lutris: modify_ldt: Operation not permitted

[Latrolage]

I play league of legends through lutris and want to run it in firejail. When I open the game the only error line which appears is thismodify_ldt: Operation not permitted. Here's what I tried

I addedseccomp !modify_ldt to my lutris.local and retried which didn't work and then removed that and added seccomp modify_ldt to my .profile and tried again but neither case seems to have done anything.
In each case respectively:

Seccomp list in: !chroot,!mount,!name_to_handle_at,!pivot_root,!ptrace,!umount2,!modify_ldt, check list: @default-keep, prelist: unknown,unknown,unknown,unknown,unknown,unknown,unknown,

Seccomp list in: !chroot,!mount,!name_to_handle_at,!pivot_root,!ptrace,!umount2,modify_ldt, check list: @default-keep, prelist: unknown,unknown,unknown,unknown,unknown,unknown,modify_ldt,

I also added ignore seccomp to the bottom of my .local and that seems to work. Ideally I want to just allow modify_ldt instead of ignore seccomp.

The above was all done on the default lutris.profile but I'm trying to get it work on my custom profile (which I want to run discord, steam and lutris in for discord rich presence). And for some reason, even adding ignore seccomp to the bottom of my games.profile doesn't make it work (it still shows the modify_ldt not permitted error)

System info

Arch Linux

❯ firejail --version
firejail version 0.9.70

Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- IDS support is disabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

my custom profiles

games.profile:

join-or-start games

#lutris
include lutris.local

#honkai
noblacklist ${HOME}/.local/share/honkers-launcher
whitelist ${HOME}/.local/share/honkers-launcher
private-bin killall
noblacklist ${HOME}/.local/share/gvfs-metadata/home
whitelist ${HOME}/.local/share/gvfs-metadata/home
private-bin honkers-launcher

# Firejail profile for discord
include discord.local
dbus-user.talk org.freedesktop.portal.Desktop # opening links in discord
# This file is overwritten after every install/update
# Persistent local customizations
#include discord-common.local
# Persistent global definitions
# added by caller profile
#include globals.local

# Disabled until someone reported positive feedback
ignore include disable-interpreters.inc
ignore include disable-xdg.inc
ignore include whitelist-runuser-common.inc
ignore include whitelist-usr-share-common.inc
ignore apparmor
ignore disable-mnt
ignore private-cache
ignore dbus-user none
ignore dbus-system none

ignore noexec ${HOME}
ignore novideo

whitelist ${HOME}/.config/BetterDiscord
whitelist ${HOME}/.local/share/betterdiscordctl

whitelist ${DOWNLOADS}
noblacklist ${HOME}/.config/discord
mkdir ${HOME}/.config/discord
whitelist ${HOME}/.config/discord
private-bin discord
private-opt discord
private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh
private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl

# Firejail profile for steam
# Description: Valve's Steam digital software delivery system
# This file is overwritten after every install/update
# Persistent local customizations
include steam.local
# Persistent global definitions
include globals.local

noblacklist ${HOME}/.config/Epic
noblacklist ${HOME}/.config/Loop_Hero
noblacklist ${HOME}/.config/MangoHud
noblacklist ${HOME}/.config/ModTheSpire
noblacklist ${HOME}/.config/RogueLegacy
noblacklist ${HOME}/.config/RogueLegacyStorageContainer
noblacklist ${HOME}/.killingfloor
noblacklist ${HOME}/.klei
noblacklist ${HOME}/.local/share/3909/PapersPlease
noblacklist ${HOME}/.local/share/aspyr-media
noblacklist ${HOME}/.local/share/bohemiainteractive
noblacklist ${HOME}/.local/share/cdprojektred
noblacklist ${HOME}/.local/share/Dredmor
noblacklist ${HOME}/.local/share/FasterThanLight
noblacklist ${HOME}/.local/share/feral-interactive
noblacklist ${HOME}/.local/share/HotlineMiami
noblacklist ${HOME}/.local/share/IntoTheBreach
noblacklist ${HOME}/.local/share/Paradox Interactive
noblacklist ${HOME}/.local/share/PillarsOfEternity
noblacklist ${HOME}/.local/share/RogueLegacy
noblacklist ${HOME}/.local/share/RogueLegacyStorageContainer
noblacklist ${HOME}/.local/share/Steam
noblacklist ${HOME}/.local/share/SteamWorldDig
noblacklist ${HOME}/.local/share/SteamWorld Dig 2
noblacklist ${HOME}/.local/share/SuperHexagon
noblacklist ${HOME}/.local/share/Terraria
noblacklist ${HOME}/.local/share/vpltd
noblacklist ${HOME}/.local/share/vulkan
noblacklist ${HOME}/.mbwarband
noblacklist ${HOME}/.paradoxinteractive
noblacklist ${HOME}/.prey
noblacklist ${HOME}/.steam
noblacklist ${HOME}/.steampath
noblacklist ${HOME}/.steampid
# needed for STEAM_RUNTIME_PREFER_HOST_LIBRARIES=1 to work
noblacklist /sbin
noblacklist /usr/sbin

