mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3506] youtube-dl and ffprobe requires libblas.so #2203
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2203
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @hyiltiz on GitHub (Jul 9, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3506
Write clear, concise and in textual form.
Bug and expected behavior
youtube-dl -x SOMELINKfails.youtube-dl -x SOMELINKsucceeds.No profile or disabling firejail
firejail --noprofile ffprobe SOMEFILEsucceeds./usr/bin/ffprobe SOMEFILEsucceeds.Reproduce
Steps to reproduce the behavior:
firejail youtube-dl -x SOMELINKorfirejail ffprobe SOMEFILEEnvironment
lsb_release -a)firejail --version) exclusive or used git commit (git rev-parse HEAD)youtube-dldepends onffprobe.Huh?
Checklist
find / -name 'firejail' 2>/dev/null/fd firejailto locate profiles ie in/usr/local/etc/firejail/PROGRAM.profile)BTW, I just noticed that the above
firejail --debugprovided way too much information about my filesystem and setup. Was that necessary? If so, please consider creating a key pair and uploading your public key so these kinds of probably sensitive private information can be shared directly with the project without putting it up in the Internet indefinitely in plain text.@bbhtt commented on GitHub (Jul 10, 2020):
See here
Can you add
passwd,groups,login.defstoprivate-etcand see if it persists or comment it to see? Is there something wrong with the first line? I ran the command,it works fine:Output
ldconfig -p | grep -i "libblas"shows anything?@hyiltiz commented on GitHub (Jul 10, 2020):
@ghost commented on GitHub (Jul 11, 2020):
This can be set in /etc/firejail/firejail.config:
Can you post output of
@bbhtt commented on GitHub (Jul 11, 2020):
ffprobecannot parse direct web links,you need a direct link to the video,not the https site,I think.https://ia800705.us.archive.org/13/items/Jolly_Fish_1932/Tom_and_Jerry_Jolly_Fish_1932_512kb.mp4I couldn't reproduce this;
ffmpegprofiles needed to be changed:ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preloadfrom current in git@hyiltiz commented on GitHub (Jul 11, 2020):
@rusty-snake commented on GitHub (Jul 11, 2020):
@hyiltiz has you made any modifications to the ffprobe, ffmpeg, youtube-dl profiles?
@kortewegdevries that happens if you do
firejail APPwhere APP has a symlink from firecfg.@hyiltiz commented on GitHub (Jul 12, 2020):
@rusty-snake I don't recall any modifications. My profiles:
@rusty-snake commented on GitHub (Jul 12, 2020):
Looks then like you need to try which line is the issue. Copy the ffmpeg profile to your home and comment all line. Then uncomment line for line. Use
firejail --profile=ffmpeg.profile ffprobe …to start. Note1:private-binshould commented all the time.Note2: My feeling is
private-etcbut I'm not sure.@hyiltiz commented on GitHub (Jul 12, 2020):
Tested with
firejail --profile=ffmpeg.profile ffprobe ~/Downloads/media/SOMEFILE.webmafter copying/etc/firejail/ffmpeg.profileto current directory~/.config/firejail.Changing nothing:
Commenting out
private-bin:Also commenting out
private-etcworked!Any idea why
private-binandprivate-etcare uncommented inmaster?@rusty-snake commented on GitHub (Jul 12, 2020):
private-bin: the ffprobe.profile containsignore private-binprivate-etc: try to use the private-etc from master, it has some fixes for dynamic linked librarys.@hyiltiz commented on GitHub (Jul 13, 2020):
Can I just put the master
private-etcunder~/.config/firejail/?@rusty-snake commented on GitHub (Jul 13, 2020):
Yes you can add
private-etc ...to.config/firejail/ffmpeg.local. Alternative you can also edit/etc/firejail/ffmpeg.profilesince the next firejail release will fix it anyway.ytdl needs ffprobe added to its private-bin (also on master).
