lutris: GE-Proton (Latest) wine version

[cfebs]

Having problems with lutris when I try to use the GE-Proton (Latest) as the wine version. With a new lutris app the wine prefix creation hangs.

2025-07-24 13:14:23,419: The game doesn't have an executable
2025-07-24 13:14:23,421: The game 'wine_test' has no ID, it is not stored in the database.
2025-07-24 13:14:23,435: No path found in LutrisConfig(level=game, game_config_id=wine_test-1753377263, runner=wine)
2025-07-24 13:14:23,435: No path for wine_test (wine)
2025-07-24 13:14:32,993: No valid prefix detected in /home/user/Games/wine_test, creating one...
2025-07-24 13:14:32,993: Creating a win64 prefix in /home/user/Games/wine_test
2025-07-24 13:14:32,993: Winepath: /home/user/.local/share/lutris/runners/proton/ge-proton/files/bin/wine
2025-07-24 13:15:03,498: Wine prefix creation is taking longer than expected...

Don't see any windows app dialog that you usually see when a new wine prefix is created.

With an existing lutris app, changing to GE-Proton (Latest) gives a bit more information when viewing logs:

...
[umu.umu_run:865] DEBUG: STORE=none
[umu.umu_run:865] DEBUG: PROTON_VERB=waitforexitandrun
[umu.umu_run:865] DEBUG: UMU_ID=umu-default
[umu.umu_run:865] DEBUG: UMU_ZENITY=
[umu.umu_run:865] DEBUG: UMU_NO_RUNTIME=
[umu.umu_run:865] DEBUG: UMU_RUNTIME_UPDATE=
[umu.umu_run:865] DEBUG: UMU_NO_PROTON=
[umu.umu_run:865] DEBUG: RUNTIMEPATH=/home/user/.local/share/umu/steamrt3
[umu.umu_run:865] DEBUG: UMU_STEAM_GAME_ID=
[umu.umu_run:865] DEBUG: UMU_INVOCATION_ID=eb61760addcc777d9f13b2df0bb98850
[umu.umu_runtime:474] DEBUG: Acquiring file lock '/home/user/.local/share/umu/umu.lock'...
[umu.umu_runtime:476] DEBUG: Acquired file lock '/home/user/.local/share/umu/umu.lock'
[umu.umu_runtime:481] DEBUG: Released file lock '/home/user/.local/share/umu/umu.lock'
[umu.umu_runtime:376] INFO: steamrt3 is up to date
[umu.umu_run:887] DEBUG: (PosixPath('/home/user/.local/share/umu/steamrt3/umu'), '--verb', 'waitforexitandrun', '--', PosixPath('/home/user/.local/share/umu/steamrt3/umu-shim'), PosixPath('/home/user/.local/share/lutris/runners/proton/ge-proton/proton'), 'waitforexitandrun', '/home/user/Games/turtle_prefix/drive_c/game.exe')
[umu.umu_run:664] DEBUG: prctl exited with status: 0
gamemodeauto: 
gamemodeauto: 
pressure-vessel-wrap[608]: E: Child process exited with code 1: bwrap: No permissions to creating new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'.

[umu.umu_run:668] DEBUG: Child 608 exited with wait status: 1
gamemodeauto: 
Monitored process exited.
Initial process has exited (return code: 256)
All processes have quit
Exit with return code 256

The key line looks like:

pressure-vessel-wrap[608]: E: Child process exited with code 1: bwrap: No permissions to creating new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'.

If I copy the lutris profile and customize it to comment #restrict-namespaces

$ firejail --profile=/home/user/.config/firejail/lutris_custom.profile --private=/home/user/.firejail/lutris /usr/bin/lutris

The failure logs are slightly different

[umu.umu_run:865] DEBUG: STORE=none
[umu.umu_run:865] DEBUG: PROTON_VERB=waitforexitandrun
[umu.umu_run:865] DEBUG: UMU_ID=umu-default
[umu.umu_run:865] DEBUG: UMU_ZENITY=
[umu.umu_run:865] DEBUG: UMU_NO_RUNTIME=
[umu.umu_run:865] DEBUG: UMU_RUNTIME_UPDATE=
[umu.umu_run:865] DEBUG: UMU_NO_PROTON=
[umu.umu_run:865] DEBUG: RUNTIMEPATH=/home/user/.local/share/umu/steamrt3
[umu.umu_run:865] DEBUG: UMU_STEAM_GAME_ID=
[umu.umu_run:865] DEBUG: UMU_INVOCATION_ID=f1e2b00eba21d009ce032065650bddbb
[umu.umu_runtime:474] DEBUG: Acquiring file lock '/home/user/.local/share/umu/umu.lock'...
[umu.umu_runtime:476] DEBUG: Acquired file lock '/home/user/.local/share/umu/umu.lock'
[umu.umu_runtime:481] DEBUG: Released file lock '/home/user/.local/share/umu/umu.lock'
[umu.umu_runtime:376] INFO: steamrt3 is up to date
[umu.umu_run:887] DEBUG: (PosixPath('/home/user/.local/share/umu/steamrt3/umu'), '--verb', 'waitforexitandrun', '--', PosixPath('/home/user/.local/share/umu/steamrt3/umu-shim'), PosixPath('/home/user/.local/share/lutris/runners/proton/ge-proton/proton'), 'waitforexitandrun', '/home/user/Games/turtle_prefix/drive_c/game.exe')
[umu.umu_run:664] DEBUG: prctl exited with status: 0
gamemodeauto: 
gamemodeauto: 
pressure-vessel-wrap[78]: E: Child process exited with code 1: bwrap: Failed to make / slave: Operation not permitted

[umu.umu_run:668] DEBUG: Child 78 exited with wait status: 1
gamemodeauto: 
Monitored process exited.
Initial process has exited (return code: 256)
All processes have quit
Exit with return code 256

Now the key line looks like:
pressure-vessel-wrap[78]: E: Child process exited with code 1: bwrap: Failed to make / slave: Operation not permitted

It looks like umu is using bwrap?

So not sure how to proceed safely. A deeper knowledge of what UMU/brwap is actually doing is required to make safe lutris profile changes - something I don't have 😄

I think GE-Proton (Latest) will eventually be the lutris wine default so it would be a nice change to get into the upstream firejail lutris profile as well.

My setup:

firejail version 0.9.74
lutris-0.5.19
kernel: 6.15.7-arch1-1

Launching with:

firejail --private=/home/user/.firejail/lutris /usr/bin/lutris