# Allow java (blacklisted by disable-devel.inc)
include allow-java.inc

include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc

mkdir ${HOME}/.steam
mkfile ${HOME}/.steampath
mkfile ${HOME}/.steampid
whitelist ${HOME}/.config/Epic
whitelist ${HOME}/.config/Loop_Hero
whitelist ${HOME}/.config/MangoHud
whitelist ${HOME}/.config/ModTheSpire
whitelist ${HOME}/.config/RogueLegacy
whitelist ${HOME}/.config/RogueLegacyStorageContainer
whitelist ${HOME}/.config/unity3d
whitelist ${HOME}/.killingfloor
whitelist ${HOME}/.klei
whitelist ${HOME}/.local/share/3909/PapersPlease
whitelist ${HOME}/.local/share/aspyr-media
whitelist ${HOME}/.local/share/bohemiainteractive
whitelist ${HOME}/.local/share/cdprojektred
whitelist ${HOME}/.local/share/Dredmor
whitelist ${HOME}/.local/share/FasterThanLight
whitelist ${HOME}/.local/share/feral-interactive
whitelist ${HOME}/.local/share/HotlineMiami
whitelist ${HOME}/.local/share/IntoTheBreach
whitelist ${HOME}/.local/share/Paradox Interactive
whitelist ${HOME}/.local/share/PillarsOfEternity
whitelist ${HOME}/.local/share/RogueLegacy
whitelist ${HOME}/.local/share/RogueLegacyStorageContainer
whitelist ${HOME}/.local/share/Steam
whitelist ${HOME}/.local/share/SteamWorldDig
whitelist ${HOME}/.local/share/SteamWorld Dig 2
whitelist ${HOME}/.local/share/SuperHexagon
whitelist ${HOME}/.local/share/Terraria
whitelist ${HOME}/.local/share/vpltd
whitelist ${HOME}/.local/share/vulkan
whitelist ${HOME}/.mbwarband
whitelist ${HOME}/.paradoxinteractive
whitelist ${HOME}/.prey
whitelist ${HOME}/.steam
whitelist ${HOME}/.steampath
whitelist ${HOME}/.steampid
include whitelist-common.inc
include whitelist-var-common.inc

# NOTE: The following were intentionally left out as they are alternative
# (i.e.: unnecessary and/or legacy) paths whose existence may potentially
# clobber other paths (see #4225).  If you use any, either add the entry to
# steam.local or move the contents to a path listed above (or open an issue if
# it's missing above).
#mkdir ${HOME}/.config/RogueLegacyStorageContainer
#mkdir ${HOME}/.local/share/RogueLegacyStorageContainer

caps.drop all
ipc-namespace
#netfilter
nodvd
nogroups
nonewprivs
noroot
notv
nou2f
# For VR support add 'ignore novideo' to your steam.local.
novideo
protocol unix,inet,inet6,netlink
# seccomp sometimes causes issues (see #2951, #3267).
# Add 'ignore seccomp' to your steam.local if you experience this.
# mount, name_to_handle_at, pivot_root and umount2 are used by Proton >= 5.13
seccomp !chroot,!mount,!name_to_handle_at,!pivot_root,!ptrace,!umount2,modify_ldt
shell none
# tracelog breaks integrated browser
#tracelog

