{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/126","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/126/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/126/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/126/events","html_url":"https://github.com/netblue30/firejail/issues/126","id":115883593,"number":126,"title":"With v. 0.9.34 services don't start anymore","user":{"login":"curiosity-seeker","id":14075215,"avatar_url":"https://avatars.githubusercontent.com/u/14075215?v=3","gravatar_id":"","url":"https://api.github.com/users/curiosity-seeker","html_url":"https://github.com/curiosity-seeker","followers_url":"https://api.github.com/users/curiosity-seeker/followers","following_url":"https://api.github.com/users/curiosity-seeker/following{/other_user}","gists_url":"https://api.github.com/users/curiosity-seeker/gists{/gist_id}","starred_url":"https://api.github.com/users/curiosity-seeker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/curiosity-seeker/subscriptions","organizations_url":"https://api.github.com/users/curiosity-seeker/orgs","repos_url":"https://api.github.com/users/curiosity-seeker/repos","events_url":"https://api.github.com/users/curiosity-seeker/events{/privacy}","received_events_url":"https://api.github.com/users/curiosity-seeker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/netblue30/firejail/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2015-11-09T14:09:34Z","updated_at":"2015-11-10T09:30:23Z","closed_at":null,"body":"I have unbound and dnscrypt-proxy sandboxed with Firejail. Unfortunately, with v. 0.9.34 those services don't start anymore with my old self-made profile. But even with the default server.profile it doesn't work. Example:\r\n\r\n`````\r\ndnscrypt-proxy.service - DNSCrypt client proxy\r\n   Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor preset: disabled)\r\n  Drop-In: /etc/systemd/system/dnscrypt-proxy.service.d\r\n           └─override.conf\r\n   Active: inactive (dead) since Mo 2015-11-09 14:56:15 CET; 9s ago\r\n  Process: 9259 ExecStart=/usr/bin/firejail --profile=/etc/firejail/server.profile /usr/bin/dnscrypt-proxy --ephemeral-keys --resolver-name=dnscrypt.eu-nl --local-address=127.0.0.1:40 --user=nobody (code=exited, status=0/SUCCESS)\r\n Main PID: 9259 (code=exited, status=0/SUCCESS)\r\n\r\nNov 09 14:56:15 hannibal firejail[9259]: Reading profile /etc/firejail/disable-mgmt.inc\r\nNov 09 14:56:15 hannibal firejail[9259]: [INFO] + DNS Security Extensions are supported\r\nNov 09 14:56:15 hannibal firejail[9259]: [INFO] - [dnscrypt.eu-nl] does not support Namecoin domains\r\nNov 09 14:56:15 hannibal firejail[9259]: [INFO] + Provider supposedly doesn't keep logs\r\nNov 09 14:56:15 hannibal firejail[9259]: [NOTICE] Starting dnscrypt-proxy 1.6.0\r\nNov 09 14:56:15 hannibal firejail[9259]: [INFO] Ephemeral keys enabled - generating a new seed\r\nNov 09 14:56:15 hannibal firejail[9259]: [INFO] Done\r\nNov 09 14:56:15 hannibal firejail[9259]: Parent pid 9259, child pid 9260\r\nNov 09 14:56:15 hannibal firejail[9259]: The new log directory is /proc/9260/root/var/log\r\nNov 09 14:56:15 hannibal firejail[9259]: parent is shutting down, bye...\r\n````` \r\nAnd for unbound:\r\n`````\r\nunbound.service - Unbound DNS Resolver\r\n   Loaded: loaded (/usr/lib/systemd/system/unbound.service; enabled; vendor preset: disabled)\r\n  Drop-In: /etc/systemd/system/unbound.service.d\r\n           └─override.conf\r\n   Active: failed (Result: start-limit) since Mo 2015-11-09 15:05:13 CET; 3s ago\r\n  Process: 12103 ExecStart=/usr/bin/firejail --profile=/etc/firejail/server.profile /usr/bin/unbound -d (code=exited, status=0/SUCCESS)\r\n  Process: 12101 ExecStartPre=/bin/cp -f /etc/trusted-key.key /etc/unbound/ (code=exited, status=0/SUCCESS)\r\n Main PID: 12103 (code=exited, status=0/SUCCESS)\r\n\r\nNov 09 15:05:13 hannibal systemd[1]: unbound.service: Service hold-off time over, scheduling restart.\r\nNov 09 15:05:13 hannibal systemd[1]: Stopped Unbound DNS Resolver.\r\nNov 09 15:05:13 hannibal systemd[1]: unbound.service: Start request repeated too quickly.\r\nNov 09 15:05:13 hannibal systemd[1]: Failed to start Unbound DNS Resolver.\r\nNov 09 15:05:13 hannibal systemd[1]: unbound.service: Unit entered failed state.\r\nNov 09 15:05:13 hannibal systemd[1]: unbound.service: Failed with result 'start-limit'.\r\n`````\r\nBoth services start normally once un-firejailed. So something has changed in v. 0.9.34 but I can't figure out what exactly."},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/155368115","html_url":"https://github.com/netblue30/firejail/issues/126#issuecomment-155368115","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/126","id":155368115,"user":{"login":"curiosity-seeker","id":14075215,"avatar_url":"https://avatars.githubusercontent.com/u/14075215?v=3","gravatar_id":"","url":"https://api.github.com/users/curiosity-seeker","html_url":"https://github.com/curiosity-seeker","followers_url":"https://api.github.com/users/curiosity-seeker/followers","following_url":"https://api.github.com/users/curiosity-seeker/following{/other_user}","gists_url":"https://api.github.com/users/curiosity-seeker/gists{/gist_id}","starred_url":"https://api.github.com/users/curiosity-seeker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/curiosity-seeker/subscriptions","organizations_url":"https://api.github.com/users/curiosity-seeker/orgs","repos_url":"https://api.github.com/users/curiosity-seeker/repos","events_url":"https://api.github.com/users/curiosity-seeker/events{/privacy}","received_events_url":"https://api.github.com/users/curiosity-seeker/received_events","type":"User","site_admin":false},"created_at":"2015-11-10T09:30:23Z","updated_at":"2015-11-10T09:30:23Z","body":"Hurra! This really works - both for dnscrypt-proxy and unbound. And btw., private-dev is no problem here.\r\n\r\nThanks a lot, netblue30, you're my hero ;-)"}}