mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4415] steam: cannot launch games (seccomp) #2660
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2660
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @rsramkis on GitHub (Jul 22, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4415
When Firejail is enable (sudo firecfg) The Steam and Steam-Native graphical applications launches and appears to be fully functional. When I try to launch a game (e.g. 'Root') it starts and then stops.
To troubleshoot:
(1) I disbled firejail is (sudo firecfg --clean) and the test game 'Root' launches successfully.
(2) I enable firejail (sudo firecfg) and I can launch Steam from command line with no profile (firejail --noprofile steam) and Steam and the test game 'Root' launch successfully.
(3) Tried to review the below logs and compare with what is in the steam.profile to see what might be missing in the settings.
Environment:
System:
Host: mani Kernel: 5.10.51-1-lts x86_64 bits: 64 Desktop: GNOME 40.3
Distro: EndeavourOS
Logs:
Game Launch Successful:
firejail --noprofile steam
output (click me)
Fails to launch game Logs:
firejail --debug steam
output (click me)
@davidebeatrici commented on GitHub (Jul 22, 2021):
Try to launch with
--ignore=seccomp.@rusty-snake commented on GitHub (Jul 22, 2021):
If this "fixes" it:
2b696b4d90/etc/templates/syscalls.txt (L89-L106)@rsramkis commented on GitHub (Jul 22, 2021):
Hi David,
I tried your suggestion by:
(1) Disabled firejail (sudo firecfg --clean)
(2) Opened terminal and ran the command ' firejail steam --ignore seccomp'.
(3) The Steam client opened, and I opened the game 'Root'.
(4) I then attempted to launch the game and it looked like something started in Steam and Stopped. I saved the output below.
output (click me)
EDIT by @rusty-snake: details-summary for long output
@rsramkis commented on GitHub (Jul 22, 2021):
I tried ' firejail steam --ignore seccomp' but I was not able to launch the game successfully.
@rusty-snake commented on GitHub (Jul 22, 2021):
--ignore=seccomp(with equal-sign btw) is a firejail argument.@rsramkis commented on GitHub (Jul 22, 2021):
My Bad. So I changed to "firejail --ignore=seccomp steam" and I can now launch the test game.
I did an additional test (shortcut) and allowed debuggers and the test game launched also.
Added to steam.profile
I will now start using your recommendation to trace out what it is about Steam which is breaking the profile. One interesting point is the older version of Steam (on my Manjaro Laptop) is not having any issues with Firejail. So must be some new behavior in Steam (there is new things ever since Pipewire Audio was introduced).
A follow up question:
(1) Is this the best place to go for a newbie to learn how to write firejail profile?
https://github.com/netblue30/firejail/wiki/Creating-Profiles
(2) Does the troubleshooting technique change if I was to use the Flatpak version Steam?
@rusty-snake commented on GitHub (Jul 22, 2021):
With newer firejail versions it is recommended to use
--seccomp-error-action=log. I should update syscalls.txt ...@davidebeatrici commented on GitHub (Jul 22, 2021):
Sorry, the argument indeed requires the equal-sign.
I personally added
ignore seccompto~/.config/firejail/steam.profilebecause a few games would just cause a launch loop.@rsramkis commented on GitHub (Jul 23, 2021):
I did some more testing this evening and got some weird results.
Test:
(1) In a new "terminal1' I used terminal command 'sudo
journalctl --grep=syscall --follow`.
(2) Launched Steam "firejail steam > test-steam-launch-root.txt" in terminal 2.
(3) I launch the test game 'Root' and it fails to launch.
(3) Alls I see in Terminal 1 is 👍
So figure I would share to see if you have any suggestions. Thanks.
test-steam-launch-root.txt
@rusty-snake commented on GitHub (Jul 23, 2021):
--seccomp-error-action=log@rsramkis commented on GitHub (Jul 23, 2021):
So pretty much I should run:
firejail --seccomp-error-action=log steam
@rsramkis commented on GitHub (Jul 27, 2021):
Hi,
Thanks for your patience while I do a little juggling. So I ran the command "firejail --seccomp-error-action=log steam" and the test game 'Root' launched with no issues. To do a sanity check I launched steam again with 'firejail steam' and was able to re-produce the problem.
I've attached the logs for "firejail --seccomp-error-action=log steam" just in case it might help us figure out what is going on,
firecfg --version
firecfg version 0.9.66
test-steam-launch-root.txt
@rusty-snake commented on GitHub (Jul 27, 2021):
That's because
--seccomp-error-action=loglogs seccomp violations but does not enforce them (like AppArmor in complain mode or SELinux in Permissive mode).+1 however the seccomp logs are in your syslog. (see https://github.com/netblue30/firejail/issues/4415#issuecomment-884680570)
In rare cases a program just don't work with seccomp, I've already saw a program that had hangs with just
seccomp.drop @swap.@rsramkis commented on GitHub (Jul 27, 2021):
The command I ran in the separate terminal to read the journals while re-producing was "journalctl --grep=syscall --follow". This did not capture any output when using the "firejail --seccomp-error-action=log steam".
