github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4362] Firefox can't access sndio sound server #2632

New issue

Closed

opened 2026-05-05 09:17:39 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:17:39 -06:00

Owner

Originally created by @nullenvk on GitHub (Jun 19, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4362

Bug and expected behavior
When using firejail, firefox can't play audio through sndio (an alternative to pulseaudio), most likely because it requires access to $HOME/.sndio/cookie. Firefox should be able to connect to sndio with use of the cookie file.

No profile and disabling firejail
Without firejail or without profiles, firefox works fine with sndio and is able to play audio.

Reproduce
Steps to reproduce the behavior:

Start sndio
Run firefox in firejail
Change default cubeb backend to sndio in about:config (media.cubeb.backend = sndio, security.sandbox.content.read_path_whitelist and write_path_whitelist = $HOME/.sndio/cookie)
Play any audio file and receive following errors in console

[Child 262, MediaDecoderStateMachine #1] WARNING: 7f9d097433c0 OpenCubeb() failed to init cubeb: file /var/tmp/portage/www-client/firefox-89.0.1/work/firefox-89.0.1/dom/media/AudioStream.cpp:323
[Child 262, MediaDecoderStateMachine #1] WARNING: Decoder=7f9d0b7c1c00 [OnMediaSinkAudioError]: file /var/tmp/portage/www-client/firefox-89.0.1/work/firefox-89.0.1/dom/media/MediaDecoderStateMachine.cpp:3916

Environment

Gentoo/Linux (latest)
firejail version 0.9.64.4

Checklist

The profile (and redirect profile if exists) hasn't already been fixed upstream.
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
I have performed a short search for similar issues (to avoid opening a duplicate).
If it is a AppImage, --profile=PROFILENAME is used to set the right profile.
Used LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM to get english error-messages.
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

Originally created by @nullenvk on GitHub (Jun 19, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4362 **Bug and expected behavior** When using firejail, firefox can't play audio through sndio (an alternative to pulseaudio), most likely because it requires access to $HOME/.sndio/cookie. Firefox should be able to connect to sndio with use of the cookie file. **No profile and disabling firejail** Without firejail or without profiles, firefox works fine with sndio and is able to play audio. **Reproduce** Steps to reproduce the behavior: 1. Start sndio 2. Run firefox in firejail 3. Change default cubeb backend to sndio in about:config (media.cubeb.backend = sndio, security.sandbox.content.read_path_whitelist and write_path_whitelist = $HOME/.sndio/cookie) 4. Play any audio file and receive following errors in console ``` [Child 262, MediaDecoderStateMachine #1] WARNING: 7f9d097433c0 OpenCubeb() failed to init cubeb: file /var/tmp/portage/www-client/firefox-89.0.1/work/firefox-89.0.1/dom/media/AudioStream.cpp:323 [Child 262, MediaDecoderStateMachine #1] WARNING: Decoder=7f9d0b7c1c00 [OnMediaSinkAudioError]: file /var/tmp/portage/www-client/firefox-89.0.1/work/firefox-89.0.1/dom/media/MediaDecoderStateMachine.cpp:3916 ``` **Environment** - Gentoo/Linux (latest) - firejail version 0.9.64.4 **Checklist** - [X] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [X] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [X] I have performed a short search for similar issues (to avoid opening a duplicate). - [X] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. - [X] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. - [X] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [X] This is not a question. Questions should be asked in https://github.com/netblue30/firejail/discussions.

gitea-mirror closed this issue

2026-05-05 09:17:41 -06:00

gitea-mirror commented

2026-05-05 09:17:42 -06:00

Author

Owner

@nullenvk commented on GitHub (Jun 19, 2021):

Also, when you disable cubeb's sandbox (media.cubeb.sandbox in about:config) with sndio backend enabled, seccomp violations occur when trying to play audio:

Sandbox: seccomp sandbox violation: pid 301, tid 373, syscall 220, args 131111 139665670645564 2 0 139666228847724 139665660862640.

