[GH-ISSUE #5185] steam: World of Tanks Blitz fails with new GE-Proton (seccomp) #2907

Closed
opened 2026-05-05 09:34:10 -06:00 by gitea-mirror · 10 comments
Owner

Originally created by @rsramkis on GitHub (Jun 9, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5185

Description

When launching the Steam version of World of Tanks Blitz (WOT Blitz) with Offical Steam Proton 7 or higher the game will fail to complete login with the error:

"Unable to log in to the server. Your current version of the game is corrupt. Please update or reinstall the client. Error code: 89 ".

image

This was re-produced on:

  • Latest version of Steam Proton v7
  • Glorious Eggroll GE-Proton7-18 (released on 2022-05-19)

The issue does not occur on "Glorius Eggroll Proton-7.2-GE-2" (released on 2022-02-14).

If there is a better way to handle this issue, please let me know. Thanks.

Steps to Reproduce

  1. Enable Firejail in terminal with "sudo firecfg".
  2. Launch Steam and install the latest version (v9 at the moment) of World of Tanks Blitz)
  3. Choose custom Proton version of official Steam Proton 7 or GE-Proton7-18.
  4. Launch the game and you will not be able to login to Wargaming with the error reported.

Expected behavior

WOT Blitz should complete login to Wargaming Servers with terminal messages like:

*** MESA_GLSL_CACHE_DIR is deprecated; use MESA_SHADER_CACHE_DIR instead ***
*** MESA_GLSL_CACHE_MAX_SIZE is deprecated; use MESA_SHADER_CACHE_MAX_SIZE instead ***
*   Trying 5.101.222.14...
* TCP_NODELAY set
* Connected to stufficons.wgcdn.co (5.101.222.14) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=CY; L=Nicosia; O=Wargaming Group Limited; CN=*.wgcdn.co
*  start date: Mar 21 00:00:00 2022 GMT
*  expire date: Apr 21 23:59:59 2023 GMT
*  subjectAltName: host "stufficons.wgcdn.co" matched cert's "*.wgcdn.co"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1
*  SSL certificate verify result: unable to get local issuer certificate (20), continuin
g anyway.
> GET /localizations/en.yaml HTTP/1.1
Host: stufficons.wgcdn.co
Accept: */*
Cache-Control: no-cache
Accept-Language: en
If-None-Match: "62a0b0e3-59de9"

< HTTP/1.1 304 Not Modified
< Server: nginx
< Date: Thu, 09 Jun 2022 03:09:28 GMT
< Connection: keep-alive
< Last-Modified: Wed, 08 Jun 2022 14:23:31 GMT
< ETag: "62a0b0e3-59de9"
< Cache: HIT
< X-Cached-Since: 2022-06-09T03:00:01+00:00
< X-ID: td2-up-gc11
<
* Connection #0 to host stufficons.wgcdn.co left intact
Installing breakpad exception handler for appid(steam)/version(1654574690)
ThreadGetProcessExitCode: no such process 50246
ThreadGetProcessExitCode: no such process 50231

Actual behavior

WOT Blitz fails to login to Wargaming Servers with terminal messages like:

*** MESA_GLSL_CACHE_DIR is deprecated; use MESA_SHADER_CACHE_DIR instead ***
*** MESA_GLSL_CACHE_MAX_SIZE is deprecated; use MESA_SHADER_CACHE_MAX_SIZE instead ***
ThreadGetProcessExitCode: no such process 1678
ThreadGetProcessExitCode: no such process 1662
ThreadGetProcessExitCode: no such process 1656
ThreadGetProcessExitCode: no such process 1650
ThreadGetProcessExitCode: no such process 1628
ThreadGetProcessExitCode: no such process 1625
ThreadGetProcessExitCode: no such process 1619
ThreadGetProcessExitCode: no such process 1617
pid 1621 != 1620, skipping destruction (fork without exec?)
Game process removed: AppID 444200 "/home/rsruser/.local/share/Steam/ubuntu12_32/reaper SteamLaunch AppId=444200 -- '/home/rsruser/.local/share/Steam/steamapps/common/SteamLinuxRuntime_soldier'/_v2-entry-point --verb=waitforexitandrun -- '/home/rsruser/.local/share/Steam/compatibilitytools.d/GE-Proton7-18'/proton waitforexitandrun  '/home/rsruser/.local/share/Steam/steamapps/common/World of Tanks Blitz/wotblitz.exe'", ProcID 1695
ThreadGetProcessExitCode: no such process 1695
ThreadGetProcessExitCode: no such process 1637
ThreadGetProcessExitCode: no such process 1480

Temporary Work Around for Steam Proton v7 and Glorious Eggroll GE-Proton7-18

  1. Create 'steam.local' file in ~/.config/firejail.
  2. Add the line "ignore seccomp "

Environment

❯ inxi -b
System:
  Host: mani Kernel: 5.18.1-zen1-1-zen arch: x86_64 bits: 64 Desktop: GNOME
    v: 42.2 Distro: EndeavourOS
CPU:
  Info: dual core Intel Core i5-5300U [MT MCP] speed (MHz): avg: 1323
    min/max: 500/2900
Graphics:
  Device-1: Intel HD Graphics 5500 driver: i915 v: kernel
  Device-2: Chicony Integrated Camera type: USB driver: uvcvideo
  Display: wayland server: X.org v: 1.21.1.3 with: Xwayland v: 22.1.2
    compositor: gnome-shell driver: X: loaded: intel
    unloaded: fbdev,modesetting,vesa gpu: i915 resolution: 1920x1200~60Hz
  OpenGL: renderer: Mesa Intel HD Graphics 5500 (BDW GT2)
    v: 4.6 Mesa 22.1.1

