0

I am looking at KeePassXC on my Linux Mint Cinnamon system. The installation and initial usage all went well, following the built-in tutorial; but there is a problem with Firefox integration.

After adding KeePassXC-Browser to Firefox, I had an error from the add-on:

Cannot connect to KeePassXC. Check that browser integration is enabled in KeePassXC settings.

The browser integration is enabled. I guess that the error occurs because I am running Firefox under firejail, so I plan to run KeePassXC under firejail also.

I am having problems running KeePassXC under firejail. I even can’t run KeePassXC from the command-line. Initially, I got an error that the executable was missing. I found it under /var/lib/flatpak/app and created a link. Then I got an error that shared library libqrencode.so.4 was not found.

This question is not about shared libraries, I know about $LD_LIBRARY_PATH, but I don’t know why the installation did not set up those things. There is nothing relevant in /etc/ld.so.conf.d or in $LD_LIBRARY_PATH. It almost seems that the installation is incomplete, but the GUI Software Manager reported no errors.

How do I run KeePassXC from the command line? Is my guess valid that firejail is isolating Firefox from KeePassXC? Can I run KeePassXC with firejail? Does anyone have any tips about running these three together?

(I am running the latest versions of Mint and the applications.)

Any help would be appreciated.

Improve this question
6
  • Are you running keepass as a flatpak app? AFAIK, firejail dropped support for flatpak as of 0.9.60, see firejail.wordpress.com/download-2/release-notes . But you can install keepassxc from mint repo, if that is good for you? Commented Jan 2, 2020 at 16:29
  • I checked the default keepassxc.profile in /etc/firejail, it has this line noblacklist ${HOME}/.mozilla which is needed for firefox integration. However, as I said, you cannot use it with flatpak. Commented Jan 2, 2020 at 16:42
  • @kmotoko Thanks for the ideas. I was previously using an old version of firejail from my repo, but upgraded to 0.9.62 from their site, so as to get keepassxc.profile. I'll update again after I have time to investigate further. Commented Jan 2, 2020 at 20:10
  • I guess I could not explain it clearly. By a flatpak app, I did not mean firejail, I meant keepassxc. snaps and flatpaks have their own type of sandboxing, and currently it is not possible to use firejail with a flatpak app. If you get keepassxc from the Linux Mint repos (or an official deb package, if there is any), then you would be able to use firejail with keepassxc flawlessly. Commented Jan 2, 2020 at 21:38
  • Also, it is a good idea to put firejail --debug firefox, firejail --debug keepassxc and which keepassxc output to your question. Commented Jan 2, 2020 at 21:45

1 Answer 1

Reset to default
0

Since the executable is found under /var/lib/flatpak/app, I am assuming you have installed keepassxc as a flatpak app. As of firejail v0.9.60, firejail does not have flatpak/snap support. See the release notes:

firejail (0.9.60) baseline; urgency=low
...
* drop support for flatpak/snap packages

If you want to sandbox keepassxc using firejail, you need to install it via the deb package, compile it from the source, or get the appimage. Since you are on Linux Mint, the most straightforward way is to install it from the repository, you can do it via:

sudo apt-get update sudo apt-get install keepassxc

Also, make sure that /etc/firejail/keepassxc.profile has the line noblacklist ${HOME}/.mozilla, which prevents the firefox directory from being blacklisted, so that keepassxc have access to the browser extension.

As a side note, flatpak and snap apps have their own way of sandboxing. For example, default flatpak build options result in:

  • No access to any host files except the runtime, the app and ~/.var/app/$APPID. Only the last of these is writable.
  • No access to the network.
  • No access to any device nodes (apart from /dev/null, etc).
  • No access to processes outside the sandbox.
  • Limited syscalls. For instance, apps can’t use nonstandard network socket types or ptrace other processes.
  • Limited access to the session D-Bus instance - an app can only own its own name on the bus.
  • No access to host services like X11, system D-Bus, or PulseAudio.

In addition, flatpak version is not officially supported by KeepassXC team, see here.


References

Improve this answer
2
  • My repo has two versions of KeePassXC, 2.5.1 as flatpak and 2.3.1. Downgrading fixed all my problems, I did not even need to edit keepassxc.profile. Commented Jan 4, 2020 at 14:41
  • Just for clarification, is 2.3.1 a deb package? Commented Jan 4, 2020 at 16:40

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.