Open Files on gvfs mounted devices

[MArpogaus]

Hi all,

I am trying to open a PDF on a samba share mounted using thunars volume manager.
The NAS gets mounted to /run/user/1000/gvfs/...

System information

OS: Manjaro Linux x86_64 
Kernel: 5.10.70-1-MANJARO
Firejail version: 0.9.66

zathura /run/user/1000/gvfs/smb-share:server=XXXXXXX.pdf

This is what happens if I try to open the file from terminal

Reading profile /etc/firejail/zathura.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/disable-write-mnt.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 374334, child pid 374335
1 program installed in 7.75 ms
Warning: skipping alternatives for private /etc
Warning fcopy: skipping /etc/fonts/conf.d/70-no-bitmaps.conf, cannot find inode
Private /etc installed in 12.83 ms
Private /usr/etc installed in 0.02 ms
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Blacklist violations are logged to syslog
Child process initialized in 262.05 ms

(zathura:11): dbind-WARNING **: 11:04:36.362: Couldn't connect to accessibility bus: Failed to connect to socket /tmp/dbus-R5MtrY0DYY: No such file or directory
error: cannot open /run/user/1000/gvfs/smb-share:server=XXXXXXXXXXXXX.pdf: No such file or directory
error: could not open document

Parent is shutting down, bye...

~/.config/firejail/zathura.local

I thought i could solve this issue by creating a local profile

noblacklist ${RUNUSER}/gvfs/
whitelist ${RUNUSER}/gvfs/

zathura /run/user/1000/gvfs/smb-share:server=XXXXXXXXXX.pdf

Now I have a new Error:

Reading profile /etc/firejail/zathura.profile
Reading profile /home/marcel/.config/firejail/zathura.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-shell.inc
Reading profile /etc/firejail/disable-write-mnt.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 374692, child pid 374693
1 program installed in 5.03 ms
Warning: skipping alternatives for private /etc
Warning fcopy: skipping /etc/fonts/conf.d/70-no-bitmaps.conf, cannot find inode
Private /etc installed in 11.20 ms
Private /usr/etc installed in 0.02 ms
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Error fstat: fs_whitelist.c:124 whitelist_file: Permission denied
Error: proc 374692 cannot sync with peer: unexpected EOF
Peer 374693 unexpectedly exited with status 

Any Idea how I could fix this problem?

Have a nice Day
Marcel

[rusty-snake]

gvfs (in general):

1. Make sure $XDG_RUNTIME_DIR/gvfs is accessible (inside the sandbox). This means you need to use whitelist ${RUNUSER}/gvfs if the profile includes whitelist-runuser-common.inc and mount it allow_root/allow_other. (There's not need to noblacklist here.)
2. Maybe you need to noblacklist ${HOME}/.local/share/gvfs-metadata (and whitelist). IDK.
3. You need to allow org.gtk.vfs.* (or parts of it). This means you need to add dbus-user.talk org.gtk.vfs.* if the policy is set to filter or if it is none to add the previous one and dbus-user filter and ignore dbus-user none.