[GH-ISSUE #3938] vlc: no video playback (seccomp)

gitea-mirror commented

2026-05-05 09:08:42 -06:00

Owner

Originally created by @MrFrank17 on GitHub (Jan 31, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3938

Hi,

VLC is no showing videos with the standard profile (using Kubuntu 20.10).
If I start it with firejail --noprofile vlc everything is fine as expected.

Starting vlc normally, journalctl --boot --pager-end --follow gives me that:

audit[615706]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3 subj=unconfined pid=615706 comm="vlc" exe="/usr/local/bin/vlc" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7f476f3c667d code=0x0
Jan 31 16:13:50 frank-laptop kernel: audit: type=1326 audit(1612106030.242:57): auid=1000 uid=1000 gid=1000 ses=3 subj=unconfined pid=615706 comm="vlc" exe="/usr/local/bin/vlc" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7f476f3c667d code=0x0
Jan 31 16:13:55 frank-laptop firejail[620322]: blacklist violation - sandbox 1853, exe kioslave5, syscall open64, path /proc/sys/kernel/core_pattern
Jan 31 16:13:55 frank-laptop firejail[620324]: blacklist violation - sandbox 1853, exe kioslave5, syscall open64, path /proc/sys/kernel/core_pattern

Any ideas?

Thanks
Frank

Originally created by @MrFrank17 on GitHub (Jan 31, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/3938 Hi, VLC is no showing videos with the standard profile (using Kubuntu 20.10). If I start it with `firejail --noprofile vlc` everything is fine as expected. Starting vlc normally, `journalctl --boot --pager-end --follow` gives me that: audit[615706]: SECCOMP auid=1000 uid=1000 gid=1000 ses=3 subj=unconfined pid=615706 comm="vlc" exe="/usr/local/bin/vlc" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7f476f3c667d code=0x0 Jan 31 16:13:50 frank-laptop kernel: audit: type=1326 audit(1612106030.242:57): auid=1000 uid=1000 gid=1000 ses=3 subj=unconfined pid=615706 comm="vlc" exe="/usr/local/bin/vlc" sig=31 arch=c000003e syscall=312 compat=0 ip=0x7f476f3c667d code=0x0 Jan 31 16:13:55 frank-laptop firejail[620322]: blacklist violation - sandbox 1853, exe kioslave5, syscall open64, path /proc/sys/kernel/core_pattern Jan 31 16:13:55 frank-laptop firejail[620324]: blacklist violation - sandbox 1853, exe kioslave5, syscall open64, path /proc/sys/kernel/core_pattern Any ideas? Thanks Frank

gitea-mirror

2026-05-05 09:08:42 -06:00

closed this issue
added the
duplicate
label

gitea-mirror commented

2026-05-05 09:08:46 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 31, 2021):

Duplicate of #3219, replace seccomp with seccomp !kcmp in vlc.profile.

@rusty-snake commented on GitHub (Jan 31, 2021): Duplicate of #3219, replace `seccomp` with `seccomp !kcmp` in vlc.profile.

gitea-mirror commented

2026-05-05 09:08:46 -06:00

Author

Owner

@MrFrank17 commented on GitHub (Jan 31, 2021):

Thanks, playback works now!
Something minor: it seems access to some KDE configuration files is still blocked (eg I am using a dark theme and without firejail vlc adapts to that style. Now it is shown in light colors. Also the filebrowser dialog has not all of my individual settings).The journal log shows nothing meaningful ...

@MrFrank17 commented on GitHub (Jan 31, 2021): Thanks, playback works now! Something minor: it seems access to some KDE configuration files is still blocked (eg I am using a dark theme and without firejail vlc adapts to that style. Now it is shown in light colors. Also the filebrowser dialog has not all of my individual settings).The journal log shows nothing meaningful ...

gitea-mirror commented

2026-05-05 09:08:47 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jan 31, 2021):

vlc is a whitelisting profile, if you want to play files stored somewhere else then Desktop/Downloads/Music/Pictures/Videos you must add a whitelist ${HOME}/path/to/file_or_dir to whitelist-player-common.local. Files which store settings like for your Qt-theme should be whitelisted (and maybe read-onlyed) in whitelist-common.inc, looks like there are some paths missing. Do you know where KDE stores this?

@rusty-snake commented on GitHub (Jan 31, 2021): vlc is a whitelisting profile, if you want to play files stored somewhere else then Desktop/Downloads/Music/Pictures/Videos you must add a `whitelist ${HOME}/path/to/file_or_dir` to `whitelist-player-common.local`. Files which store settings like for your Qt-theme should be `whitelist`ed (and maybe `read-only`ed) in `whitelist-common.inc`, looks like there are some paths missing. Do you know where KDE stores this?

gitea-mirror commented

2026-05-05 09:08:48 -06:00

Author

Owner

@MrFrank17 commented on GitHub (Jan 31, 2021):

I used vlc.local, but good to know that there are other ways as well.
Sorry, no idea how KDE handles that (or which folders are used).
I hoped to see a blacklist (or in this case a whitelist?) violation in the journal output.

