mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3725] Firefox widevinecdm crashes (e.g. Amazon Prime Video) #2349
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2349
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Utini2000 on GitHub (Nov 5, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3725
Write clear, concise and in textual form.
Bug and expected behavior
When activating the firejail profile for firefox, Amazon Prime will not work anymore because the plugin "widevinecdm" crashes.
No profile and disabling firejail
When disabling firejail, everything will work fine.
Reproduce
Steps to reproduce the behavior:
sudo firecfg
start firefox
play a video on amazon prime video (won't work)
close firefox
sudo firecfg --clean
start firefox
play a video on amazon prime video (will work)
Environment
Additional context
Other context about the problem like related errors to understand the problem.
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.debug output
@SkewedZeppelin commented on GitHub (Nov 5, 2020):
#3681
#3645
#3390
@Utini2000 commented on GitHub (Nov 5, 2020):
Oh crap... sorry but I really searched. Must be blind today :S
@SkewedZeppelin commented on GitHub (Nov 5, 2020):
It happens...
:)
@Utini2000 commented on GitHub (Nov 5, 2020):
@SkewedZeppelin I cannot fix the issue though
I created /home/.config/firejail/firefox.local and added:
browser-allow-drm yesThis line does not work at all and firefox won't start.
It is also not included in /etc/firejail/firefox.profile
The following line starts firefox but DRM will will not play:
?BROWSER_ALLOW_DRM: yes@SkewedZeppelin commented on GitHub (Nov 5, 2020):
That line goes into /etc/firejail/firejail.config
@Utini2000 commented on GitHub (Nov 5, 2020):
But in that case the next update will overwrite it again?
@reinerh commented on GitHub (Nov 5, 2020):
Does Arch just overwrite config files that the user has modified?
@Jazzyboy1 commented on GitHub (Nov 6, 2020):
Changing
browser-allow-drm notobrowser-allow-drm yesin/etc/firejail/firejail.configdid nothing for me.Widevine was still crashing until I added
ignore noexec ${HOME}to~/.config/firejail/firefox.local.I suspect the
?BROWSER_ALLOW_DRMflag wasn't working on my system for some reason.For reference:
OS: Manjaro 20.2 Nibia
Kernel: x86_64 Linux 5.7.19-2-MANJARO
DE: KDE 5.75.0 / Plasma 5.20.2
And my
firefox.localfile just contains these lines:I've only had this issue since installing a large number of package updates today, which included updates for firejail and firefox among many other packages.
@rusty-snake commented on GitHub (Nov 6, 2020):
Has you uncommented it? Are there any
global.localorfirefox-common.localfiles? If you editedBROWSER_ALLOW_DRMinfirefox.profile: have you made any typos?@Jazzyboy1 commented on GitHub (Nov 6, 2020):
.... I actually did not uncomment it. I feel like such an idiot right now. Sorry for the trouble.
It works fine now after uncommenting that line. (so I removed the
ignore noexec ${HOME}from my firefox.local)Thanks
@Utini2000 commented on GitHub (Nov 6, 2020):
@Jazzyboy1 can you please post the changes you now have in:
~/.config/firejail/firefox.local
and
/etc/firejail/firejail.config
I believe I re-produced all your steps and didn't get it to work. But I might have done something wrong so I would love to double check with your files :-)
@SkewedZeppelin commented on GitHub (Nov 6, 2020):
All you need:
sudo sed -i 's/# browser-allow-drm no/browser-allow-drm yes/'
/etc/firejail/firejail.config
@Utini2000 commented on GitHub (Nov 6, 2020):
Alright, but with the next update it might be gone and break firefox again.
Why can't this be done in the ~/.config/firejail/firefox.local ?
@reinerh commented on GitHub (Nov 6, 2020):
Because these are settings supposed to be set by the system administrator and should not be overwritable by users.
@reinerh commented on GitHub (Nov 6, 2020):
Also I would be highly surprised if settings are gone after an upgrade in Arch... This would mean users can never touch a file in /etc?
@Utini2000 commented on GitHub (Nov 6, 2020):
Files won't be gone after an update. you get a message to manually compare new and old files. One more manual step to do when updating.
@Utini2000 commented on GitHub (Nov 6, 2020):
Does not work for me:
sed: no input files zsh: permission denied: /etc/firejail/firejail.configAlso for me there is no "browser-allow-drm" line is in firefox.profile?
How ever, there is in firefox-commong.profile
---- Update:
Okay I realized you set "browser-allow-drm" in "/etc/firejail/firejail.config" and not in the firefox specific file. So this will allow it system wide? Why not allow it for firefox only?
@rusty-snake commented on GitHub (Nov 6, 2020):
for root ???!
You can not set conditions in profile, but you can set the command behind a condition unconditional to your locals. However using the condition is the suggested by, because if widevine requires new permissions (for example
whitelist /var/lib/widevine), then we will add these commands behind this condition. So you set browser-allow-drm once and it works also if new things are added to this condition.@Utini2000 commented on GitHub (Nov 6, 2020):
Yes even with sudo :o
Hmm but what if I want to allow DRM only in a specific browser instead of allowing DRM on my whole system?
@rusty-snake commented on GitHub (Nov 6, 2020):
browser-allow-drm only allows drm in briwser with drm support (firefox and chrom*).
noexec ${HOME}to BROWSER.local to opt-outignore noexec ${HOME}to firefox.local@Utini2000 commented on GitHub (Nov 6, 2020):
Thanks, I will give it a try later.
I would still prefer to blacklist it for the whole system and whitelist it application specific instead of whitelistening it to the whole system and blacklisting it to specific apps.
@rusty-snake commented on GitHub (Dec 16, 2020):
I'm closing here due to inactivity, please fell free to request to reopen if you have more questions.
machine-idin libreoffice.profile #4271