@nullenvk commented on GitHub (Jun 19, 2021): Also, when you disable cubeb's sandbox (media.cubeb.sandbox in about:config) with sndio backend enabled, seccomp violations occur when trying to play audio: ``` Sandbox: seccomp sandbox violation: pid 301, tid 373, syscall 220, args 131111 139665670645564 2 0 139666228847724 139665660862640. ```

gitea-mirror commented

2026-05-05 09:17:43 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 19, 2021):

When using firejail, firefox can't play audio through sndio (an alternative to pulseaudio), most likely because it requires access to $HOME/.sndio/cookie. Firefox should be able to connect to sndio with use of the cookie file.

If whitelist ${HOME}/.sndio/cookie works, we should add it to whitelist-common.inc

Also, when you disable cubeb's sandbox (media.cubeb.sandbox in about:config) with sndio backend enabled, seccomp violations occur when trying to play audio:

syscall 220 is semtimedop on x86_64 and getdents64 on i386. Both aren't blocked by firejail. Can you reproduce this with --noprofile too?

@rusty-snake commented on GitHub (Jun 19, 2021): > When using firejail, firefox can't play audio through sndio (an alternative to pulseaudio), most likely because it requires access to $HOME/.sndio/cookie. Firefox should be able to connect to sndio with use of the cookie file. If `whitelist ${HOME}/.sndio/cookie` works, we should add it to whitelist-common.inc > Also, when you disable cubeb's sandbox (media.cubeb.sandbox in about:config) with sndio backend enabled, seccomp violations occur when trying to play audio: syscall 220 is `semtimedop` on x86_64 and `getdents64` on i386. Both aren't blocked by firejail. Can you reproduce this with `--noprofile` too?

gitea-mirror commented

2026-05-05 09:17:43 -06:00

Author

Owner

@nullenvk commented on GitHub (Jun 19, 2021):

When using firejail, firefox can't play audio through sndio (an alternative to pulseaudio), most likely because it requires access to $HOME/.sndio/cookie. Firefox should be able to connect to sndio with use of the cookie file.

If whitelist ${HOME}/.sndio/cookie works, we should add it to whitelist-common.inc

Also, when you disable cubeb's sandbox (media.cubeb.sandbox in about:config) with sndio backend enabled, seccomp violations occur when trying to play audio:

syscall 220 is semtimedop on x86_64 and getdents64 on i386. Both aren't blocked by firejail. Can you reproduce this with --noprofile too?

The problem doesn't occur when I use --noprofile. However, I think adding that whitelist option to whitelist-common.local stopped these seccomp messages from appearing, although the problem still occurs and firefox prints out that "failed to init cubeb" message.

@nullenvk commented on GitHub (Jun 19, 2021): > > When using firejail, firefox can't play audio through sndio (an alternative to pulseaudio), most likely because it requires access to $HOME/.sndio/cookie. Firefox should be able to connect to sndio with use of the cookie file. > > If `whitelist ${HOME}/.sndio/cookie` works, we should add it to whitelist-common.inc > > > Also, when you disable cubeb's sandbox (media.cubeb.sandbox in about:config) with sndio backend enabled, seccomp violations occur when trying to play audio: > > syscall 220 is `semtimedop` on x86_64 and `getdents64` on i386. Both aren't blocked by firejail. Can you reproduce this with `--noprofile` too? The problem doesn't occur when I use --noprofile. However, I think adding that whitelist option to whitelist-common.local stopped these seccomp messages from appearing, although the problem still occurs and firefox prints out that "failed to init cubeb" message.

gitea-mirror commented

2026-05-05 09:17:44 -06:00

Author

Owner

@nullenvk commented on GitHub (Jun 19, 2021):

Oh, I've found out how to fix it. The program needs to access /tmp/sndio directory too, then the problem stops.

@nullenvk commented on GitHub (Jun 19, 2021): Oh, I've found out how to fix it. The program needs to access /tmp/sndio directory too, then the problem stops.

gitea-mirror referenced this issue

2026-05-05 10:20:25 -06:00

[PR #2632] [CLOSED] Add ignore for feh to allow internet access #4456

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2632

No description provided.

Rows
Columns