/2/comm", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
read(3, "kthreadd\n", 1024)             = 9
close(3)                                = 0
setresuid(-1, 1000, -1)                 = 0
setresgid(-1, 1000, -1)                 = 0
setresuid(-1, 0, -1)                    = -1 EPERM (Operation not permitted)
setresgid(-1, 0, -1)                    = -1 EPERM (Operation not permitted)
newfstatat(AT_FDCWD, "/run", {st_mode=S_IFDIR|0755, st_size=760, ...}, 0) = 0
newfstatat(AT_FDCWD, "/run/firejail", {st_mode=S_IFDIR|0755, st_size=300, ...}, 0) = 0
newfstatat(AT_FDCWD, "/run/firejail", {st_mode=S_IFDIR|0755, st_size=300, ...}, 0) = 0
getpid()                                = 50873
openat(AT_FDCWD, "/run/firejail/firejail-run.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = -1 EACCES (Permission denied)
write(2, "Error: cannot create a lockfile "..., 67Error: cannot create a lockfile at /run/firejail/firejail-run.lock
) = 67
write(2, "Error ../../src/firejail/preproc"..., 82Error ../../src/firejail/preproc.c:47: preproc_lock_file: open: Permission denied
) = 82
exit_group(1)                           = ?
+++ exited with 1 +++

maybe i should run /usr/bin/firejail --keep-shell-rc /usr/bin/strace /usr/bin/code so i did

sudo cp /etc/firejail/code.profile /etc/firejail/strace.profile # this will still include my code.profile

and i added the following to my code.profile:

noblacklist /usr/bin/strace
whitelist /usr/bin/strace

so i should be able to run code via strace
but that results in

 ❯❯❯ /usr/bin/firejail --keep-shell-rc /usr/bin/strace /usr/bin/code
Reading profile /etc/firejail/strace.profile
Reading profile /home/dieter/.config/firejail/code.local
Reading profile /etc/firejail/allow-common-devel.inc
Reading profile /etc/firejail/electron-common.profile
Reading profile /etc/firejail/blink-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
firejail version 0.9.73

Parent pid 53569, child pid 53570
Warning: not remounting /var/lib/docker/overlay2/a511fcb55ad56d96937601db04680d601c12237b16b6927fc33779af0e16d37f/merged
Warning: not remounting /var/lib/docker/overlay2/45c778999b2e146173258e5b0d3f730cfacc44f771318ab5db008dd8df3d3bfe/merged
Warning: not remounting /var/lib/docker/overlay2/1f4373ce43c8f0cc19e805179f52f70709a5b240c19c0f6c42d33f70d7602d52/merged
Warning: not remounting /var/lib/docker/overlay2/6f06a259a6c2395186e9186fd6b38e31ef2499940649459d4696c7f66290cdf4/merged
Warning: not remounting /var/lib/docker/overlay2/a511fcb55ad56d96937601db04680d601c12237b16b6927fc33779af0e16d37f/merged
Warning: not remounting /var/lib/docker/overlay2/45c778999b2e146173258e5b0d3f730cfacc44f771318ab5db008dd8df3d3bfe/merged
Warning: not remounting /var/lib/docker/overlay2/1f4373ce43c8f0cc19e805179f52f70709a5b240c19c0f6c42d33f70d7602d52/merged
Warning: not remounting /var/lib/docker/overlay2/6f06a259a6c2395186e9186fd6b38e31ef2499940649459d4696c7f66290cdf4/merged
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 46.88 ms
Child process initialized in 66.29 ms
Error: no suitable /usr/bin/strace executable found

Parent is shutting down, bye...

[rusty-snake]

BTW is there a way to make this option the default, at least for code? so i don't need to run such a complicated command

You mean like in the profile?

[Dieterbe]

i meant more globally. my thinking was if an app is allowed to access files such as .bashrc and .zshrc, then i would want it to be the real files, so my aliases, env variables, etc work.
but on second thought, that's maybe not so wise. so yeah, in per-app profiles would work too :)

[rusty-snake]

To run strace inside of the sandbox you need allow-debuggers.

For straceing firejail too, see https://github.com/netblue30/firejail/wiki/Debugging-Firejail#strace

[rusty-snake]

noblacklist /usr/bin/strace
whitelist /usr/bin/strace

You likely want neither both.

For the noblacklist I'm unsure if it lifts the ${PATH}/strace blacklist.
You don't want the whitelist.

[Dieterbe]

i have added allow-debuggers both to /etc/firejai/strace.profile and to my code.local.
when i run /usr/bin/firejail --keep-shell-rc /usr/bin/strace /usr/bin/code i keep getting the same Error: no suitable /usr/bin/strace executable found even when i remove the whitelist, and when i remove both of the whitelist and the noblacklist

[kmk3]

is there a general way to troubleshoot a containerized program, when it needs
certain files, but you're not quite sure which?

Yes, firejail --trace=trace.txt /path/to/program.

If you use it instead of strace, what is the output in trace.txt?