firefox: cannot communicate with 1Password

[jovial-snyder]

I am running an up-to-date Firefox with Firejail 0.9.72 and the firefox.profile. I am also using 1Password (installed via the deb, and it's running without Firejail, so no sandbox at all). My goal now is to have the 1Password Firefox addon automatically unlocked when the 1Password desktop is unlocked. This works (as expected) when I run Firefox without Firejail, but doesn't when I use Firejail.

So the situation is very similar to using Firefox with the KeePassXC addon. But so far, my attempts to make it work have been unsuccessful. I think this could be of interest to many people, seeing that 1PW is a widely used password manager, especially on company-owned devices.

Any ideas?

Relates to:

• New profile: 1password #4874

[glitsj16]

Can you collect the ${RUNUSER} paths 1PW uses when you run Firefox without Firejail and post that here? If it is indeed similar to #5444 you will need to integrate those locations as indicated in that thread.

[jovial-snyder]

Hey. I wouldn't even know where to begin. No idea what the env variable RUNUSER is supposed to be or how I would get it from a running application like 1PW. As far as I can tell it's not explained in the Firejail documentation. The only thing I am aware of is https://man7.org/linux/man-pages/man1/runuser.1.html but I have no clue how this relates to Firejail or how I would get the paths I am looking for. It's not clear to me how they even found those KeePassXC paths in the issue you mentioned.

[glitsj16]

${RUNUSER} is a Firejail construct, comparable to ${DESKTOP}, ${DOCUMENTS}, ${DOWNLOADS} etc from the XDG specification. It expands to /run/user/<uid> so if your user is 1000 (a default on most Linux distro's) you will see a set of dirs/files exposed under /run/user/1000.

I've tried 1PW for a while to assist debugging this and - depending on configuration - I noticed it creates:

• /run/user/1000/1Password-BrowserSupport.sock
• /run/user/1000/s.sock <-- this only gets exposed if you enabled SSH Agent in Preferences (under devtools IIRC), which implies allowing access to ${HOME}/.ssh and ${HOME}/.1password

The latest 1PW version at least can also use polkit apparently. For that a whitelist /usr/share/polkit-1/actions/com.1password.1Password.policy is needed in 1password.profile.
And it exposes com.onepassword.OnePassword on the D-Bus session bus so we could filter on that too. BUT this is all relevant to firejailing 1PW and - sadly enough - doesn't help in your quest to communicate with Firefox as far as I have been able to test. Someone more familiar with 1PW might have ideas how this extra information can help in this context.

I couldn't even get unsandboxed 1PW to communicate with an unsandboxed Firefox. Always needed to unlock the web extension in the browser even though 1PW is unlocked. I'm afraid I gave up after a few days. At least we can ascertain that our current 1password.profile isn't very helpfull to users and IMO should be removed from firecfg.

[jovial-snyder]

I don't think the 1Password profile is the problem, it's the Firefox profile. I can get KeePassXC (not sandboxed) to work with Firefox (sandboxed) if I follow the steps mentioned in my initial post. But 1Password (not sandboxed) with Firefox (sandboxed) does not work, even if I try to add those changes you mentioned.

1PW + Firefox (both not sandboxed) does work for me after applying this fix.

[glitsj16]

1PW + Firefox (both not sandboxed) does work for me after applying this fix.

Thanks for the info. But the 1Password package from AUR I used to try to reproduce does have all the correct permissions and ownerships already. It still doesn't work for me here I'm afraid. I did notice it creates ${HOME}/.1Password (besides ${HOME}/.config/1Password). Maybe the profile needs whitelisted access to that path too, not sure. I do admit the 1Password app is a total black box to me. Hopefully someone with more insights chimes in...

[jaredmo]

I'm struggling with this as well. Anyone find a solution on the whitelist? Firefox and 1Password work together when Firejail is disabled.