[GH-ISSUE #3282] Sound not working with firejail

gitea-mirror commented

2026-05-05 08:43:55 -06:00

Owner

Originally created by @Leebre on GitHub (Mar 18, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3282

Hi, I am trying to run steam in firejail on Parabola GNU/Linux (derivative of Arch). If I run it outside of firejail, it seems to work fine and XCom: Enemy Unknown starts and runs fine. However, in firejail, even if I use --noprofile, the sound in the Steam application doesn't work (for example, in the store videos) and the game won't launch.

Originally created by @Leebre on GitHub (Mar 18, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3282 Hi, I am trying to run steam in firejail on Parabola GNU/Linux (derivative of Arch). If I run it outside of firejail, it seems to work fine and XCom: Enemy Unknown starts and runs fine. However, in firejail, even if I use `--noprofile`, the sound in the Steam application doesn't work (for example, in the store videos) and the game won't launch.

gitea-mirror added the

bug

label 2026-05-05 08:43:55 -06:00

gitea-mirror commented

2026-05-05 08:43:57 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 19, 2020):

Do you use pulseaudio?

@rusty-snake commented on GitHub (Mar 19, 2020): Do you use pulseaudio?

gitea-mirror commented

2026-05-05 08:43:58 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 19, 2020):

@rusty-snake yes, I am.

@Leebre commented on GitHub (Mar 19, 2020): @rusty-snake yes, I am.

gitea-mirror commented

2026-05-05 08:43:59 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 21, 2020):

@rusty-snake commented on GitHub (Mar 21, 2020): Related: #3165 https://github.com/netblue30/firejail/issues/3165#issuecomment-584815612

gitea-mirror commented

2026-05-05 08:44:00 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 21, 2020):

@rusty-snake thanks for the link. I read the info there and tried firejail --noprofile --noblacklist=/sys/module steam, but the sound still doesn't work. I am seeing the following error in the console though:

ALSA lib pcm_dmix.c:1089:(snd_pcm_dmix_open) unable to open slave
[0321/153240.860067:ERROR:alsa_util.cc(204)] PcmOpen: default,No such file or directory
ALSA lib pcm_dmix.c:1089:(snd_pcm_dmix_open) unable to open slave
[0321/153240.860907:ERROR:alsa_util.cc(204)] PcmOpen: plug:default,No such file or directory

so there is clearly some error relating to ALSA. My system is a fairly generic Dell Insipron desktop PC, x86, using a built-in sound card.

@Leebre commented on GitHub (Mar 21, 2020): @rusty-snake thanks for the link. I read the info there and tried `firejail --noprofile --noblacklist=/sys/module steam`, but the sound still doesn't work. I am seeing the following error in the console though: ``` ALSA lib pcm_dmix.c:1089:(snd_pcm_dmix_open) unable to open slave [0321/153240.860067:ERROR:alsa_util.cc(204)] PcmOpen: default,No such file or directory ALSA lib pcm_dmix.c:1089:(snd_pcm_dmix_open) unable to open slave [0321/153240.860907:ERROR:alsa_util.cc(204)] PcmOpen: plug:default,No such file or directory ``` so there is clearly some error relating to ALSA. My system is a fairly generic Dell Insipron desktop PC, x86, using a built-in sound card.

gitea-mirror commented

2026-05-05 08:44:01 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 22, 2020):

I tried it with --noblacklist=/sys/fs as well and no joy. Something to do with ALSA must be being blocked by one of the built-in blockers?

@Leebre commented on GitHub (Mar 22, 2020): I tried it with `--noblacklist=/sys/fs` as well and no joy. Something to do with ALSA must be being blocked by one of the built-in blockers?

gitea-mirror commented

2026-05-05 08:44:02 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 22, 2020):

I just commented out all of the built-in blacklisted locations in fs.c and re-compiled. I ran firejail --noprofile --debug-blacklists steam, to verify that no locations were still being blacklisted - the sound still doesn't work and I get the same pcm errors.

@Leebre commented on GitHub (Mar 22, 2020): I just commented out all of the built-in blacklisted locations in `fs.c` and re-compiled. I ran `firejail --noprofile --debug-blacklists steam`, to verify that no locations were still being blacklisted - the sound still doesn't work and I get the same pcm errors.

gitea-mirror commented

2026-05-05 08:44:03 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 22, 2020):

You can use firejail --noprofile --trace=outputfile steam to trace open, openat, fopen, access, opendir, ... or strace to trace everything. firejail --build steam maybe contain some hints or firejail --noprofile --debug steam.