So if I have done everything right here, assume we chalk up the solution for now as Added to steam.profile:
This development system EndeavorOS, but my daily driver is Manjaro which won't be upgraded for 1 month. So I may come back and post another comment in on a month to state whether I made the same change there.
@rusty-snake commented on GitHub (Jul 28, 2021):
So adding
allow-debuggersfixes it? If so, can you comment it and try to replace theseccompcommand in steam.profile withseccomp !ptrace,!personality,!process_vm_readvseccomp.drop @defaultseccomp !ptrace,!process_vm_readvseccomp !ptrace,!personality@rsramkis commented on GitHub (Jul 28, 2021):
Hi Rusty-Snake
It is confirmed that enabling "allow-debuggers" fixes the launching issue of individual steam games.
(1) I then replaced the default seccomp lines:
With the following lines:
(2) Ran journalctl --grep=syscall --follow` in a separate terminal.
No output produced during the test.
(3) Disabled Firejail (sudo firecfg --clean).
(4) Launched Steam (firejail steam).
(5) Steam client launched successfully. But unable to launch the test game 'Root'. Below is the terminal output:
terminal output
EDIT by @rusty-snake: details-summary for terminal output
@rusty-snake commented on GitHub (Jul 28, 2021):
I meant to do four testes, one for every
seccomp...that I listed. Sorry if this wasn't clear.e.g. (1) Comment
seccomp !ptraceand addseccomp !ptrace,!personality,!process_vm_readv(2) runfirejail /usr/bin/steamand open Root, does it work yes/no (if no you can skipseccomp !ptrace,!process_vm_readvandseccomp !ptrace,!personality) (3) replaceseccomp !ptrace,!personality,!process_vm_readvwithseccomp.drop @defaultand go to step 2 and so on.@rsramkis commented on GitHub (Jul 28, 2021):
Thanks for your feedback. I had this feeling looking at the seccomp commands I had gotten the test wrong.
So something very interesting came up. I noticed that on Linux that the problem I originally identified changes when I run steam:
(1) From "Steam (runtime)" icon.
--No extra configuration lines are needed in the steam.profile to run Steam Client and Steam games.
(2) Run 'firejail steam' from terminal (zsh configured) where Steam Client launches but not individual games.
--For some reason the "allow-debugger" line does not work dependably from terminal.
--all 'setcomp' lines were tested individually all all failed.
So .... as a QA I am quite puzzled why it is all working while running from the desktop program icon. Because this is how I was running it when I had issues starting a game.
Maybe the question is why are games failing when steam is launched from terminal?
Test Steps:
(1) Launch Allacritty to open the terminal.
(2) Prompt opens as ZSH.
(3) Launch steam 'steam'
(4) Steam client launches. The games start and stop (e.g. 'Roor').
@rusty-snake commented on GitHub (Jul 28, 2021):
Executed by the desktop-filefirejail /path/to/programif you have a firecfg symlink for programfirejail --list)@DoPlJoe commented on GitHub (Aug 1, 2021):
I have the same problem and none of the 4 lines solves it for me, it does work with "--ignore=seccomp". Going with the journal log, I get the following numbers: 349, 165, 155, 166 and 303 in the journal. Feeding those in debug-syscalls gives me nothing for 349 and then "mount", "pivot_root", "umount2", "name_to_handle_at" respectively.
For reference I was trying to run "Deus Ex: Human Revolution - Director's Cut", when I ran into the issue, but didn't get the issue with the 1/2 other proton titles I tried.
@kmk3 commented on GitHub (Aug 1, 2021):
@DoPlJoe commented 7 minutes ago:
See also #3219.
@DoPlJoe commented on GitHub (Aug 1, 2021):
Should I add something to the profile or is this just as an addendum?
@rusty-snake commented on GitHub (Aug 1, 2021):
You should exceptions to the profile. Which architecture have the logged syscalls? All i386 (
arch=40000003)?@kmk3 commented on GitHub (Aug 1, 2021):
It was an addendum to explain where 349 comes from / how to debug 32-bit
syscalls.
I don't know about the other syscalls, but since #4375, kcmp shouldn't be
blocked by default anymore. Which firejail version are you using?
@DoPlJoe commented on GitHub (Aug 2, 2021):
I'm using Manjaro(Arch) and the official community package 0.9.66-1.
@rsramkis commented on GitHub (Aug 3, 2021):
Hi,
I use "sudo firecfg" to create the system links for the majority of the Gnome\Installed programs. So in the case of launching steam:
@rsramkis commented on GitHub (Aug 5, 2021):
Interestingly enough the issue came back today after I did an upgrade of the package to version "Steam 1.0.0.71-1". I ended up adding the line "ignore seccomp" to the steam.profile and I was back up and running.
So more steam behavior to figure out.
@rsramkis commented on GitHub (Oct 20, 2021):
Closing this issue for now with the above configuration changes. Thank you,