github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4324] Access to CEC Adapter blocked by kodi.profile #2622

New issue

Closed

opened 2026-05-05 09:17:03 -06:00 by gitea-mirror · 9 comments

gitea-mirror commented

2026-05-05 09:17:03 -06:00

Owner

Originally created by @lapseofreason on GitHub (Jun 1, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4324

In order to use a CEC adapter in kodi (using libcec), access to /dev/ttyACM0 is required. However, this is blocked by private-dev in kodi.profile.

Bug and expected behavior

Access to /dev/ttyACM0 is required to use CEC adapter, but is denied by kodi.profile.

No profile and disabling firejail

Access to /dev/ttyACM0 works when running it without firejail.

Reproduce
Steps to reproduce the behavior:

Run in bash firejail kodi
Connect a CEC adapter to the USB port.
See the error in kodi (and in the log) about not being able to access the CEC adapter.

Environment

Fedora 34
firejail-0.9.64.4-1.fc34

Additional context
The profile can be overridden locally in kodi.profile, but I could not find a way to override private-dev. It seems to not be able to customize it (#1446). Suggestions for a workaround would be welcome.

Checklist

The profile (and redirect profile if exists) hasn't already been fixed upstream.
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
I have performed a short search for similar issues (to avoid opening a duplicate).
If it is a AppImage, --profile=PROFILENAME is used to set the right profile.
Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

Originally created by @lapseofreason on GitHub (Jun 1, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4324 In order to use a CEC adapter in kodi (using [libcec](https://github.com/Pulse-Eight/libcec)), access to `/dev/ttyACM0` is required. However, this is blocked by `private-dev` in `kodi.profile`. **Bug and expected behavior** - Access to `/dev/ttyACM0` is required to use CEC adapter, but is denied by `kodi.profile`. **No profile and disabling firejail** - Access to `/dev/ttyACM0` works when running it without firejail. **Reproduce** Steps to reproduce the behavior: 1. Run in bash `firejail kodi` 2. Connect a CEC adapter to the USB port. 3. See the error in kodi (and in the log) about not being able to access the CEC adapter. **Environment** - Fedora 34 - firejail-0.9.64.4-1.fc34 **Additional context** The profile can be overridden locally in `kodi.profile`, but I could not find a way to override `private-dev`. It seems to not be able to customize it (#1446). Suggestions for a workaround would be welcome. **Checklist** - [x] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. - [ ] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [x] This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

gitea-mirror closed this issue

2026-05-05 09:17:05 -06:00

gitea-mirror commented

2026-05-05 09:17:06 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 1, 2021):

The profile can be overridden locally in kodi.profile, but I could not find a way to override private-dev. It seems to not be able to customize it (#1446). Suggestions for a workaround would be welcome.

ignore private-dev . . .

@rusty-snake commented on GitHub (Jun 1, 2021): > The profile can be overridden locally in kodi.profile, but I could not find a way to override private-dev. It seems to not be able to customize it (#1446). Suggestions for a workaround would be welcome. `ignore private-dev` . . .

gitea-mirror commented

2026-05-05 09:17:07 -06:00

Author

Owner

@lapseofreason commented on GitHub (Jun 1, 2021):

@rusty-snake Thanks a log for the quick hint to the workaround!

@lapseofreason commented on GitHub (Jun 1, 2021): @rusty-snake Thanks a log for the quick hint to the workaround!

gitea-mirror commented

2026-05-05 09:17:08 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 1, 2021):

Would you say CEC adapters are common enough to be worth adding a note to kodi.profile?

# Add 'ignore private-dev' to your kodi.local if you use a CEC adapter.

@rusty-snake commented on GitHub (Jun 1, 2021): Would you say CEC adapters are common enough to be worth adding a note to kodi.profile? ``` # Add 'ignore private-dev' to your kodi.local if you use a CEC adapter. ```

gitea-mirror commented

2026-05-05 09:17:09 -06:00

Author

Owner

@lapseofreason commented on GitHub (Jun 1, 2021):

Hard to say, for the specific use case of a media center I suspect they are quite common as they allow you to control kodi with the TV remote. There is one on every RaspberryPI, for desktops they are a bit harder to get though.

I just tried the workaround, which did not work so I suspect there must be something else blocking access to /dev/ttyACM0 too. I also tried commenting out private-dev in kodi.profile to make sure I didn't make any mistakes (which didn't work either).

Running firejail --noprofile kodi on the other hand works.

@lapseofreason commented on GitHub (Jun 1, 2021): Hard to say, for the specific use case of a media center I suspect they are quite common as they allow you to control kodi with the TV remote. There is one on every RaspberryPI, for desktops they are a bit harder to get though. I just tried the workaround, which did not work so I suspect there must be something else blocking access to `/dev/ttyACM0` too. I also tried commenting out `private-dev` in kodi.profile to make sure I didn't make any mistakes (which didn't work either). Running `firejail --noprofile kodi` on the other hand works.

gitea-mirror commented

2026-05-05 09:17:09 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 1, 2021):

Then it's either blacklisted

ignore no3d
ignore noinput
ignore nosound
ignore notv
ignore nou2f
ignore novideo

or requires group permissions

ignore nogroups
ignore noroot

I guess.

@rusty-snake commented on GitHub (Jun 1, 2021): Then it's either blacklisted ``` ignore no3d ignore noinput ignore nosound ignore notv ignore nou2f ignore novideo ``` or requires group permissions ``` ignore nogroups ignore noroot ``` I guess.

gitea-mirror commented

2026-05-05 09:17:09 -06:00

Author

Owner

@lapseofreason commented on GitHub (Jun 1, 2021):

Thanks! Adding the following to kodi.local works for me:

ignore private-dev
ignore nogroups
ignore noroot

Without any one of them it does not work.

I understand that it requires nogroups as /dev/ttyACM0 is not world-readable, but I'm unsure why noroot is needed.

@lapseofreason commented on GitHub (Jun 1, 2021): Thanks! Adding the following to `kodi.local` works for me: ``` ignore private-dev ignore nogroups ignore noroot ``` Without any one of them it does not work. I understand that it requires `nogroups` as `/dev/ttyACM0` is not world-readable, but I'm unsure why `noroot` is needed.

gitea-mirror commented

2026-05-05 09:17:10 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 1, 2021):

noroot removes all groups except for firejail, tty (is /dev/ttyACM0 not tty?), audio, video, games.

@rusty-snake commented on GitHub (Jun 1, 2021): `noroot` removes all groups except for `firejail`, `tty` (is `/dev/ttyACM0` not `tty`?), `audio`, `video`, `games`.

gitea-mirror commented

2026-05-05 09:17:10 -06:00

Author

Owner

@lapseofreason commented on GitHub (Jun 1, 2021):

/dev/ttyACM0 is group dialout on Fedora.

@lapseofreason commented on GitHub (Jun 1, 2021): `/dev/ttyACM0` is group `dialout` on Fedora.

gitea-mirror commented

2026-05-05 09:17:11 -06:00

Author

Owner

@lapseofreason commented on GitHub (Jun 3, 2021):

@rusty-snake Thanks a lot, seems like a good compromise to add it as a comment to the profile!

@lapseofreason commented on GitHub (Jun 3, 2021): @rusty-snake Thanks a lot, seems like a good compromise to add it as a comment to the profile!

gitea-mirror referenced this issue

2026-05-05 10:20:19 -06:00

[PR #2622] [MERGED] Fix dconf-editor access to glib schemas #4447

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2622

No description provided.

Rows
Columns