@rusty-snake commented on GitHub (Mar 22, 2020): You can use `firejail --noprofile --trace=outputfile steam` to trace open, openat, fopen, access, opendir, ... or strace to trace everything. `firejail --build steam` maybe contain some hints or `firejail --noprofile --debug steam`.

gitea-mirror commented

2026-05-05 08:44:04 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 22, 2020):

@rusty-snake ok, I'll give those a try and let you know what happens. Another thing I tried was running Rhythmbox in firejail (firejail --noprofile rhythmbox) and I got no sound with that either. So, it seems I have a general sound issue w. firejail, not just with Steam. One thing I noticed was the window title bar of Rhythmbox said it was operating as the superuser. So, I tried running it as root outside firejail and also got no sound. This might be the underlying problem - why is firejail running Rhythmbox as the superuser?

@Leebre commented on GitHub (Mar 22, 2020): @rusty-snake ok, I'll give those a try and let you know what happens. Another thing I tried was running Rhythmbox in firejail (`firejail --noprofile rhythmbox`) and I got no sound with that either. So, it seems I have a general sound issue w. firejail, not just with Steam. One thing I noticed was the window title bar of Rhythmbox said it was operating as the superuser. So, I tried running it as root outside firejail and also got no sound. This might be the underlying problem - why is firejail running Rhythmbox as the superuser?

gitea-mirror commented

2026-05-05 08:44:05 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 22, 2020):

https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#ive-noticed-the-title-bar-in-firefox-shows-as-superuser-is-this-normal

@rusty-snake commented on GitHub (Mar 22, 2020): https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#ive-noticed-the-title-bar-in-firefox-shows-as-superuser-is-this-normal

gitea-mirror commented

2026-05-05 08:44:05 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 22, 2020):

@rusty-snake thanks for the link. However, it seems strange the I get the same audio issues in firejail as I do if I try to run the application as root. I will look into how to enable sound for the root user and see if that helps with firejail.

@Leebre commented on GitHub (Mar 22, 2020): @rusty-snake thanks for the link. However, it seems strange the I get the same audio issues in firejail as I do if I try to run the application as root. I will look into how to enable sound for the root user and see if that helps with firejail.

gitea-mirror commented

2026-05-05 08:44:06 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 24, 2020):

I couldn't find a good way to enable the root user to use sound with pulseaudio, so I removed pulse completely and now the sound works fine with steam in firejail (both the client and the XCom game I was trying). Again, I suspect its to do with pulse not allowing access for the root user (I'm suddenly not so much a fan of pulse any more ...)

@Leebre commented on GitHub (Mar 24, 2020): I couldn't find a good way to enable the root user to use sound with pulseaudio, so I removed pulse completely and now the sound works fine with steam in firejail (both the client and the XCom game I was trying). Again, I suspect its to do with pulse not allowing access for the root user (I'm suddenly not so much a fan of pulse any more ...)

gitea-mirror commented

2026-05-05 08:44:06 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 24, 2020):

just remembered, have you tried firecfg --fix-sound?

@rusty-snake commented on GitHub (Mar 24, 2020): just remembered, have you tried `firecfg --fix-sound`?

gitea-mirror commented

2026-05-05 08:44:07 -06:00

Author

Owner

@Leebre commented on GitHub (Mar 24, 2020):

@rusty-snake yes, I ran that command after installing, per the installation instructions on firejail.wordpress.com. However, I still experienced no audio through pulseaudio with firejailed applications.

@Leebre commented on GitHub (Mar 24, 2020): @rusty-snake yes, I ran that command after installing, per the installation instructions on firejail.wordpress.com. However, I still experienced no audio through pulseaudio with firejailed applications.

gitea-mirror commented

2026-05-05 08:44:07 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 5, 2020):

No idea if that could change anything but you can give it a try: firejail --noprofile --noblacklist=/sys/module --noautopulse steam

Unfortunately I have no more ideas what the issue could be, or how to investigate it further.

@rusty-snake commented on GitHub (Apr 5, 2020): No idea if that could change anything but you can give it a try: `firejail --noprofile --noblacklist=/sys/module --noautopulse steam` Unfortunately I have no more ideas what the issue could be, or how to investigate it further.

gitea-mirror commented

2026-05-05 08:44:07 -06:00

Author

Owner

@matu3ba commented on GitHub (Apr 10, 2020):

@rusty-snake Suggestion to change title to "Firejailed steam has no pulseaudio sound".

@matu3ba commented on GitHub (Apr 10, 2020): @rusty-snake Suggestion to change title to "Firejailed steam has no pulseaudio sound".

gitea-mirror commented

2026-05-05 08:44:08 -06:00

Author

Owner

@matu3ba commented on GitHub (Apr 11, 2020):

@glitsj16 Suggestion to change title to "Firejailed steam has no pulseaudio sound", because other sound apparently works.

