github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3681] Widevine/DRM broken with firejail 0.9.64 in browsers #2318

New issue

Closed

opened 2026-05-05 09:00:33 -06:00 by gitea-mirror · 10 comments

gitea-mirror commented

2026-05-05 09:00:33 -06:00

Owner

Originally created by @cjsthompson on GitHub (Oct 20, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3681

Widevine (netflix) no longer works with Brave (1.15.75) after upgrading to firejail 0.9.64rc1-2 (arch linux). Works fine when starting brave without firejail or with firejail --noprofile /usr/bin/brave.

[242:1:1020/162026.705732:ERROR:cdm_module.cc(139)] CDM at /home/bla/.config/BraveSoftware/Brave-Browser/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so could not be loaded.
[242:1:1020/162026.705998:ERROR:cdm_module.cc(140)] Error: /home/bla/.config/BraveSoftware/Brave-Browser/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so: cannot open shared object file: Operation not permitted

Originally created by @cjsthompson on GitHub (Oct 20, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3681 Widevine (netflix) no longer works with Brave (1.15.75) after upgrading to firejail 0.9.64rc1-2 (arch linux). Works fine when starting brave without firejail or with firejail --noprofile /usr/bin/brave. ``` [242:1:1020/162026.705732:ERROR:cdm_module.cc(139)] CDM at /home/bla/.config/BraveSoftware/Brave-Browser/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so could not be loaded. [242:1:1020/162026.705998:ERROR:cdm_module.cc(140)] Error: /home/bla/.config/BraveSoftware/Brave-Browser/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so: cannot open shared object file: Operation not permitted ```

gitea-mirror

2026-05-05 09:00:33 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 09:00:36 -06:00

Author

Owner

@SkewedZeppelin commented on GitHub (Oct 20, 2020):

Do you have
browser-allow-drm yes
in your
/etc/firejail/firejail.config ?

@SkewedZeppelin commented on GitHub (Oct 20, 2020): Do you have browser-allow-drm yes in your /etc/firejail/firejail.config ?

gitea-mirror commented

2026-05-05 09:00:37 -06:00

Author

Owner

@cjsthompson commented on GitHub (Oct 20, 2020):

Nope, and enabling that fixes the problem. Thanks for the hint.

@cjsthompson commented on GitHub (Oct 20, 2020): Nope, and enabling that fixes the problem. Thanks for the hint.

gitea-mirror commented

2026-05-05 09:00:37 -06:00

Author

Owner

@rusty-snake commented on GitHub (Oct 20, 2020):

FYI: https://github.com/netblue30/firejail/pull/3390

@rusty-snake commented on GitHub (Oct 20, 2020): FYI: https://github.com/netblue30/firejail/pull/3390

gitea-mirror commented

2026-05-05 09:00:37 -06:00

Author

Owner

@cjsthompson commented on GitHub (Oct 20, 2020):

That explains why it was working until I upgraded I guess.

@cjsthompson commented on GitHub (Oct 20, 2020): That explains why it was working until I upgraded I guess.

gitea-mirror commented

2026-05-05 09:00:38 -06:00

Author

Owner

@toby63 commented on GitHub (Sep 3, 2021):

Is it also possible to activate this via a command flag?
(e.g. firejail --browser-allow-drm PROGRAM)

@toby63 commented on GitHub (Sep 3, 2021): Is it also possible to activate this via a command flag? (e.g. `firejail --browser-allow-drm PROGRAM`)

gitea-mirror commented

2026-05-05 09:00:38 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 3, 2021):

$ grep BROWSER_ALLOW_DRM /etc/firejail/*.profile
/etc/firejail/chromium-common.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
/etc/firejail/ephemeral.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
/etc/firejail/firefox-common.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
/etc/firejail/midori.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
/etc/firejail/otter-browser.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
$ firejail --ignore='noexec ${HOME}' firefox

@rusty-snake commented on GitHub (Sep 3, 2021): ```console $ grep BROWSER_ALLOW_DRM /etc/firejail/*.profile /etc/firejail/chromium-common.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME} /etc/firejail/ephemeral.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME} /etc/firejail/firefox-common.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME} /etc/firejail/midori.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME} /etc/firejail/otter-browser.profile:?BROWSER_ALLOW_DRM: ignore noexec ${HOME} $ firejail --ignore='noexec ${HOME}' firefox ```

gitea-mirror commented

2026-05-05 09:00:39 -06:00

Author

Owner

@toby63 commented on GitHub (Sep 3, 2021):

Interesting, thx.
Do I interpret this correctly that the DRM plugin wants to take a look in my home folder?

@toby63 commented on GitHub (Sep 3, 2021): Interesting, thx. Do I interpret this correctly that the DRM plugin wants to take a look in my home folder?

gitea-mirror commented

2026-05-05 09:00:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 3, 2021):

It will get installed in your home folder, therefore you need to mount it exec.

@rusty-snake commented on GitHub (Sep 3, 2021): It will get installed in your home folder, therefore you need to mount it `exec`.

gitea-mirror commented

2026-05-05 09:00:39 -06:00

Author

Owner

@toby63 commented on GitHub (Sep 3, 2021):

It will get installed in your home folder, therefore you need to mount it exec.

I see, and I guess it can't be further limited?

@toby63 commented on GitHub (Sep 3, 2021): > It will get installed in your home folder, therefore you need to mount it `exec`. I see, and I guess it can't be further limited?

gitea-mirror commented

2026-05-05 09:00:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 3, 2021):

Actaully you could noexec every directory in firejail --ignore=private-bin --profile=firefox ls -a $HOME except for .mozilla, however a mkdir $HOME/this_dir_is_exec inside the sandbox is possible.

@rusty-snake commented on GitHub (Sep 3, 2021): Actaully you could `noexec` every directory in `firejail --ignore=private-bin --profile=firefox ls -a $HOME` except for `.mozilla`, however a `mkdir $HOME/this_dir_is_exec` inside the sandbox is possible.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2318

No description provided.

Rows
Columns