Firefox 106 cant connect to KeePassXC 2.7.4

[ghost]

Hello,
I'm running Firefox 106 under Firejail.
On KeePassXC 2.7.1, browser integration was working with

whitelist ${RUNUSER}/kpxc_server
whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer

in firefox.local.

On version 2.7.4, it does not work, it says it cant exchange keys.
I have tried to add whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC but it does not fix the issue.
What should I do to make it work?

[varjolintu]

Possibly related: keepassxreboot/keepassxc#8704

[ghost]

I did forget to mention that it works when Firefox is not started via Firejail.

[rusty-snake]

I know https://github.com/netblue30/firejail/projects/6#card-83023753

[rusty-snake]

The whitelist is correct, but you also need to noblacklist because

firejail/etc/inc/disable-common.inc

Line 597 in e24eade

blacklist ${RUNUSER}/app

[droidmonkey]

The whitelist is correct, but you also need to noblacklist because

firejail/etc/inc/disable-common.inc

Line 597 in e24eade

blacklist ${RUNUSER}/app

Any reason why this subdirectory is blacklisted by default?

[rusty-snake]

It was added to the blacklist as part of blacklisting runtime files of other programs (flatpak(s) in this case). However it should be reconsidered and likely be removed.

[ghost]

I did just try with noblacklist added but it is still not working.

[rusty-snake]

Checklist:

• ${RUNUSER}/app/org.keepassxc.KeePassXC.BrowserServer exists _{edit: fixed path}
• firefox.local and keepassxc.local contain both the whitelist and the noblacklist
• keepassxc is started before firefox

If it still does not work, there's a third problem.

[ghost]

The file exists.
firefox.local contains said files.
KeePassXC is not running under Firejail, then no restriction on its side.
I'm starting KeePassXC at login reduced in systray so it's always running.
That was my tests conditions and still fails.

[michelesr]

This is what I use on my firefox profile (with Firefox 106.0.2):

whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer
noblacklist ${RUNUSER}/app
whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC

include /etc/firejail/firefox.profile

This is in my keepassxc profile:

noblacklist ${RUNUSER}/app
mkdir ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/wayland*

include /etc/firejail/keepassxc.profile

I reckon this is because they moved browser integration socket (and symlinked the old location to the new one)

$ readlink $XDG_RUNTIME_DIR/org.keepassxc.KeePassXC.BrowserServer
/run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer

Edit: I've added mkdir ${RUNUSER}/app/org.keepassxc.KeePassXC to the keepassxc profile because otherwise it won't be able to create the directory if it's not present already.

[rusty-snake]

Based on @michelesr answer:

~/.config/firejail/firefox.local:

noblacklist ${RUNUSER}/app
mkdir ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC

~/.config/firejail/keepassxc.local:

noblacklist ${RUNUSER}/app

[opqriu]

If I just create the above 2 files anew, will "wayland + debian stable gnome + firefox esr" be able to communicate with keepassxc-2.7.6?

My firefox esr is not communicating with keepassxc in firejail mode.

[rusty-snake]

Does it work w/o firejail?

Do you have any other modifications done to firejail provided profiles? Which version of firejail? Maybe try to upgrade firejail to the version from backports.

[cyberpunkrocker-zero]

@rusty-snake Thanks for the tip, and for your patience. Now both Brave and Firefox finally work.

[WhyNotHugo]

Submitted fixes in #5452

You'll still need to allow the socket path to be accessed by Firefox.

Sorry for breaking people's setup. The socket was moved to a dedicated directory so it is now possible to only share that directory with Firefox. Previously ${RUNUSER} had to be shared in its entirety, which is far from ideal.

[DistantThunder]

Hi, just to indicate that at least, on Arch Linux, in my setup (Firefox 112.x & KeepassXC 2.7.4 with only Firefox being jailed), I still had to add:

private-bin keepassxc-proxy

In addition to the comment: #5444 (comment) .

[rusty-snake]

That's because you added private-bin to your firefox.local. It's not a default configuration ("in my setup").

[master-bob]

Hello.

I'm not sure what I am doing wrong, or if I am doing anything wrong.

I am running:

• debian bullseye (PureOS)
• Firefox ESR 102.10.0
• Keepassxc 2.6.2
• firejail 0.9.64.4
• firejail-profiles 0.9.72-2~bpo11+1
• firejail 0.9.72-2~bpo11+1

Contents of firefox.local:

leonardo@anicca:~/.config/firejail$ cat firefox.local 
# Firefox local profile

# workaround to allow firefox to communicate with keepassxc
noblacklist ${RUNUSER}/app
mkdir ${RUNUSER}/app/org.keepassxc.KeePassXC
whitelist ${RUNUSER}/app/org.keepassxc.KeePassXC

Contents of keepassxc.local:

leonardo@anicca:~/.config/firejail$ cat keepassxc.local 
# keepassxc profile

# workaround to allow communication with keepassxc
noblacklist ${RUNUSER}/app

The KeepassXC-Browser Firefox extension can not connect to an unlocked Keepassxc.

If I start firefox with LC_ALL=C firejail --noprofile firefox this extension is able to connect.

I just saw that firejail 0.9.72 is available so I will attempt to that and report if it fixes. edit: it did not fix it.

[rusty-snake]

Update your KeePassXC or use the old sandbox unfriendly socket path.

[master-bob]

Bingo! Thanks, updating to 2.7.4 worked! 🙏