@matu3ba commented on GitHub (Apr 11, 2020): @glitsj16 Suggestion to change title to "Firejailed steam has no pulseaudio sound", because other sound apparently works.

gitea-mirror commented

2026-05-05 08:44:08 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 11, 2020):

@matu3ba read that comment: https://github.com/netblue30/firejail/issues/3282#issuecomment-603382929

@rusty-snake commented on GitHub (Apr 11, 2020): @matu3ba read that comment: https://github.com/netblue30/firejail/issues/3282#issuecomment-603382929

gitea-mirror commented

2026-05-05 08:44:08 -06:00

Author

Owner

@ghost commented on GitHub (Apr 11, 2020):

@matu3ba Why should we do that? The OP started noticing audio issues in Steam, while digging into it detected that all firejailed apps suffer from it and changed the title accordingly. Until there's a very good argument to do so I'm regarding the issue title the OP's prerogative.

@ghost commented on GitHub (Apr 11, 2020): @matu3ba Why should we do that? The OP started noticing audio issues in Steam, while digging into it detected that all firejailed apps suffer from it and changed the title accordingly. Until there's a **very** good argument to do so I'm regarding the issue title the OP's prerogative.

gitea-mirror commented

2026-05-05 08:44:09 -06:00

Author

Owner

@Leebre commented on GitHub (Apr 12, 2020):

@matu3ba no, that isn't correct. I have tried with other applications that use audio and I'm not able to get sound from any of them within firejail with pulseaudio running.

@rusty-snake ok, I will give that a try when I get a chance. Although, for me, removing pulseaudio and falling back to ALSA solves the problem.

@Leebre commented on GitHub (Apr 12, 2020): @matu3ba no, that isn't correct. I have tried with other applications that use audio and I'm not able to get sound from any of them within firejail with pulseaudio running. @rusty-snake ok, I will give that a try when I get a chance. Although, for me, removing pulseaudio and falling back to ALSA solves the problem.

gitea-mirror commented

2026-05-05 08:44:09 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 12, 2021):

You can try noprofile.profie. If this does not work ... 😿 .

@rusty-snake commented on GitHub (May 12, 2021): You can try [noprofile.profie](https://gist.github.com/rusty-snake/bb234cb3e50e1e4e7429f29a7931cc72). If this does not work ... :crying_cat_face: .

gitea-mirror commented

2026-05-05 08:44:10 -06:00

Author

Owner

@odiferousmint commented on GitHub (May 4, 2022):

Sorry for somewhat necrobumping, but I have audio issues with Discord on Void Linux. It works with --noprofile and it works with the posted noprofile.profile.

I actually had audio issues with Discord (as in, the website) inside the browser Vivaldi as well, but the following lines solved it:

noblacklist /sys/fs
noblacklist /sys/module

It does not work for the Discord app though. It works if I remove all whitelist lines.

For example, this one WORKS:

include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc

noblacklist /sys/fs
noblacklist /sys/module

keep-config-pulse

noblacklist ${HOME}/.config/discord

But this one does NOT WORK:

include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc

noblacklist /sys/fs
noblacklist /sys/module

keep-config-pulse

noblacklist ${HOME}/.config/discord
mkdir ${HOME}/.config/discord
whitelist ${HOME}/.config/discord
whitelist ${DOWNLOADS}

Any ideas as to why that might be the case? Keep in mind it does not work either if I comment out the noblacklist lines OR if the keep-config-pulse is missing. I suppose I have to whitelist or noblacklist something else, but not exactly sure what.

I did try the default Discord.profile as well, that was actually the first thing I did and that one does not work either.

Unfortunately in this case I do not get any errors related to DBus, alsa, or pulseaudio either.

Apparently it even works with:

include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc

noblacklist /sys/fs
noblacklist /sys/module

keep-config-pulse

noblacklist ${HOME}/.config/discord

apparmor
caps.drop all
caps.keep sys_admin,sys_chroot
netfilter
no3d
nodvd
nogroups
noinput
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6
shell none

disable-mnt
private-cache
private-tmp

dbus-user none
dbus-system none

private-bin Discord,bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh
private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl

#mkdir ${HOME}/.config/discord
#whitelist ${HOME}/.config/discord
#whitelist ${DOWNLOADS}

The issue only occurs if I uncomment the last 3 lines.

