mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2035] Firejail 0.9.54 and pulseaudio 12: Edge case with no sound #1373
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1373
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @lknix on GitHub (Jul 9, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2035
I have an interesting problem (an edge case) where sound doesn't work if I switch to another user which has access to X11:
Any ideas why it doesn't work out of the box? Also, I'm not completely sure how
--ignore=whitelisthelps. Afaik it ignores all thewhiltelistlines in the profile. Should I bisect thewhitelists to find out exactly which one is problematic?@chiraag-nataraj commented on GitHub (Jul 9, 2018):
Yes please! That would be very helpful 🙂 I suspect it's something to do with the files in
/var(so you can try commenting outinclude /etc/firejail/whitelist-var-common.incas a first guess).@lknix commented on GitHub (Jul 9, 2018):
OK, here are the results. I had to comment out the following:
/etc/firejail/firefox-common.profile:/etc/firejail/firefox.profile:And all of them need to be commented out - if any one of them is left, then there's no sound. I've double checked.
@chiraag-nataraj commented on GitHub (Jul 9, 2018):
Is your
pulsesocket in~/.config/pulseby any chance? You may need to whitelist that directory as well. Try whitelisting~/.config/pulseas well as~/.pulse(if you have that directory). That may let you uncomment the home directory whitelists (includinginclude /etc/firejail/whitelist-common.inc). As for thewhitelist-var-commonportion, see if adding awhitelist /var/run/user(and uncommenting theinclude whitelist-var-common.inc) helps.@lknix commented on GitHub (Jul 9, 2018):
@chiraag-nataraj thanks for your prompt replies. Unfortunately, none of the suggestions worked:
whitelist ${HOME}/.config/pulse->/etc/firejail/globals.local:There's no sound if I comment out any of the
${HOME}or${DOWNLOADS}lines. I don't have~/.pulsedirectory.whitelist /var/run/user->/etc/firejail/globals.local:firejaildoesn't want to run:@lknix commented on GitHub (Jul 9, 2018):
Just to reiterate:
firejailworks fine if used by the same user who started X11:It only stops working if I switch to another user which has granted access to X11 (for GUI apps).
@lknix commented on GitHub (Jul 9, 2018):
OK, the same issue with
mpv:web, everything works outside offirejail, but trying to run inside it there's no sound:@chiraag-nataraj commented on GitHub (Jul 9, 2018):
Okay, let me try this in a virtual machine (don't want to pollute my main computer with random additional users xD) and get back.
@lknix commented on GitHub (Jul 9, 2018):
@chiraag-nataraj maybe this is helpful:
pulseaudiowith multiple users (and not running it system-wide) I usemodule-native-protocol-tcpwhich binds at127.0.0.1:4713. So, basicallypulseaudiois started by the same user as X11 (luka).webits~.config/pulse/clienf.confhasdefault-server = 127.0.0.1. Sowebconnects to existingpulseaudio.@chiraag-nataraj commented on GitHub (Jul 11, 2018):
This is very interesting. I just played around with this, following the exact same steps you used, and sound worked for me. I created a new user (dummy), added it to the X11 ACL,
sudo'd in to the user, and ran firefox both with and without firejail. I got sound both times.I also don't have a
~/.config/pulse/directory in thedummyuser's home directory.pulseis started by my main user (chiraag) and binds to the TCP socket. And apparentlypulsejust...discovers the TCP socket I suppose? Because I didn't configurepulseat all for userdummy.@chiraag-nataraj commented on GitHub (Jul 11, 2018):
I also verified that
pulseisn't spawning a new instance fordummy- that is, it's reusing the existing instance (using the TCP socket, no doubt). So now we come to: Why is it that mine worked and yours failed? 😜@chiraag-nataraj commented on GitHub (Jul 15, 2018):
@lknix Do you think there are any other details that are relevant? I'll try putting a
pulse.confin the other user's home folder to see if that changes anything, but otherwise, our setups are identical.@lknix commented on GitHub (Jul 24, 2018):
This is interesting.
~/.config/pulse/client.conffor mywebuser:There are also these files in the
~/.config/pulse/:It's interesting that your setup just works using TCP socket (default fallback?). If I change my setup to use unix socket it doesn't work for some reason, but it does with TCP.
This is puzzling - I'm not sure what else to check. Any ideas?
@chiraag-nataraj commented on GitHub (Jul 24, 2018):
I think the unix socket doesn't work because of ownership issues? Like, in my system, systemd starts the pulseaudio service with a socket in /run/user//pulse, which is clearly not accessible to other users. The TCP socket gets around that.
If TCP works fine for you now, it seems that this issue is resolved?
@chiraag-nataraj commented on GitHub (Aug 18, 2018):
@lknix I got the impression that the issue is resolved, so I'm going to close this now. If I got the wrong impression, please feel free to reopen!
@disposableone commented on GitHub (Dec 19, 2020):
Please reopen because you got the wrong impression.
Pulseaudio can create sockets wherever. I set it to create a socket in /tmp/. I was getting issues that seemed like permission issues but then I added the unix socket to the 'default-server' field in .config/pulse/client.conf for the user, and sounds in firejail started working. Before it was giving the 'couldn't connect to the bus' error, making it look like it was a permission issue.