Arch Linux

wtx

Member

Registered: 2014-06-09

Posts: 92

[SOLVED] Firejail and Neochat application

I'm trying to configure Firejail for proper running of Neochat application taken from AUR.

At the moment "neochat" is symlinked to "/usr/bin/firejail" and there is default, ready to use Firejail profile for neochat in "/etc/firejail/neochat.profile" file.

The issue I've got is that during the start of application I get the error message: "Unable to read access token: org.freedsktop.DBus.Error.ServiceUnknown" at the bottom of the app window and the application isn't able to restore the account settings.
When I start neochat without Firejail profile everything works properly - it restores the account from stored on disk settings. The issue is only when using the default "neochat.profile".

I'm not sure but seems like the issue is with communication of NeoChat app with user DBus.
I disabled user DBus settings in: "${HOME}/.config/firejail/neochat.local" file:

  whitelist ${HOME}/.local/state
  ignore dbus-user

The first line should allow to re/store the state of NeoChat application and the second line perhaps removes the user DBus restrictions from "/etc/firejail/neochat.profile".
This additional "neochat.local" file fixes the issue but isn't the DBus permissions too wide in this case?
If yes how can I find out what keys (addresses) in DBus communication the NeoChat app is trying to use? I'd like to narrow down the number of allowed addresses to minimum.

Is the "strace" the only option here?

Last edited by wtx (2026-10-17 05:05:40)

gabrielsec

Member

From: Brazil | Rio De Janeiro

Registered: 2026-10-16

Posts: 18

Re: [SOLVED] Firejail and Neochat application

`strace` isn't the only option. Firejail has built-in D-Bus logging through `--dbus-user.log`. The Firejail manual documents this option, and the ArchWiki Firejail guide covers application profiles.

I'd first remove `ignore dbus-user` from `~/.config/firejail/neochat.local` while keeping the `whitelist ${HOME}/.local/state` rule. This lets you test the filesystem change without disabling the profile's D-Bus restrictions.

Then launch NeoChat with D-Bus logging enabled, using the actual NeoChat executable rather than the symlink that points to Firejail. If the executable is `/usr/bin/neochat`, run:

firejail --profile=/etc/firejail/neochat.profile --dbus-user.log /usr/bin/neochat 2>&1 | tee "$HOME/neochat-dbus.log"

Reproduce the error and inspect `~/neochat-dbus.log`. The D-Bus error alone doesn't tell us which service needs access, so I'd identify the relevant bus name from the log before adding permissions.

Once identified, use the narrowest suitable rule: `dbus-user.talk` allows communication with a bus name, while `dbus-user.call` can restrict access to specific interfaces, methods, and object paths. See the Firejail profile documentation.

I'd avoid keeping `ignore dbus-user`, since the goal is to retain the D-Bus filtering and allow only what NeoChat actually needs.

Regards, 
Gabriel

---

The more we help each other, the better the world becomes.

Share knowledge, be kind, and don't let toxicity define the community.

wtx

Member

Registered: 2014-06-09

Posts: 92

Re: [SOLVED] Firejail and Neochat application

How could I miss the "--dbus-user.log" option when reading the manual?

I tried this option and it turned out that I needed this additional line to my "neochat.local" file:

dbus-user.talk org.freedesktop.secrets

after removing "ignore dbus-user".

So finally my "neochat.local" file looks like this:

whitelist ${HOME}/.local/state
dbus-user.talk org.freedesktop.secrets

It fixes my issue. Thanks.