mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4512] firefox: no sound (whitelisting in ${RUNUSER}) #2690
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2690
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jose1711 on GitHub (Sep 6, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4512
Bug and expected behavior
After a recent update of
firejailI am no longer getting any audio from Firefox.No profile and disabling firejail
firejail --noprofile /path/to/programin a terminal?Sound works
/usr/bin/vlc)?Sound works
Reproduce
Steps to reproduce the behavior:
firejail firefoxpavucontroleither)Environment
Arch Linux, rolling, x86_64
firejail --version) exclusive or used git commit (git rev-parse HEAD)firejail version 0.9.67 (firejail-git r7675.263e3fe72-1)
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.Log
@rusty-snake commented on GitHub (Sep 6, 2021):
ignore include whitelist-run-common.inc?whitelist /usr/share/pipewire( #4483)?media.cubeb.sandbox=falseonabout:config? (TESTING ONLY!)@jose1711 commented on GitHub (Sep 6, 2021):
PipeWire
BINGO! I did have
include firefox-common-addons.profileinfirefox-common.local. After commenting out the line the sound started to work. This line is however suggested byfirefox-common.profileitself:So there is still something in
firefox-common-addons.profilewhich causes audio to break.@rusty-snake commented on GitHub (Sep 6, 2021):
firefox-common-addons.profileignoresinclude whitelist-runuser-common.inc(because it breaks a lot of such programs). But firefox.profile nowwhitelists${RUNUSER}/*firefox*. Therefore all sockets in$XDG_RUNTIME_DIR(D-Bus, Wayland, PipeWire, PulseAudio, ...) are missing.@rusty-snake commented on GitHub (Sep 6, 2021):
@jose1711 commented on GitHub (Sep 6, 2021):
Adding
ignore ${RUNUSER}/*firefox*tofirefox-common-addons.profileas suggested above did not resolve the issue. Or is this just a start and I need to figure out also everything needed for correct communication to PW?@rusty-snake commented on GitHub (Sep 6, 2021):
Sad, is there any other uncommented
whitelist ${RUNUSER}? Maybe search in--debugoutput.What does
firejail --ignore=private-bin --profile=firefox ls /run/user/$UIDshow?@kmk3 commented on GitHub (Sep 7, 2021):
@rusty-snake commented on Sep 6:
->
@jose1711 commented on GitHub (Sep 7, 2021):
This did not help either. I don't know, perhaps this is the cause?
@rusty-snake commented on GitHub (Sep 7, 2021):
Why does it want to create /run/user/1000/pulse? If you use PipeWire, it should not even access it.
@jose1711 commented on GitHub (Sep 7, 2021):
I have no idea. I do have
pipewire-pulseinstalled though.@jose1711 commented on GitHub (Oct 28, 2021):
So what I finally did was edit
firefox-common-addons.profileto contain:and the sound is back. Not sure if it makes to keep this open as this may be an issue impacting only a handful of users.
@jmetrius commented on GitHub (Mar 6, 2022):
Will this fix be included in
firefox-common-addons.profile? I hit the same bug recently.@jmetrius commented on GitHub (Mar 6, 2022):
Nvm. This actual problem might be this:
ignore whitelist ${RUNUSER}/*firefox*infirefox-common-addons.profileis declared too late to stop its counterpartwhitelist ${RUNUSER}/*firefox*infirefox.profilefrom taking effect.Adding
ignore whitelist ${RUNUSER}/*firefox*tofirefox.localinstead immediately resolves this bug. So it seems to be an issue of precedence?@rusty-snake Would it be a good idea to actually preprocess profiles for ignore-statements so they always take effect, independent of the order of declaration?
@rusty-snake commented on GitHub (Mar 7, 2022):
There are even more things like #3358 for which the apply while parsing logic make problems.