@hyiltiz commented on GitHub (Jul 13, 2020):
Got the
private-etc ...line from masterto
/etc/firejail/ffmpeg.profile, and addedffprobeto/etc/firejail/youtube-dl.profile'sprivate-binline beforeyoutube-dllike:Still getting (other) errors about
ffprobe:@rusty-snake commented on GitHub (Jul 13, 2020):
I just saw that the
private-etcline in youtube-dl.profile also needs to extended withld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload.@hyiltiz commented on GitHub (Jul 13, 2020):
Added, but still same error
ERROR: WARNING: unable to obtain file audio codec with ffprobe@rusty-snake commented on GitHub (Jul 13, 2020):
Lets go trough it.
whitelist /usr/share/ffmpeglooks most promising to me right now, try to add it to ytdl.@hyiltiz commented on GitHub (Jul 13, 2020):
Same error; even tried appending the diff'ed lines:
to
/etc/firejail/youtube-dl, but got the same error.@bbhtt commented on GitHub (Jul 13, 2020):
Can you see if
--prefer-ffmpegworks? Or attachverboseandignore-configflags toyoutube-dland post the output in a text file.@hyiltiz commented on GitHub (Jul 13, 2020):
Here you go (these still keep all the changes we've already done earlier):
@bbhtt commented on GitHub (Jul 14, 2020):
Just a guess, can you try with a shorter video (10-20 MB) or a different file format like mp4,mkv,m4a; also with specifying the format
--audio-format? I couldn't reproduce any of it on Debian 10@hyiltiz commented on GitHub (Jul 14, 2020):
Here, a 1.14MiB video,
.m4aformat, specifying--audio-format opus:@bbhtt commented on GitHub (Aug 3, 2020):
@hyiltiz Trying this one more time. Can you verify if you have the following files?
ffprobeneeds the library:openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libblas.so.3", O_RDONLY|O_CLOEXEC) = 3@hyiltiz commented on GitHub (Aug 3, 2020):
@bbhtt commented on GitHub (Aug 3, 2020):
Hm, I was under the impression that the symlink under
/etc/alternatives/wasn't pointing to the correct library in/lib/, because I could reproduce that error by installing multiple packages (amd64) that offered the same library. Each time I installed oneupdate-alternativesreconfigured that symlink under/etc/andffprobesearches for the library under/etc/alternatives/. A fresh Debian Sid comes with only libblas3 pre-installed. This was the stock symlink that worked:/etc/alternatives/libblas.so.3-x86_64-linux-gnu -> /usr/lib/x86_64-linux-gnu/blas/libblas.so.3@hyiltiz commented on GitHub (Aug 4, 2020):
I have
libblas3andlibblas-devinstalled; I get rid oflibblas-dev? Not sure what you are suggesting.@bbhtt commented on GitHub (Aug 4, 2020):
I'm not to sure about it. I guess it's worth a try at this point. You might also have
libopenblas0-pthread. So get rid of all 3+ffmpeg (apt-mark hold/unhold), then reinstall onlylibblas3,ffmpeg,reset the cachesudo ldconfig -N -X -v,try running with the profile that came with 0.9.62 without any modifications first, then add private-etc of master if you need.I don't know what's wrong with you system but I grabbed a copy of Sid NetInst iso (-344 Mb) took 30 minutes to install and setup firejail and I can run fine with 0.9.62-3 and the profiles that came with it w/o any modifications. Thelibblasdependency came in with Sid, you canapt-rdepends ffmpegto find it's listed underlibalapackandlibsphinx.@hyiltiz commented on GitHub (Aug 4, 2020):
Hmm, I'd be willing to try the above suggestion, but I think it is a workaround rather than a fix if I understand Firejail's "no fuss" design principle correctly. It is better implemented as a rule against various system states rather than fine tuning system packages.
libblas-devorlibblas3*cannot be removed as it is a dependency for a few other packages I'd rather keep. Removedlibopenblas0-pthread,libopenblas0*andlibopenblas0-openmp*. Removed then installedffmpeg, then:Even with the private-etc modifications, still getting the same error about libblas.
@bbhtt commented on GitHub (Aug 4, 2020):
apt install --reinstall libblas3@hyiltiz commented on GitHub (Aug 4, 2020):
Reinstalled
libblas3thenffmpeghten resetldconfigcache. Still the same error.@bbhtt commented on GitHub (Aug 4, 2020):
Commenting
private-etcstill works? Like you said:@hyiltiz commented on GitHub (Aug 4, 2020):
Hmm, I re-downloaded the
ffmpeg.profilefrom master. Had to comment outprivate-bin ffmpeg,private-etc, and ADDITIONALLY alsoinclude disable-shell.inc,dbus-user noneanddbus-system noneforfirejail --profile=~/.config/firejail/ffmpeg.profile ffprobe ~/Downloads/media/SOMEFILE.webmto work.Uncommenting
private-etc ...for the above command says:@bbhtt commented on GitHub (Aug 4, 2020):
firejail --profile=<> /usr/bin/<>. Those were not in 0.9.62.@hyiltiz commented on GitHub (Aug 15, 2020):
Not sure about your
<>notation.@bbhtt commented on GitHub (Aug 16, 2020):
That error happens when you already have a symlink.