OK, I do get error with private-dev, complains about:

[2022-05-05 01:21:54.137] [120] (discord.cpp:551): JS console: ["%c[RPCServer:IPC]","Starting on /tmp/discord-ipc-0"]
ALSA lib pcm_dmix.c:1032:(snd_pcm_dmix_open) unable to open slave
ALSA lib pcm_dmix.c:1032:(snd_pcm_dmix_open) unable to open slave
[2022-05-05 01:21:54.855] [134] (device_info_linux.cc:45): NumberOfDevices

~~Any ideas?~~

SOLVED: Never mind, the issue was a missing whitelist ${HOME}/.config/pulse. I assumed keep-config-pulse would have done it.

An example of a supposedly working profile:

include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc

noblacklist /sys/fs
noblacklist /sys/module

keep-config-pulse

apparmor
caps.drop all
caps.keep sys_admin,sys_chroot
netfilter
nodvd
nogroups
noinput
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6
shell none

disable-mnt
private-cache
private-tmp

dbus-user none
dbus-system none

private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl
private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl

noblacklist ${HOME}/.config/discord
mkdir ${HOME}/.config/discord
whitelist ${HOME}/.config/discord
whitelist ${DOWNLOADS}
whitelist ${HOME}/.config/pulse

It was a great monologue regardless. sighs

I do have some issues still at times but it might not be firejail related, or not exclusively.

@odiferousmint commented on GitHub (May 4, 2022): Sorry for somewhat necrobumping, but I have audio issues with Discord on Void Linux. It works with `--noprofile` and it works with the posted `noprofile.profile`. I actually had audio issues with Discord (as in, the website) inside the browser Vivaldi as well, but the following lines solved it: ``` noblacklist /sys/fs noblacklist /sys/module ``` It does not work for the Discord app though. It works if I remove all `whitelist` lines. For example, this one **WORKS**: ``` include disable-common.inc include disable-devel.inc include disable-interpreters.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse noblacklist ${HOME}/.config/discord ``` But this one **does NOT WORK**: ``` include disable-common.inc include disable-devel.inc include disable-interpreters.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse noblacklist ${HOME}/.config/discord mkdir ${HOME}/.config/discord whitelist ${HOME}/.config/discord whitelist ${DOWNLOADS} ``` Any ideas as to why that might be the case? Keep in mind it does not work either if I comment out the `noblacklist` lines OR if the `keep-config-pulse` is missing. I suppose I have to `whitelist` or `noblacklist` something else, but not exactly sure what. I did try the default `Discord.profile` as well, that was actually the first thing I did and that one does not work either. Unfortunately in this case I do not get any errors related to `DBus`, `alsa`, or `pulseaudio` either. --- Apparently it even works with: ``` include disable-common.inc include disable-devel.inc include disable-interpreters.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse noblacklist ${HOME}/.config/discord apparmor caps.drop all caps.keep sys_admin,sys_chroot netfilter no3d nodvd nogroups noinput nonewprivs noroot notv nou2f novideo protocol unix,inet,inet6 shell none disable-mnt private-cache private-tmp dbus-user none dbus-system none private-bin Discord,bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl #mkdir ${HOME}/.config/discord #whitelist ${HOME}/.config/discord #whitelist ${DOWNLOADS} ``` The issue only occurs if I uncomment the last 3 lines. --- OK, I do get error with `private-dev`, complains about: ``` [2022-05-05 01:21:54.137] [120] (discord.cpp:551): JS console: ["%c[RPCServer:IPC]","Starting on /tmp/discord-ipc-0"] ALSA lib pcm_dmix.c:1032:(snd_pcm_dmix_open) unable to open slave ALSA lib pcm_dmix.c:1032:(snd_pcm_dmix_open) unable to open slave [2022-05-05 01:21:54.855] [134] (device_info_linux.cc:45): NumberOfDevices ``` ~~Any ideas?~~ --- **SOLVED**: Never mind, the issue was a missing `whitelist ${HOME}/.config/pulse`. I assumed `keep-config-pulse` would have done it. An example of a supposedly working profile: ``` include disable-common.inc include disable-devel.inc include disable-interpreters.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse apparmor caps.drop all caps.keep sys_admin,sys_chroot netfilter nodvd nogroups noinput nonewprivs noroot notv nou2f novideo protocol unix,inet,inet6 shell none disable-mnt private-cache private-tmp dbus-user none dbus-system none private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl noblacklist ${HOME}/.config/discord mkdir ${HOME}/.config/discord whitelist ${HOME}/.config/discord whitelist ${DOWNLOADS} whitelist ${HOME}/.config/pulse ``` It was a great monologue regardless. *sighs* --- I do have some issues still at times but it might not be `firejail` related, or not exclusively.

Rows
Columns

[GH-ISSUE #3282] Sound not working with firejail #2061