@MrFrank17 commented on GitHub (Jan 31, 2021): I used `vlc.local`, but good to know that there are other ways as well. Sorry, no idea how KDE handles that (or which folders are used). I hoped to see a blacklist (or in this case a whitelist?) violation in the journal output.

gitea-mirror commented

2026-05-05 09:08:49 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 1, 2021):

blacklist (or in this case a whitelist?) violation in the journal output.

Will not happen for missing whitelist. However, you can firejail --build=~/vlc.profile vlc and then compare all the whitelist ${HOME}/....

@rusty-snake commented on GitHub (Feb 1, 2021): > blacklist (or in this case a whitelist?) violation in the journal output. Will not happen for missing `whitelist`. However, you can `firejail --build=~/vlc.profile vlc` and then compare all the `whitelist ${HOME}/...`.

gitea-mirror commented

2026-05-05 09:08:50 -06:00

Author

Owner

@MrFrank17 commented on GitHub (Feb 1, 2021):

Oh, wasn't aware about that possibility!
Was still a lot to look up - I added this in vlc.local.
Note these are the additional ones, have not checked if they all really needed. Maybe you can give me a hint ...

include /etc/firejail/whitelist-common.inc
include whitelist-usr-share-common.inc

whitelist ${HOME}/.local/share/RecentDocuments
whitelist ${HOME}/.local/share/kioslave5/icons/hicolor
whitelist ${HOME}/.cache/thumbnails
whitelist ${HOME}/.config/pulse
whitelist ${HOME}/.pulse-cookie
whitelist ${HOME}/.cache/thumbnails
whitelist ${HOME}/.Xdefaults-frank-laptop
whitelist ${HOME}/.cache/mesa_shader_cache
whitelist /usr/share/kioslave5
whitelist /usr/share/texmf
whitelist /usr/share/vlc
whitelist /usr/share/kubuntu-default-settings

To have it fully functional I commented also out all the disable*.inc in vlc.profile. That's for sure too much, but I did not had the time to look into that.

@MrFrank17 commented on GitHub (Feb 1, 2021): Oh, wasn't aware about that possibility! Was still a lot to look up - I added this in vlc.local. Note these are the additional ones, have not checked if they all really needed. Maybe you can give me a hint ... include /etc/firejail/whitelist-common.inc include whitelist-usr-share-common.inc whitelist ${HOME}/.local/share/RecentDocuments whitelist ${HOME}/.local/share/kioslave5/icons/hicolor whitelist ${HOME}/.cache/thumbnails whitelist ${HOME}/.config/pulse whitelist ${HOME}/.pulse-cookie whitelist ${HOME}/.cache/thumbnails whitelist ${HOME}/.Xdefaults-frank-laptop whitelist ${HOME}/.cache/mesa_shader_cache whitelist /usr/share/kioslave5 whitelist /usr/share/texmf whitelist /usr/share/vlc whitelist /usr/share/kubuntu-default-settings To have it fully functional I commented also out all the disable*.inc in vlc.profile. That's for sure too much, but I did not had the time to look into that.

gitea-mirror commented

2026-05-05 09:08:50 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 2, 2021):

${HOME}/.local/share/RecentDocuments, ${HOME}/.cache/thumbnails: what the name says
${HOME}/.config/pulse, ${HOME}/.pulse-cookie: pulse audio
${HOME}/.cache/mesa_shader_cache: just a cache
/usr/share: system-wide, not relevant for theme change by user

@rusty-snake commented on GitHub (Feb 2, 2021): `${HOME}/.local/share/RecentDocuments`, `${HOME}/.cache/thumbnails`: what the name says `${HOME}/.config/pulse`, `${HOME}/.pulse-cookie`: pulse audio `${HOME}/.cache/mesa_shader_cache`: just a cache `/usr/share`: system-wide, not relevant for theme change by user

gitea-mirror commented

2026-05-05 09:08:51 -06:00

Author

Owner

@MrFrank17 commented on GitHub (Feb 2, 2021):

Ok, I works now!
The solution is surprisingly simple after all I have tried out - I added to my local profile:
noblacklist ${DOCUMENTS}
noblacklist ${PICTURES}
Not sure why this enough, but well, it works ...

@MrFrank17 commented on GitHub (Feb 2, 2021): Ok, I works now! The solution is surprisingly simple after all I have tried out - I added to my local profile: `noblacklist ${DOCUMENTS}` `noblacklist ${PICTURES}` Not sure why this enough, but well, it works ...

gitea-mirror referenced this issue

2026-05-05 10:18:03 -06:00

[PR #2461] [MERGED] Harden gnome-logs.profile #4328

Rows
Columns

[GH-ISSUE #3938] vlc: no video playback (seccomp) #2461