firejail --profile=youtube-dl /usr/bin/youtube-dl.@hyiltiz commented on GitHub (Aug 16, 2020):
Not sure the last command was what you'd like me to test, but here is what I did:
ffmpeg.profileandyoutube-dl.profilefrom masterprivate-bin,private-etc,include disable-shell.inc,dbus-user,dbus-systemlinesfirejail --profile=~/.config/firejail/youtube-dl.profile /usr/bin/youtube-dl 'https://www.youtube.com/watch?v=7RMz7tePA98'So far, it is the only setup that works reliably.
@bbhtt commented on GitHub (Aug 16, 2020):
So the problematic line is either
private-etcorprivate-bin?dbus-userdbus-systemaren't available to 0.9.62. Can you try narrowing down it a bit to whoseprivate-etcorprivate-binis causing the problem?. Like for example, test with onlyffmpeg somefile.mp4with your profile to see:1. if the master works without any change
2. commenting
private-binorprivate-etchelps, then move on to the youtube-dl profile...‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐On Sunday, August 16, 2020 4:44 AM, Hörmet Yiltiz notifications@github.com wrote:
@hyiltiz commented on GitHub (Aug 16, 2020):
dbus-*etc. needs to be removed for0.9.62for firejail to parse first so didprivate-binfailsprivate-etcsucceedsFor detailed procedures, here is what I did (
scripttypescript output, can be viewed as plain-text file)http://ix.io/2ujM
@bbhtt commented on GitHub (Aug 16, 2020):
This is for ffmpeg or youtube-dl or both? Sorry, I can't open your link...
@hyiltiz commented on GitHub (Aug 16, 2020):
Both. As you asked, I tested for ffmpeg/ffprobe only first, then with a successful ffmpeg setup, tested youtube-dl.
@bbhtt commented on GitHub (Aug 17, 2020):
Try adding this to the
private-etcline ofyoutube-dl.profileseparated by commas, remove if one is duplicate, "ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,httpd,apache,apache2,nsswitch.conf,host.conf,gai.conf" to see if it works:firejail --profile=~/.config/firejail/youtube-dl.profile /usr/bin/youtube-dl 'https://www.youtube.com/watch?v=7RMz7tePA98'. You can remove thequietfrom ffprobe,ffmpeg,ytdl profile to get a better overview of which profiles are being loaded by firejail...If this still fails, try a combination of
strace(strace -o file.txt /usr/bin/ytdl <link>andcat file.txt|egrep "/etc/|/usr/share/"or under firejail:firejail --allow-debuggers --profile=profile strace -o file.txt /usr/bin/ytdl <link>) andfirejail --build /usr/bin/ytdl( should output info on terminal,if not look in/tmpfor a file named firejail_straceXXX`) to see if something comes up specific to your system that isn't in any of the profiles.@hyiltiz commented on GitHub (Oct 9, 2020):
Did that.
Removed quiet.
Failed, so trying strace.
This failed since strace wasn't found in the youtube-dl profile. Didn't want to further fuss with the profile we are trying to debug in the first place. But I'll do so if that is necessary.
This does seem to show interesting results but I am not sure what's specific to my system. It mentioned seccomp in the end, so provided a few filters for the mentioned logs. I'd also paste the strace dump but it is 20k LOC, and even pastebin is refusing to handle that.
@rusty-snake commented on GitHub (Nov 9, 2020):
What the state here?
@hyiltiz commented on GitHub (Nov 9, 2020):
I've been getting help trying to pinpoint a profile that works and why it wasn't working. Still awaiting help.
@bbhtt commented on GitHub (Nov 11, 2020):
Sorry if there was a confusion but you should've added it to the original
private-etcline not make a new line like this:So only one private-etc like this:
Anyways looking at the strace and build I don't think even above will work and in that case I'm out of ideas; sorry.
