github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3951] firejail rtkit dbus support #2472

New issue

Open

opened 2026-05-05 09:09:21 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:09:21 -06:00

Owner

Originally created by @hautecodure on GitHub (Feb 6, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3951

I'm trying to get PipeWire running, but its built-in module to elevate process priority, utilizing rtkit, seems to error out, when trying to do so.

The error: Failed to look up client: No such file or directory seems out-of-place, but looking at the source, rtkit utilizes GetConnectionUnixProcessID to get information about the calling process and throws EIO if it fails.

I tried running firejail --build (which shouldn't be limited by a profile config), but the error still appears and the resulting config does not contain any dbus references.

Is this functionality supported in firejail?

Env:

firejail 0.9.6.5
rtkit 0.13.1

Originally created by @hautecodure on GitHub (Feb 6, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/3951 I'm trying to get `PipeWire` running, but its built-in module to elevate process priority, utilizing `rtkit`, seems to error out, when trying to do so. The error: `Failed to look up client: No such file or directory` seems out-of-place, but looking at the [source](https://github.com/heftig/rtkit/blob/master/rtkit-daemon.c#L1017), `rtkit` utilizes [GetConnectionUnixProcessID](https://github.com/heftig/rtkit/blob/master/rtkit-daemon.c#L981) to get information about the calling process and throws `EIO` if it fails. I tried running `firejail --build` (which shouldn't be limited by a profile config), but the error still appears and the resulting config does not contain any `dbus` references. Is this functionality supported in `firejail`? Env: - firejail 0.9.6.5 - rtkit 0.13.1

gitea-mirror commented

2026-05-05 09:09:23 -06:00

Author

Owner

@kris7t commented on GitHub (Feb 6, 2021):

I think firejail --build doesn't really support dbus, so you'll have to write your dbus lines in the profile yourself. Not sure though why does it fail without any profile.

@kris7t commented on GitHub (Feb 6, 2021): I think `firejail --build` doesn't really support dbus, so you'll have to write your `dbus` lines in the profile yourself. Not sure though why does it fail without any profile.

gitea-mirror commented

2026-05-05 09:09:24 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 7, 2021):

--build implies --nonewprivs and --caps.drop=all. For testing if this works with firejail at all, you should use --noprofile and --profile=noprofile.profile.

static unsigned long get_unix_process_id(

_{c295fa849f/rtkit-daemon.c (L973)}

If this is a pid outside of the sandbox, it will fail.

@rusty-snake commented on GitHub (Feb 7, 2021): `--build` implies `--nonewprivs` and `--caps.drop=all`. For testing if this works with firejail at all, you should use --noprofile and --profile=[noprofile.profile](https://gist.github.com/rusty-snake/bb234cb3e50e1e4e7429f29a7931cc72). --- ```C static unsigned long get_unix_process_id( ``` <sub>https://github.com/heftig/rtkit/blob/c295fa849f52b487be6433e69e08b46251950399/rtkit-daemon.c#L973</sub> If this is a pid outside of the sandbox, it will fail.

gitea-mirror commented

2026-05-05 09:09:25 -06:00

Author

Owner

@hautecodure commented on GitHub (Feb 7, 2021):

Thank for the suggestions, i think I've made a bit of a progress, but not sure how to continue.

I think the issue is not related to dbus itself. After reading a bit more, rtkit expects a MakeThreadRealtime/MakeThreadHighPriority call with tid as argument. This argument is the return from the gettid syscall as seen in module-rtkit in PipeWire.

With firejail --profile=noprofile.profile, gettid is filtered, returning a 1 < tid < 100 long.
Without firejail, tid == pid

Any suggestions what's the best/cleanest way to proceed?

@hautecodure commented on GitHub (Feb 7, 2021): Thank for the suggestions, i think I've made a bit of a progress, but not sure how to continue. I think the issue is not related to dbus itself. After reading a bit more, `rtkit` expects a `MakeThreadRealtime`/`MakeThreadHighPriority` call with `tid` as argument. This argument is the return from the `gettid` syscall as seen in [module-rtkit](https://gitlab.freedesktop.org/pipewire/pipewire/-/blob/master/src/modules/module-rtkit.c) in `PipeWire`. - With `firejail --profile=noprofile.profile`, `gettid` is filtered, returning a `1 < tid < 100` long. - Without `firejail`, `tid == pid` Any suggestions what's the best/cleanest way to proceed?

gitea-mirror commented

2026-05-05 09:09:26 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 7, 2021):

If a program still fail with this profile, it is incompatible with firejail.

Keep in mind that even with this profile some things are done which can break the program.

a new private pid-namespace is created

@rusty-snake commented on GitHub (Feb 7, 2021): > If a program still fail with this profile, it is incompatible with firejail. > Keep in mind that even with this profile some things are done which can break the program. > - a new private pid-namespace is created

gitea-mirror commented

2026-05-05 09:09:27 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 7, 2021):

Possible that we need a do-not-create-a-new-pid-namespace command. The new pid-namespace is the reason why there is no profile for teamviewer and is the presumed cause why push-to-talk in zoom don't work and ... .

Maybe playing with unshare --mount --user --pid --map-current-user --mount-proc --fork helps to findout more.

@rusty-snake commented on GitHub (Feb 7, 2021): Possible that we need a `do-not-create-a-new-pid-namespace` command. The new pid-namespace is the reason why there is no profile for teamviewer and is the presumed cause why push-to-talk in zoom don't work and ... . Maybe playing with `unshare --mount --user --pid --map-current-user --mount-proc --fork` helps to findout more.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2472

No description provided.

Rows
Columns