mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #4855] chromium: no sound with pipewire #2795
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2795
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @reinerh on GitHub (Jan 14, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4855
Someone on the Debian bug tracker reported that Chromium 97 no longer plays sound when firejailed.
I was able to reproduce that.
I narrowed it down to whitelists inside the HOME directory.
I.e. I disabled
include whitelist-common.incand allwhitelist ${HOME}/...in chromium.profile and chromium-common.profile, and then sound was working again.But I have problems figuring out which additional directory needs to be whitelisted.
I tried
--trace(which just hangs and doesn't even open the Chromium window),--trace=file(which opens the windows, but does not load a website) and then usedstraceto log opened files.But nothing looks sound-related in there.
Here is the console output with broken sound:
@rusty-snake commented on GitHub (Jan 14, 2022):
If no one else has an idea, I would suggest to narrow it down with something like
for file in ./.*; do echo "whitelist $(realpath "$file")"; done.@reinerh commented on GitHub (Jan 14, 2022):
@rusty-snake That was a very good idea, thanks.
I figured out that it is related to my setup... I'm using pipewire (which emulates pulseaudio) and have its runtime directory in
~/pipewire, which was blocked...It worked for me after whitelisting the directory. So I guess there is a different problem for the original reporter. I'll ask them about their setup...
@antonv6 commented on GitHub (Jan 16, 2022):
The follow-up from Mad Horse on the original bug has a hint:
No idea what the new version of chromium means by "secure directory", but I added
whitelist ${RUNUSER}/pulse(so the entire directory, not just pulse/native file) to chromium.local and now sound works through pipewire-pulse again.@rusty-snake commented on GitHub (Jan 16, 2022):
https://bugs.gentoo.org/show_bug.cgi?id=699776
@netblue30 commented on GitHub (Jan 16, 2022):
The directory will have to be hardcoded and activated by default by --private and --whitelist commands. For example we have alsa and pulse brought in by default by --private:
Do we know what directories (runtime and config under /home/username) are they using? My impression is pipewire is still under heavy development. I'm not sure what's happening in Fedora, probably this is where it will be deployed first. Anyway, I'm going for a test release (0.9.68~rc1) next week, the big release two weeks later. We can wait to bring in pipewire if needed.
@reinerh commented on GitHub (Jan 16, 2022):
Pipewire works actually fine. It's already whitelisted in includes:
The problem I had was just very specific to my setup, as I have manually pointed the runtime path to somewhere else.
Though it's not yet clear what problem the OP has...
@netblue30 commented on GitHub (Jan 16, 2022):
OK, thanks! If they come with a user file or directory under /home/username we'll make it default later.
@rusty-snake commented on GitHub (Jan 16, 2022):
FWIW
man 4 pipewire.confThese are the deamon config files, there is
/usr/share/pipewire/client.confbut IDK if it has a user equivalent.@netblue30 commented on GitHub (Jan 16, 2022):
I'll make it default as ~/.config/pipewire/pipewire.conf
@rusty-snake commented on GitHub (Jan 16, 2022):
This file is read by pipewire (the deamon). IDK if the client library read's it too but I don't think so. If we allow it inside the sandbox, it must be read-only (it's turing complete and pipewire isn't sandboxed).
@netblue30 commented on GitHub (Jan 16, 2022):
OK, so we don't need to add it for --private/--whitelist.
Question: is --nosound option working on a pipewire setup?
@reinerh commented on GitHub (Jan 16, 2022):
Just tested it.
firejail --nosound chromiumis still able to play sound in youtube videos.Edit: but as mentioned, I have my pipewire rundir (which has the socket) in a non-standard path.
@netblue30 commented on GitHub (Jan 16, 2022):
--nosound should be fine now if XDG_RUNTIME_DIR env variable is configured or if the socket is under /run/user/UID/pipewire-*
60231bd3ca@netblue30 commented on GitHub (Feb 3, 2022):
I think this one is closed.