thunderbird: Failed to connect to Wayland display

[Gilrain]

Description

Thunderbird fails to launch with the default profile, stating it cannot find a WAYLAND_DISPLAY.

Commenting the following in thunderbird.profile allows the program to start normally:

ignore include whitelist-runuser-common.inc

Steps to Reproduce

$ Reading profile /etc/firejail/thunderbird.profile
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /home/user/.config/firejail/firefox-common.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-proc.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
firejail version 0.9.74

Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 9078, child pid 9082
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Private /etc installed in 50.04 ms
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 122.56 ms
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Warning: Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior.
Child process initialized in 246.16 ms
[39] Wayland Proxy [0x7f51a896e460] Error: CheckWaylandDisplay(): Failed to connect to Wayland display '/run/user/1000/wayland-1' error: No such file or directory
Error: we don't have any display, WAYLAND_DISPLAY='wayland-1' DISPLAY=':0'

Parent is shutting down, bye...

Behavior without a profile

$ LC=ALL firejail --noprofile /usr/bin/thunderbird
firejail version 0.9.74

Parent pid 20455, child pid 20456
Base filesystem installed in 0.03 ms
Child process initialized in 6.33 ms

Environment

• Name/version/arch of the Linux kernel: Linux 6.15.8-1 x86_64
• Name/version of the Linux distribution: Arch Linux
• Name/version of the relevant program(s)/package(s): thunderbird 141.0-1
• Version of Firejail: 0.9.74

Additional context

firefox-common.local:

noblacklist ${RUNUSER}/app
whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/kpxc_server
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

ignore disable-mnt
whitelist ${DOWNLOADS}

dbus-user.talk org.freedesktop.Notifications
dbus-user.talk org.freedesktop.ScreenSaver
dbus-user.talk org.kde.kdeconnect
dbus-user.talk org.freedesktop.portal.Desktop

Log

Output of LC_ALL=C firejail --debug /usr/bin/thunderbird

https://gist.github.com/Gilrain/e8d3dd62f562a5a450bd890299f829ad.js

Output of env | grep DISPLAY

WAYLAND_DISPLAY=wayland-1
DISPLAY=:0

Output of ls -l /run /run/user/1000

/run:
total 4
drwxr-xr-x  2 root    root     80 28 juil. 10:18 blkid
drwxr-xr-x  2 clamav  clamav  100 28 juil. 09:55 clamav
drwxr-xr-x  4 root    root     80 28 juil. 09:48 credentials
drwx------  2 root    root     40 28 juil. 09:33 cryptsetup
drwxr-xr-x  3 root    cups     80 28 juil. 09:33 cups
drwxr-xr-x  2 root    root     60 28 juil. 09:33 dbus
prw-------  1 root    root      0 28 juil. 09:33 dmeventd-client
prw-------  1 root    root      0 28 juil. 09:33 dmeventd-server
drwxr-xr-x  2 root    root     60 28 juil. 09:34 faillock
drwxr-xr-x 13 root    root    300 28 juil. 09:34 firejail
srwxr-xr-x  1 greeter greeter   0 28 juil. 09:33 greetd-893.sock
-rw-r--r--  1 root    root      0 28 juil. 09:33 greetd.run
drwxr-xr-x  2 root    root     40 28 juil. 09:33 initramfs
drwxr-xr-x  3 root    root    100 28 juil. 09:33 lock
drwxr-xr-x  3 root    root     60 28 juil. 09:33 log
drwxr-xr-x  2 root    root     40 28 juil. 09:33 media
drwxr-xr-x  2 root    root    100 28 juil. 09:34 mount
drwxr-x---  2 named   named    40 28 juil. 09:33 named
drwxrwx---  2 nut     nut      80 28 juil. 09:33 nut
srwxrwx---  1 root    seat      0 28 juil. 09:33 seatd.sock
drwxr-xr-x  2 root    root     60 28 juil. 09:33 ssh-unix-local
drwx--x--x  3 root    root     60 28 juil. 09:33 sudo
drwx------  2 root    root     40 28 juil. 09:33 svnserve
drwxr-xr-x 23 root    root    660 28 juil. 10:19 systemd
drwxr-xr-x  2 root    root     60 28 juil. 09:33 tmpfiles.d
drwxr-xr-x  3 root    root     60 28 juil. 09:33 tpm2-tss
drwxr-xr-x  8 root    root    180 28 juil. 09:34 udev
drwx------  2 root    root     40 28 juil. 09:34 udisks2
drwxr-xr-x  3 root    root     60 28 juil. 09:34 user
-rw-rw-r--  1 root    utmp    768 28 juil. 09:54 utmp
drwxrwsr-x  2 uuidd   uuidd    40 28 juil. 09:33 uuidd

