mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4523] No webcams in Zoom #2693
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2693
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @algor512 on GitHub (Sep 10, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4523
Bug and expected behavior
Webcam is not working in Zoom using both zoom.profile and noprofile
(the list "Camera" in Zoom settings is empty).
I call firejail+Zoom as
firejail --whitelist=$XDG_RUNTIME_DIR --ignore=nogroups --profile=zoom --appimage /opt/Zoom-5.7.31792.0820.glibc2.17-x86_64.AppImage(without
--whitelist=$XDG_RUNTIME_DIRpulseaudio don't work, and I use--ignore=nogroupssince I am using distro without systemd).No profile and disabling firejail
firejail --noprofile --appimage /opt/Zoom-5.7.31792.0820.glibc2.17-x86_64.AppImagechanges nothing (webcam is still not working)./opt/Zoom-5.7.31792.0820.glibc2.17-x86_64.AppImage) works well (i.e. webcam is working).Reproduce
Steps to reproduce the behavior:
firejail --whitelist=$XDG_RUNTIME_DIR --ignore=nogroups --profile=zoom --appimage /opt/Zoom-5.7.31792.0820.glibc2.17-x86_64.AppImageAdditional context
It is interesting that after running bash in firejail using zoom profile it is possible to access webcam. That is
produces a video recorded from it.
Environment
Distro: Void Linux (with glibc)
Firejail version: commit
af94772, I also had the same problem on latest stable version 0.9.66.Zoom version: Zoom-5.7.31792.0820.glibc2.17-x86_64.AppImage from https://github.com/probonopd/Zoom.AppImage/releases/tag/stable
Checklist
https://github.com/netblue30/firejail/issues/1139)--profile=PROFILENAMEis used to set the right profile.LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAMto get english error-messages.browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.Log
debug output
@rusty-snake commented on GitHub (Sep 10, 2021):
Can you try
using the noprofile.profile--appimageIt's 2:
Use
[x]to get@rusty-snake commented on GitHub (Sep 10, 2021):
af947720d5/src/firejail/sandbox.c (L793-L794)af947720d5/src/firejail/sandbox.c (L579-L591)@algor512 commented on GitHub (Sep 10, 2021):
firejail --whitelist=$XDG_RUNTIME_DIR --ignore=nogroups --noprofile /opt/Zoom-5.7.31792.0820.glibc2.17-x86_64.AppImageworks well.It seems to I have to whitelist something in /lib/modules/?
Thank you, I've fixed it.
@rusty-snake commented on GitHub (Sep 10, 2021):
No. Try to
--ignore=private-devbut I'm not sure.Where does void put the pa socket? (
ls -lR /run/user/$UID)@algor512 commented on GitHub (Sep 10, 2021):
I checked /bin/fusermount permissions by running bash in firejail, they are 400.
I think pa puts its socket in $XDG_RUNTIME_DIR/pulse/ by default. In my system $XDG_RUNTIME_DIR is set to
mktemp -d /tmp/$(id -u)-runtime-dir.XXXin .xinitrс (but it may vary, it is not a default path).As I understand I cannot use env vars in zoom.local, so I think it's ok to call firejail with
--whitelist=$XDG_RUNTIME_DIRin my situation.@rusty-snake commented on GitHub (Sep 10, 2021):
--noblacklist='${PATH}/fusermount'🤦
${RUNUSER}macro but IDK if it works, at some points/run/user/$UIDis hardcoded and at some${XDG_RUNTIME_DIR:-/run/user/$UID}is used.whitelist /tmp/<YOUR UID>-runtime-dir.???/pulse/nativeto your zoom.local@algor512 commented on GitHub (Sep 10, 2021):
Now I get the error
fusermount: failed to open mountpoint for reading: Permission denied.This is strange, but with
--whitelist=$XDG_RUNTIME_DIRpa works well, while with--whitelist=$XDG_RUNTIME_DIR/pulseor--whitelist=$XDG_RUNTIME_DIR/pulse/nativeit doesn't.The pa socket is there:
@rusty-snake commented on GitHub (Sep 11, 2021):
You need to findout where it tries to mount (maybe
ignore disable-mnt?).@algor512 commented on GitHub (Sep 11, 2021):
When I run appimage without firejail, the mount point is
/tmp/.mount_Zoom-5i90DLq. I think, the problem is that the owner of/tmp/.mount_Zoom-5i90DLqis root, and I don't know what permissions are set for this directory (normally they are rwxr-xr-x).@rusty-snake commented on GitHub (Sep 11, 2021):
Blindly guessing:
--ignore=caps.keep@algor512 commented on GitHub (Sep 12, 2021):
I don't know why but it works, thank you!
@makew0rld commented on GitHub (Apr 26, 2022):
Was also experiencing this issue with Zoom installed from Archlinux, using the package zoom-firejail.
Using
--ignore=caps.keepalso worked for me to fix the problem, which only started occurring recently. Should I open a new issue?Also, @rusty-snake could you explain what that flag does?
@rusty-snake commented on GitHub (Apr 26, 2022):
It keep all capabilities in the bounding set.
@makew0rld commented on GitHub (Apr 26, 2022):
So with
ignore, does that basically disable the sandboxing of Zoom, losing the security of firejail? Or am I misunderstanding.@rusty-snake commented on GitHub (Apr 26, 2022):
ignore=caps.keepignore one line in zoom.profile. I wouldn't say it disables sandboxing, it just weaks the sandbox in one point.@makew0rld commented on GitHub (Apr 26, 2022):
Which line is that?
@rusty-snake commented on GitHub (Apr 26, 2022):
Ok, it's electron.profile
afee8603f3/etc/profile-a-l/electron.profile (L29)@makew0rld commented on GitHub (Jun 6, 2022):
Just to update on this: this fix works when I open Zoom firejail from my launcher, but if I have Firefox open it from a Zoom link, the same issue of my camera not working comes back. @rusty-snake any idea why launching from Firefox is different and how to fix this?
@rusty-snake commented on GitHub (Jun 6, 2022):
If that means that zoom runs inside the firejail sandbox I'm surprised that this even works. Anyway in that case it's better to copy the link/id and paste it into zoom.
@makew0rld commented on GitHub (Jun 6, 2022):
I'm not sure exactly what you mean. Allow me to clarify the setup: I have a zoom-firejail.desktop file, so that Firefox can see firejailed Zoom as its own application. When I open a Zoom link in Firefox (firefox is not in a firejail but that shouldn't be relevant), Firefox opens the link using firejailed Zoom. This opens and works fine, except the webcam doesn't work. This still occurs even with
--ignore=caps.keepin place.Yes this is what I have been doing. But this becomes tedious especially with passwords on meetings and link shorteners. Do you have any idea why this is happening and if there's a way to fix it?
@rusty-snake commented on GitHub (Jun 6, 2022):
Important point. Forget my previous comment. And I don't have any idea for this, sorry.