mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2037] Machine-ID breaks Pulseaudio #1374
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1374
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Futureknows on GitHub (Jul 11, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2037
This was discussed but a solution isn't clear.
--machine-id flag breaks Pulseaudio so no sound in Tor-browser and other firejails.
Turning off MID spoofing exposes the persistent machine-id (hardware fingerprint) inside the sandbox.
We are running Pulseaudio 11.1 and this issue persists.
Is there a current solution?
@Vincent43 commented on GitHub (Jul 11, 2018):
In which profile
machine-idbreaks Pulseaudio? It works for me in firefox.@Futureknows commented on GitHub (Jul 11, 2018):
Tor-Browser-Launcher, Brave, Firefox, Chromium pretty much every firejail I launch with --machine-id.
@chiraag-nataraj commented on GitHub (Jul 11, 2018):
I don't even have
/etc/machine-idavailable in many of my personal profiles (I useprivate-etcfilters in many of them), and sound hasn't broken for me yet.What do you get if you put in a
private-etcfilter leaving outmachine-id. For example, this is the one I use with myfirefoxprofile:private-etc hosts,passwd,mime.types,fonts,mailcap,firefox,xdg,gtk-3.0,X11,pulse,alternatives,localtime,nsswitch.conf(you might also needresolv.confin there depending on your setup).@Vincent43 commented on GitHub (Jul 12, 2018):
Both Chromium and Firefox have sound working while using
machine-idon Archlinux and KDE for me. What distro and desktop environment are you using?@Futureknows commented on GitHub (Jul 12, 2018):
I didn't add
--machine-idto any profile. I'm issuing firejail commands as documentedfirejail --machine-id firefox. Any time I include--machine-idI lose Pulseaudio in any Browser (Chromium, Brave, Firefox, Tor).Current Fedora 28 with Cinnamon but I am seeing similar issue on Mint 18.3.
I'm going to figure out private-etc and report back.
Thanks!
@Vincent43 commented on GitHub (Jul 12, 2018):
It doesn't matter. It has same effect.
@chiraag-nataraj commented on GitHub (Jul 15, 2018):
@Futureknows Did you test the
private-etcfilter? I've turned onmachine-idon all of my (personal) profiles with no issues so far. What exactly is yourpulseaudiosetup? Is it the default/standard setup? Did you make any changes?@chiraag-nataraj commented on GitHub (Jul 15, 2018):
(Also, btw,
machine-idis useful even if you use aprivate-etcfilter, since the machine ID is also available at/var/lib/dbus/machine-idwhich is also spoofed byfirejail)@netblue30 commented on GitHub (Jul 15, 2018):
Somehow pulseaudio ends up reading /etc/machine-id and it will refuse to start if it doesn't find it. Also some part of the dbus code might read it. I don't know why they do that. I'll have to try Arch, maybe they removed it, see @Vincent43 comment above.
@chiraag-nataraj commented on GitHub (Jul 15, 2018):
The same is true for me on Debian - I can get away without having pulse read the machine ID.
@Futureknows commented on GitHub (Jul 16, 2018):
I didn't make any changes to Pulseaudio, it is the default install from Fedora 28 Cinnamon which must have just recently been updated to 12.0, it was 11.1. It is persistent across all apps, I don't get Pulseaudio output from Rhythmbox, VLC or anything firejailed with --machine-id.
I noticed a dbus error when --machine-id is present:
When I enable private-etc (removing comment firefox-common.profile it breaks my networking in Firefox.
@chiraag-nataraj commented on GitHub (Jul 16, 2018):
Huh...you probably need
ca-certificatesandca-certificates.confI guess? That's weird that I don't end up require it...[edit] never mind...hold on. At least on my system, the certificates are in
/usr/share/ca-certificates. If your system is different, you may need to also includeca-certificatesin yourprivate-etcpredicate.@Futureknows commented on GitHub (Jul 16, 2018):
Incidentally the problem was similar on my Mint machine and although private-etc doesn't break networking Pulseaudio was still blocked by machine-id.
After digging I applied an older solution
echo "enable-shm = no" >> ~/.config/pulse/client.conf"In addition I applied the same to daemon.conf:
echo "enable-shm = no" >> ~/.config/pulse/daemon.conf"Now audio works along with machine-id everywhere.
I noticed if I add machine-id to globals.local for some reason I lose Pulseaudio again.
If I launch it per instance --machine-id then it works perfect.