nautilus: cannot create new thumbnails (bwrap/userns)

[Froggy232]

Hi,

Sorry to bother you again, this time it's for a very little problem : since I applied firecfg, nautilus is not able to create thumbnails anymore. I still can see the previous ones, but all new files just stay with the default icons.

Would someone have an idea on how to fix the issue? I haven't find anything on internet.

It's not a big problem, but I would love to get back this feature.
Thanks you

[rusty-snake]

What's your firejail version? Or precisely asked was ffmpeg got firejailed?

[Froggy232]

Thanks, I will remove it. Do you know if there is other firejail rule I need to remove?
I suspect a problem from apparmor, I will keep the thread updated.

Thanks you!

[Froggy232]

So, the root cause wasn't firejail but linux-hardened : as it disable user-namespace, one need to replace bubblewrap with bubblewrap-suid (https://bugs.archlinux.org/task/63762).

Still, the PDF thumbnail doesn't work if I keep evince-thumbnailer firejailed.
I have simply commented all thumbnailers from firecfg.config for the moment, but if someone know what to add to .local files, I would be happy to try.

Best regards

[rusty-snake]

bubblewrap always sets the NO_NEW_PRIVS prctl which means firejails suid-bit is ignored and it will fail. There's nothing that can fix this by adding it to a .local. You can not use bubblewrap inside firejail and you can not use firejail inside bubblewrap. Double sandboxing usually makes more pain then it's worth. The thumbnailers are already sandboxed then.

That still leaves us with the question of how to proceed with it. Remove all thumbnailers from firecfg.config and reduce security of other filemanagers (except dolphin) or keep them and break nautilus? Opinions?

[Froggy232]

Right, I understand.
Personally, I have disable thumbnailers from firecfg.config as I only use nautilus, and as thumbnail are important to my workflow anyway, but I haven't the knowledge to have an opinon on a sane default TBH.
Thanks for your help, as always!
Have a nice day

[glitsj16]

That still leaves us with the question of how to proceed with it. Remove all thumbnailers from firecfg.config and reduce security of other filemanagers (except dolphin) or keep them and break nautilus? Opinions?

Personally I've always found it very tedious to do daily work/pleasure with a firejailed filemanager. Things tend to break left and right all the time and debugging/fixing all these (relatively minor) glitches lead to overly complex .local files, loss of time-hair-sanity etcetera. IMO a reasonably secure middleground is NOT to sandbox filemanagers BUT rely on tightly sandboxed individual applications used under the hood anyway - so preferably in whitelisting mode. When it comes to thumbnailing I would rather break nautilus than dropping functional apps from firecfg.config. But I'm old-skool (very) and tend to use filemanagers in detailed list-view mode anyway. If not seeing a big thumbnail is the price to pay for added (sense of) security, I'm happy to do so...

What's more important here IMO is that to inform/advise users on how to drop specific apps from being firecfg'ed by default needs improving - something I know @rusty-snake is well aware of / put extra work in - and probably the raison-d'etre for firecfg.py in the first place.