# private-bin is disabled while in testing, but is known to work with multiple games.
# Add the next line to your steam.local to enable private-bin.
private-bin awk,basename,bash,bsdtar,bzip2,cat,chmod,cksum,cmp,comm,compress,cp,curl,cut,date,dbus-launch,dbus-send,desktop-file-edit,desktop-file-install,desktop-file-validate,dirname,echo,env,expr,file,find,getopt,grep,gtar,gzip,head,hostname,id,lbzip2,ldconfig,ldd,ln,ls,lsb_release,lsof,lspci,lz4,lzip,lzma,lzop,md5sum,mkdir,mktemp,mv,netstat,ps,pulseaudio,python*,readlink,realpath,rm,sed,sh,sha1sum,sha256sum,sha512sum,sleep,sort,steam,steamdeps,steam-native,steam-runtime,sum,tail,tar,tclsh,test,touch,tr,umask,uname,update-desktop-database,wc,wget,wget2,which,whoami,xterm,xz,zenity
# Extra programs are available which might be needed for select games.
# Add the next line to your steam.local to enable support for these programs.
#private-bin java,java-config,mono
# To view screenshots add the next line to your steam.local.
#private-bin eog,eom,gthumb,pix,viewnior,xviewer

private-dev
# private-etc breaks a small selection of games on some systems. Add 'ignore private-etc'
# to your steam.local to support those.
private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl,vulkan
#private-tmp

read-only ${HOME}/.config/MangoHud
dbus-user.talk org.kde.StatusNotifierWatcher

private-bin kde-open5
ignore seccomp

discord.local:

whitelist ${HOME}/.cache
whitelist /opt/discord
whitelist ${HOME}/Pictures

noblacklist ${HOME}/.config/ibus
read-only ${HOME}/.config/ibus
noblacklist /run/user/1000/bus
read-only  /run/user/1000/bus

noblacklist ${HOME}/.config/fcitx5
read-only ${HOME}/.config/fcitx5
noblacklist ${HOME}/.config/fcitx
read-only ${HOME}/.config/fcitx

noblacklist ${HOME}/Videos/sendable
whitelist ${HOME}/Videos/sendable

ignore private-tmp
ignore protocol

noblacklist ${RUNUSER}
whitelist ${RUNUSER}

private-bin gdbus

dolphin-emu.local:

noblacklist ${HOME}/.cache/dolphin-emu
noblacklist ${HOME}/.config/dolphin-emu
noblacklist ${HOME}/.local/share/dolphin-emu

whitelist ${HOME}/.cache/dolphin-emu
whitelist ${HOME}/.config/dolphin-emu
whitelist ${HOME}/.local/share/dolphin-emu
whitelist /usr/share/dolphin-emu

private-bin dolphin,dolphin-tool
private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dconf,drirc,fonts,gconf,glvnd,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,kde4rc,kde5rc,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg

steam.local:

noblacklist ${HOME}/Pictures/steamimages
whitelist ${HOME}/Pictures/steamimages
read-only ${HOME}/Pictures/steamimages

noblacklist ${HOME}/.config/steamtinkerlaunch
whitelist ${HOME}/.config/steamtinkerlaunch

noblacklist /dev/input
noblacklist /dev/js*
noblacklist /dev/hidraw*
noblacklist /dev/input/event*
#ignore seccomp

noblacklist ${HOME}/git/godot
whitelist ${HOME}/git/godot
noblacklist ${HOME}/.cache/godot
noblacklist ${HOME}/.config/godot
noblacklist ${HOME}/.local/share/godot

noblacklist ${RUNUSER}
whitelist ${RUNUSER}
ignore netfilter

private-bin Xwayland,gamescope,gamemoderun,prime-run,steamtinkerlaunch,tee,nvim,rev,yad,git,pgrep,pidof,pkill,unzip,wine
private-bin gamescope,xprop,xrandr,xxd,xwininfo,xdotool,xkbcomp,vkcube

noblacklist /media/1tbsshd
whitelist /media/1tbsshd
noblacklist /media/4tbhdd
whitelist /media/4tbhdd

noblacklist /tmp/.X11-unix
noblacklist /tmp/.X11-unix/X0
whitelist /tmp/.X11-unix/X0

ignore noroot

[rusty-snake]

Likely you need a exception for i386 as well (--seccomp.32).

[Latrolage]

Running firejail --seccomp.32="\!modify_ldt" --profile=games lutris indeed does get it to start. How would I put this into a .profile or .local file though? i tried seccomp-32 !modify_ldt but apparently that just doesn't exist

[rusty-snake]

seccomp.32 !modify_ldt

[kmk3]

PR opened to fix Lutris:

• lutris.profile: fix running League of Legends #5449