WebStorm debugging Node.js broken with common profile

[tredondo]

I'm pretty new to Firejail and I've just tried to debug a Node script with Webstorm, using the nodejs-common.profile. I get this error and the program aborts:

Error: Cannot find module '/tmp/debugConnector.211.6222.6.js'

I've added an ignore for private-tmp and now my ${CFG}/node.profile is this:

ignore private-tmp
include nodejs-common.profile

But I still get that error, the debugger doesn't start, and the program just runs:

Debugger listening on ws://127.0.0.1:44915/09ba7b49-f655-4bd8-92f8-331be21c8b9e
For help, see: https://nodejs.org/en/docs/inspector
Error getpwuid: main.c:236 init_cfg: Success
Error in JetBrains node debug connector:  Error: Command failed: /usr/local/bin/node /tmp/debugConnector.211.6222.6.js
    at checkExecSyncError (node:child_process:690:11)
    at execFileSync (node:child_process:709:15)
    at Object.<anonymous> (/tmp/debugConnector.211.6222.6.js:37:3)
    at Module._compile (node:internal/modules/cjs/loader:1092:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1121:10)
    at Module.load (node:internal/modules/cjs/loader:972:32)
    at Function.Module._load (node:internal/modules/cjs/loader:813:14)
    at Module.require (node:internal/modules/cjs/loader:996:19)
    at Module._preloadModules (node:internal/modules/cjs/loader:1251:12)
    at loadPreloadModules (node:internal/bootstrap/pre_execution:455:5) {
  status: 1,
  signal: null,
  output: [ null, null, null ],
  pid: 33,
  stdout: null,
  stderr: null
}

I had run ln -s /usr/bin/firejail /usr/local/bin/node and WebStorm is not firejailed.

The offending line turned out to be this,

private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg

I don't really understand what's going on there 🤔

[reinerh]

Error getpwuid: main.c:236 init_cfg: Success

This sounds like it tries to access /etc/passwd to get information about the user, and when you remove the private-etc line it works, as the file is then available.

[tredondo]

Adding ignore private-etc solved the problem, but @rusty-snake

or add passwd to the private-etc line, works too and is more secure.

I can't figure out the profile line format to ignore only /etc/passwd.

• debugging works:

  ignore private-tmp
  ignore private-etc
  include nodejs-common.profile
  

• this breaks debugging as in my OP:

  ignore private-tmp
  ignore private-etc passwd
  include nodejs-common.profile
  

[rusty-snake]

"add passwd" not "ignore passwd" => private-etc passwd.

[tredondo]

Thanks, that worked. So what happens in that case, when my node.profile has private-etc passwd then it includes nodejs-common, and that file has private-etc alternatives,ca-certificates,crypto-policies...? Are the lines additive, or only private-etc passwd gets interpreted, so some other stuff can break because the other directories listed after private-etc in nodejs-common.profile now won't be replicated? I can't find that documented clearly in man firejail-profile(5).

[rusty-snake]

private-etc and private-bin always accumulate.

[tredondo]

Thanks. I've sent a PR to document these changes in the Node.js profile.