/run/user/1000:
total 4
drwxr-xr-x 3 user user  60 28 juil. 09:34 app
srw-rw-rw- 1 user user   0 28 juil. 09:34 bus
drwx------ 2 user user  60 28 juil. 10:19 dconf
dr-x------ 2 user user   0  1 janv.  1970 doc
drwx------ 2 user user  60 28 juil. 09:34 gcr
drwx------ 2 user user 160 28 juil. 09:34 gnupg
dr-x------ 2 user user   0 28 juil. 09:34 gvfs
drwx------ 2 user user  60 28 juil. 10:19 gvfsd
drwx------ 3 user user  60 28 juil. 09:34 hypr
drwx------ 2 user user  80 28 juil. 09:34 keyring
lrwxrwxrwx 1 user user  80 28 juil. 09:34 org.keepassxc.KeePassXC.BrowserServer -> /run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer
drwxr-xr-x 2 user user  60 28 juil. 09:34 p11-kit
srw-rw-rw- 1 user user   0 28 juil. 09:34 pipewire-0
-rw-r----- 1 user user   0 28 juil. 09:34 pipewire-0.lock
srw-rw-rw- 1 user user   0 28 juil. 09:34 pipewire-0-manager
-rw-r----- 1 user user   0 28 juil. 09:34 pipewire-0-manager.lock
drwx------ 2 user user  80 28 juil. 09:34 pulse
drwxr-xr-x 8 user user 200 28 juil. 09:34 systemd
drwxr-xr-x 2 user user  80 28 juil. 09:34 uwsm
srwxr-xr-x 1 user user   0 28 juil. 09:34 wayland-1
-rw-r----- 1 user user   0 28 juil. 09:34 wayland-1.lock

Output of firejail --profile=thunderbird ls -l /run /run/user/1000

/run:
total 0
drwxr-xr-x  2 nobody nobody  60 28 juil. 10:26 cups
drwxr-xr-x  2 nobody nobody  60 28 juil. 10:26 dbus
drwxr-xr-x 13 nobody nobody 300 28 juil. 09:34 firejail
drwxr-xr-x  2 nobody nobody  40 28 juil. 09:33 media
drwxr-xr-x  3 nobody nobody  60 28 juil. 10:26 systemd
drwxr-xr-x  3 nobody nobody  60 28 juil. 10:26 udev
drwxr-xr-x  3 nobody nobody  60 28 juil. 10:26 user

/run/user/1000:
total 0
drwxr-xr-x 3 user user 60 28 juil. 10:26 app
lrwxrwxrwx 1 user user 80 28 juil. 10:26 org.keepassxc.KeePassXC.BrowserServer -> /run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer

[kmk3]

Basic debugging information is missing; please follow the bug report template:

• https://github.com/netblue30/firejail/issues/new?template=bug_report.md

[kmk3]

Commenting the following in thunderbird.profile allows the program to start
normally:

ignore include whitelist-runuser-common.inc

Cannot reproduce.

This looks like it's due to local modifications.

Is there anything in any globals.local?

$ LC=ALL firejail /usr/bin/thunderbird

This should be:

$ LC_ALL=C firejail /usr/bin/thunderbird

$ LC=ALL firejail /usr/bin/thunderbird
[...]
Child process initialized in 246.71 ms
[39] Wayland Proxy [0x7f997886e790] Error: CheckWaylandDisplay(): Failed to connect to Wayland display '/run/user/1000/wayland-1' error: Aucun fichier ou dossier de ce nom
Error: we don't have any display, WAYLAND_DISPLAY='wayland-1' DISPLAY=':0'

Parent is shutting down, bye...

What is the output of the following?

env | grep DISPLAY
ls -l /run /run/user/1000
firejail --profile=thunderbird ls -l /run /run/user/1000

[Gilrain]

Sorry, the report was not complete: I had modified firefox-common.profile to enable some dbus functionalities. These cause thunderbird to fail. Of course, Firefox 141 works.
I amended the report.

[rusty-snake]

whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/kpxc_server
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

If you add one of them to your firefox-common.local, you revoke access to x11/wayland/pulseaudio/ .... for thunderbird.

Either don't add them to firefox-common but firefox.local instead or make sure thunderbird includes whitelist-runuser-common.inc if it does not break things (gpg) for you.

---

@kmk3 b787548 moved these three lines from the browser profiles to firefox-common, leading users into a wrong direction.

[kmk3]

whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/kpxc_server
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

If you add one of them to your firefox-common.local, you revoke access to
x11/wayland/pulseaudio/ .... for thunderbird.

Good catch, should be fixed in:

• profiles: thunderbird: fix ignoring wruc #6852