@hyiltiz commented on GitHub (Nov 11, 2020):
Huh? There was no extra newlines in my tests in
private-etcline; the first line is commented out with#, and the second line, IIRC, should be one I copied out from this thread.Shall we keep this open to see if someone else may have some ideas? @kortewegdevries couldn't replicate it, so maybe waiting until someone else could replicate would be meaningful too.
@bbhtt commented on GitHub (Nov 11, 2020):
You commented the original
private-etcline from the profile and added only thisprivate-etc ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,httpd,apache,apache2,nsswitch.conf,host.conf,gai.conf.Hence the error in your post: (because with only that you are missing hosts,resolv.conf, etc.)
I said to combine both like this:
private-etc alternatives,apache,apache2,ca-certificates,crypto-policies,gai.conf,hostname,hosts,host.conf,httpd,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl,youtube-dl.confnot comment the original one and add another line.@hyiltiz commented on GitHub (Nov 11, 2020):
Aha, gotcha! Thanks for patiently explaining. Did with only changing
youtube-dlprofile and theffmpegprofile, and then also (the system-wide):@rusty-snake commented on GitHub (Jan 4, 2021):
I'm closing here due to inactivity, please fell free to request to reopen if you still have this issue.
@hyiltiz commented on GitHub (Jan 4, 2021):
I am willing to offer any help in debugging as I've been doing, but cannot resolve the issue alone by myself and the issue still persists.
@rusty-snake commented on GitHub (Jan 5, 2021):
I can't follow this thread. Can you give a short summary.
@hyiltiz commented on GitHub (Feb 5, 2021):
Ok, I'll try to summarize.
youtube-dlandffmpegworks fine without firejailprivate-etcand/orprivate-binfor them both may resolve this issue, but unsure what (this was ongoing investigation and I am still awaiting response to my test above)libGL.so.1seems to be the culprit in most of these cases, and it seems not only specific toffmpegoryoutube-dl, as I can reproduce the same issue withokular, despite having installing pakcages that providelibGL.so.1x86-64Debian but also installedi386packages (Steam and some packages only provide a 32bit build...), and am wondering if that is the root cause. Is it possible that firejail, detecting my system asx86-64, didn't bothered to properly mask thei386libraries, and thex86-64binaries accidentally found thei386libraries when invoked with firejail which maskedx86-64? (showingokularbelow asyoutube-dlcalls other programs and makes debugging too complicated)In all cases, directly calling the program with something like
/usr/bin/okularor/usr/bin/ffmpegwill resolve the issue, unless that command then calls another program that has a firejail profile (likeyoutube-dlcallsffmpegwhich has a profile). I'd rather not throw away the firejail profiles all the time, but not sure how to work around it.I have apparmor running, although none of the mentioned programs above are listed in
aa-status, so not sure if apparmor is relevant.@rusty-snake commented on GitHub (Feb 5, 2021):
blacklist /usr/lib/i386-linux-gnu(or where else debian has i386 libs) can be used to test this.So if you add
ignore private-binandignore private-etcto ffmpeg.local and youtube-dl.local it works?@hyiltiz commented on GitHub (Feb 7, 2021):
Yes. I'd rather not ignore them, so I think we've been bisecting a list of things to ignore above.
Added
blacklist /usr/lib/i386-linux-gnutookular.localbut still gives the same error message. Guess the assumption wasn't correct.@rusty-snake commented on GitHub (Mar 27, 2021):
That right, but no narrow it down I asked if it works if they are ignored.
Assuming that adding only one of the ignores still breaks (i.e. both are necessary):
ignore private-etcandprivate-bin ldconfigwork?ignore private-binandprivate-etc <ALL FILES>?Use
unalias ls && ls /etc | tr '\n' ','to get a list of all files/dirs. You will first get some really nothing saying error messages from firejail on files like sudoers, remove all such files until ytdl starts. If it works now, remove files from the list until you find the most minimal list which works.@1ras commented on GitHub (Aug 25, 2023):
Regarding libblas.so, this is because "private-etc alternatives" provides now an incomplete alternatives directory (this was not the case in the past):
Native system:
Inside Firejail:
Same issue with wine executables:
Native system:
Inside Firejail:
For some reason /etc/alternatives is incomplete with "private-etc alternatives". Some links are still available, others are missing. I can see no good reason why symlinks to installed software are "randomly" removed.
This affects Debian Bookworm, firejail 0.9.72.
@kmk3 commented on GitHub (Aug 26, 2023):
This may potentially be fixed by: