github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

hidraw access (and enumeration fails) #2808

New issue

Closed

opened 2026-05-05 09:27:50 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:27:50 -06:00

Owner

Originally created by @WPettersson on GitHub (Feb 2, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4892

Description

I've been using steam under firejail for a while now, including a steam controller and everything had worked fine. Until a couple of days ago. It's taken a while to work out what happened, but I think it was down to me switching to using the controller wireless. This meant that the USB dongle is now inserted permanently in my PC, and in particular at boot. And a recent reboot changed /dev/hidraw? numbering, pushing the steam controller down from /dev/hidraw{9..12} to /dev/hidraw{4..8}.

For the record, I'm running Gentoo, firejail is at 0.9.64.4 which is admittedly old. The reason I'm posting this is that I also have a solution to this on my end.

Steps to Reproduce

Have the steam controller registered under /dev/hidraw{0..9} (all 5 in that range).
Run Steam
Try to use controller

Expected behavior

Controller to work, Steam recognises the USB receiver

Actual behavior

Controller does not work, Steam does not recognise the USB receiver

Behavior without a profile

Works fine

Additional context

The problem is access to the Steam controller /dev/hidraw? devices:

https://github.com/netblue30/firejail/blob/121749f0ca167eb3705ed2d5170ec6bd308c3ea5/src/firejail/fs_dev.c#L81

This shows that /dev/hidraw{0..9} are blocked if nou2f is enabled. Disabling nou2f does fix my issue, and the steam controller works again.

This leads to some questions:

nou2f clearly was renamed in the past 71a3b97ce5 but is it still a good name?
The code above only blocks /dev/hidraw{0..9} - should this be extended to block further elements? Up to /dev/hidraw20? Possibly with wildcard matching?
Should the Steam profile have nou2f removed? Some people might want to keep Steam from accessing u2f, while others (like me) want to use a steam controller.

Environment

Gentoo rolling stable-ish version
Firejail 0.9.64.4

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
- I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Originally created by @WPettersson on GitHub (Feb 2, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/4892 ### Description I've been using steam under firejail for a while now, including a steam controller and everything had worked fine. Until a couple of days ago. It's taken a while to work out what happened, but I think it was down to me switching to using the controller wireless. This meant that the USB dongle is now inserted permanently in my PC, and in particular at boot. And a recent reboot changed `/dev/hidraw?` numbering, pushing the steam controller down from `/dev/hidraw{9..12}` to `/dev/hidraw{4..8}`. For the record, I'm running Gentoo, firejail is at 0.9.64.4 which is admittedly old. The reason I'm posting this is that I also have a solution to this on my end. ### Steps to Reproduce 1. Have the steam controller registered under `/dev/hidraw{0..9}` (all 5 in that range). 2. Run Steam 3. Try to use controller ### Expected behavior Controller to work, Steam recognises the USB receiver ### Actual behavior Controller does not work, Steam does not recognise the USB receiver ### Behavior without a profile Works fine ### Additional context The problem is access to the Steam controller `/dev/hidraw?` devices: * <https://github.com/netblue30/firejail/blob/121749f0ca167eb3705ed2d5170ec6bd308c3ea5/src/firejail/fs_dev.c#L81> This shows that `/dev/hidraw{0..9}` are blocked if `nou2f` is enabled. Disabling `nou2f` does fix my issue, and the steam controller works again. This leads to some questions: 1. `nou2f` clearly was renamed in the past 71a3b97ce5c6990b06ec674e4739ce6dfcab6b40 but is it still a good name? 2. The code above only blocks `/dev/hidraw{0..9}` - should this be extended to block further elements? Up to `/dev/hidraw20`? Possibly with wildcard matching? 3. Should the Steam profile have `nou2f` removed? Some people might want to keep Steam from accessing u2f, while others (like me) want to use a steam controller. ### Environment - Gentoo rolling stable-ish version - Firejail 0.9.64.4 ### Checklist - [X] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [X] I can reproduce the issue without custom modifications (e.g. globals.local). - [X] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [X] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [X] I have performed a short search for similar issues (to avoid opening a duplicate). - [X] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [X] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)

gitea-mirror

2026-05-05 09:27:50 -06:00

closed this issue
added the
duplicate
label

gitea-mirror commented

2026-05-05 09:27:52 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 2, 2022):

The code above only blocks /dev/hidraw{0..9} - should this be extended to block further elements? Up to /dev/hidraw20? Possibly with wildcard matching?

#2723

@rusty-snake commented on GitHub (Feb 2, 2022): > The code above only blocks /dev/hidraw{0..9} - should this be extended to block further elements? Up to /dev/hidraw20? Possibly with wildcard matching? #2723

gitea-mirror commented

2026-05-05 09:27:54 -06:00

Author

Owner

@kmk3 commented on GitHub (Apr 10, 2025):

The problem is access to the Steam controller /dev/hidraw? devices:

firejail/src/firejail/fs_dev.c

This shows that /dev/hidraw{0..9} are blocked if nou2f is enabled.
Disabling nou2f does fix my issue, and the steam controller works again.

This leads to some questions:

nou2f clearly was renamed in the past
71a3b97
but is it still a good name?

I'd say probably not, though this is a known issue.

The code above only blocks /dev/hidraw{0..9} - should this be extended
to block further elements? Up to /dev/hidraw20? Possibly with wildcard
matching?

Should be fixed by:

#6704

Should the Steam profile have nou2f removed? Some people might want to
keep Steam from accessing u2f, while others (like me) want to use a steam
controller.

Removed in:

#6534

@kmk3 commented on GitHub (Apr 10, 2025): > The problem is access to the Steam controller `/dev/hidraw?` devices: > > * [firejail/src/firejail/fs_dev.c](https://github.com/netblue30/firejail/blob/121749f0ca167eb3705ed2d5170ec6bd308c3ea5/src/firejail/fs_dev.c#L81) > This shows that `/dev/hidraw{0..9}` are blocked if `nou2f` is enabled. > Disabling `nou2f` does fix my issue, and the steam controller works again. > > This leads to some questions: > > 1. `nou2f` clearly was renamed in the past > [71a3b97](https://github.com/netblue30/firejail/commit/71a3b97ce5c6990b06ec674e4739ce6dfcab6b40) > but is it still a good name? I'd say probably not, though this is a known issue. > 2. The code above only blocks `/dev/hidraw{0..9}` - should this be extended > to block further elements? Up to `/dev/hidraw20`? Possibly with wildcard > matching? Should be fixed by: * #6704 > 3. Should the Steam profile have `nou2f` removed? Some people might want to > keep Steam from accessing u2f, while others (like me) want to use a steam > controller. Removed in: * #6534

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2808

No description provided.

Rows
Columns