I'm trying to use firejail (version for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application but I wasn't successful in doing so.

Currently I'm trying to write a custom man.profile-file, since it sounds quite easy. I put a file with the following content in my ~/.config/firejail/-directory:

noblacklist /usr/share/man/
noblacklist /usr/lib/man-db/

include whitelist-var-common.inc

shell none

private-bin sed,less,man,groff,nroff,tbl,bash

But when I run man less, my pager opens only with an empty page and after closing I can read following error message:

Reading profile /home/$USER/.config/firejail/man.profile
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 42020, child pid 42045
7 programs installed in 10.65 ms
Child process initialized in 10.69 ms
/usr/bin/man: command exited with status 255: (cd /usr/share/man && /usr/lib/man-db/zsoelim) | (cd /usr/share/man && /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t ISO-8859-1//IGNORE) | (cd /usr/share/man && tbl) | (cd /usr/share/man && nroff -mandoc -rLL=189n -rLT=189n -Tutf8)

What am I doing wrong? Any ideas/pointers are appreciated!

Update (thanks @@artem-s-tashkinov): when running strace -f -e file -o /tmp/man.log man less (after first performing sudo firecfg --clean) and examining the output of /tmp/man.log I found that several other files were read while invoking man less. Therefore I updated the lines starting with private-bin and private-lib to include the following:

private-bin sed,less,man,groff,nroff,tbl,bash,terminfo,locale
private-lib /usr/lib/man-db,/usr/share/groff,/usr/share/locale,/usr/share/terminfo,/usr/share/man,/usr/lib/x86_64-linux-gnu,/lib/x86_64-linux-gnu,/usr/lib/charset.alias,/etc/ld.so.preload,/etc/ld.so.cache,/etc/manpath.config,/etc/suid-debug,/etc/terminfo,/etc/sysless,/etc/localtime

But the result is still negative: man less yields the following error:

bin/bash: error while loading shared libraries: libtinfo.so.6: cannot open shared object file: No such file or directory                                                                        
/usr/bin/man: command exited with status 127: (cd /usr/share/man && /usr/lib/man-db/zsoelim) | (cd /usr/share/man && /usr/lib/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE) | (cd /usr/share/man && preconv -e UTF-8) | (cd /usr/share/man && tbl) | (cd /usr/share/man && nroff -mandoc -rLL=189n -rLT=189n -Tutf8)                                                                        

When looking for the location of libtinfo.so.6 using find /lib -name "*libtinfo*" the result is in /lib/x86_64-linux-gnu/, which is included in the private-lib-line.

And when eliminating the lines starting with private-bin and private-lib, it works (but obviously without the additional sandboxing).

1 Answer 1


Run it via strace -fF -e file -o /tmp/man.log man less first to see which extra directories you need to include for the command to work under firejail.

At least on my Fedora 32 these additional directories are required:

  • /usr/share/groff
  • /usr/share/locale - this one is probably already included by whitelist-var-common.inc
  • /usr/share/terminfo
  • @artem-s-tashkinov: thanks for the fast reply! I included the following line to my man.profile: private-lib /usr/share/groff,/usr/share/locale,/usr/share/terminfo but now I get a WARNING: terminal is not fully functional and it still only outputs an empty page.
    – n0542344
    Commented Oct 28, 2020 at 19:29
  • 1
    A debian patch says these command currently don't work under firejail: sources.debian.org/patches/firejail/0.9.64-1/… Or maybe you haven't whitelisted all the required directories. Commented Oct 28, 2020 at 19:33
  • @artem-s-tashkinov: well, that's a pity... I just figured out that I could run it without the private-bin ...-part of the file. This defeats (partially) the sandboxing-idea, but it's a better option than not using firejail at all.
    – n0542344
    Commented Oct 28, 2020 at 19:38
  • @artem-s-tashkinov: by the way: strace outputs strace: deprecated option -F ignored.
    – n0542344
    Commented Oct 28, 2020 at 19:40
  • Old habits never die :-) Commented Oct 29, 2020 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .