Profile with join-or-start option does not work with "--profile="

Author: ferreumCreated Jan 17, 2023Updated Jun 14, 2026

Labelssecurity

Description

When specifying a profile with --profile= option that contains join-or-start, firejail fails to join an existing sandbox and prints an error. Starting the sandbox works. Only joining seems to be affected.

Steps to Reproduce

Assume a minimal profile joinme.profile for testing, that only contains a join-or-start option:

> cat joinme.profile
join-or-start joinme

In one terminal, run firejail with that profile:

> firejail --profile=joinme.profile sh
Reading profile joinme.profile
Parent pid 6936, child pid 6938
Child process initialized in 6.45 ms
sh-5.1$

While the first sandbox is running, run the same command in a separate terminal:

> firejail --profile=joinme.profile sh
Reading profile joinme.profile
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Error: --shell=none configured, but no program specified

Expected behavior

firejail joins the existing sandbox.

Actual behavior

firejail prints "Error: --shell=none configured, but no program specified" and exits.

Behavior without a profile

Joining without profile works:

> firejail --noprofile --join=joinme sh
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Child process initialized in 2.47 ms
sh-5.1$ exit
> firejail --noprofile --join-or-start=joinme sh
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Child process initialized in 3.27 ms
sh-5.1$

Additional context

Seems to be argument parsing related. Specifying --debug changes the error message (last line):

> firejail --debug --profile=joinme.profile sh
Reading profile joinme.profile
Switching to pid 6938, the first child process inside the sandbox
Changing root to /proc/6938/root
Set caps filter 1ffffffffff
Drop privileges: pid 4, uid 1000, gid 1000, force_nogroups 0
Error: invalid option --profile=joinme.profile after --join

That message makes no sense as there's no --join before --profile.

Environment

Linux distribution and version: Arch Linux
arch firejail pkg version 0.9.72-1

firejail version 0.9.72

Compile time support:
        - always force nonewprivs support is disabled
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - D-BUS proxy support is enabled
        - file transfer support is enabled
        - firetunnel support is disabled
        - IDS support is disabled
        - networking support is enabled
        - output logging is enabled
        - overlayfs support is disabled
        - private-home support is enabled
        - private-cache and tmpfs as user enabled
        - SELinux support is disabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

See "Steps to Reproduce" and "Additional context" above.

Source: netblue30/firejail

View original on GitHub View discussion on GitHub