Checklist

  • The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
  • I can reproduce the issue without custom modifications (e.g. globals.local).
  • The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
  • The profile (and redirect profile if exists) hasn't already been fixed upstream.
  • [ x] I have performed a short search for similar issues (to avoid opening a duplicate).
    • [x ] I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
  • I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)
Originally created by @rsramkis on GitHub (Jun 9, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5185 ### Description When launching the Steam version of World of Tanks Blitz (WOT Blitz) with Offical Steam Proton 7 or higher the game will fail to complete login with the error: "Unable to log in to the server. Your current version of the game is corrupt. Please update or reinstall the client. Error code: 89 ". ![image](https://user-images.githubusercontent.com/14362317/172899638-1cae22d7-8612-4478-923b-617f7e4decae.png) This was re-produced on: * Latest version of Steam Proton v7 * Glorious Eggroll [GE-Proton7-18](https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/GE-Proton7-18) (released on 2022-05-19) The issue does not occur on "Glorius Eggroll [Proton-7.2-GE-2](https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/7.2-GE-2)" (released on 2022-02-14). If there is a better way to handle this issue, please let me know. Thanks. ### Steps to Reproduce 1. Enable Firejail in terminal with "sudo firecfg". 2. Launch Steam and install the latest version (v9 at the moment) of World of Tanks Blitz) 3. Choose custom Proton version of official Steam Proton 7 or GE-Proton7-18. 4. Launch the game and you will not be able to login to Wargaming with the error reported. ### Expected behavior WOT Blitz should complete login to Wargaming Servers with terminal messages like: ``` *** MESA_GLSL_CACHE_DIR is deprecated; use MESA_SHADER_CACHE_DIR instead *** *** MESA_GLSL_CACHE_MAX_SIZE is deprecated; use MESA_SHADER_CACHE_MAX_SIZE instead *** * Trying 5.101.222.14... * TCP_NODELAY set * Connected to stufficons.wgcdn.co (5.101.222.14) port 443 (#0) * ALPN, offering http/1.1 * Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: C=CY; L=Nicosia; O=Wargaming Group Limited; CN=*.wgcdn.co * start date: Mar 21 00:00:00 2022 GMT * expire date: Apr 21 23:59:59 2023 GMT * subjectAltName: host "stufficons.wgcdn.co" matched cert's "*.wgcdn.co" * issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1 * SSL certificate verify result: unable to get local issuer certificate (20), continuin g anyway. > GET /localizations/en.yaml HTTP/1.1 Host: stufficons.wgcdn.co Accept: */* Cache-Control: no-cache Accept-Language: en If-None-Match: "62a0b0e3-59de9" < HTTP/1.1 304 Not Modified < Server: nginx < Date: Thu, 09 Jun 2022 03:09:28 GMT < Connection: keep-alive < Last-Modified: Wed, 08 Jun 2022 14:23:31 GMT < ETag: "62a0b0e3-59de9" < Cache: HIT < X-Cached-Since: 2022-06-09T03:00:01+00:00 < X-ID: td2-up-gc11 < * Connection #0 to host stufficons.wgcdn.co left intact Installing breakpad exception handler for appid(steam)/version(1654574690) ThreadGetProcessExitCode: no such process 50246 ThreadGetProcessExitCode: no such process 50231 ``` ### Actual behavior WOT Blitz fails to login to Wargaming Servers with terminal messages like: ``` *** MESA_GLSL_CACHE_DIR is deprecated; use MESA_SHADER_CACHE_DIR instead *** *** MESA_GLSL_CACHE_MAX_SIZE is deprecated; use MESA_SHADER_CACHE_MAX_SIZE instead *** ThreadGetProcessExitCode: no such process 1678 ThreadGetProcessExitCode: no such process 1662 ThreadGetProcessExitCode: no such process 1656 ThreadGetProcessExitCode: no such process 1650 ThreadGetProcessExitCode: no such process 1628 ThreadGetProcessExitCode: no such process 1625 ThreadGetProcessExitCode: no such process 1619 ThreadGetProcessExitCode: no such process 1617 pid 1621 != 1620, skipping destruction (fork without exec?) Game process removed: AppID 444200 "/home/rsruser/.local/share/Steam/ubuntu12_32/reaper SteamLaunch AppId=444200 -- '/home/rsruser/.local/share/Steam/steamapps/common/SteamLinuxRuntime_soldier'/_v2-entry-point --verb=waitforexitandrun -- '/home/rsruser/.local/share/Steam/compatibilitytools.d/GE-Proton7-18'/proton waitforexitandrun '/home/rsruser/.local/share/Steam/steamapps/common/World of Tanks Blitz/wotblitz.exe'", ProcID 1695 ThreadGetProcessExitCode: no such process 1695 ThreadGetProcessExitCode: no such process 1637 ThreadGetProcessExitCode: no such process 1480 ``` ### Temporary Work Around for Steam Proton v7 and Glorious Eggroll GE-Proton7-18 1. Create 'steam.local' file in ~/.config/firejail. 3. Add the line "ignore seccomp " ### Environment ``` ❯ inxi -b System: Host: mani Kernel: 5.18.1-zen1-1-zen arch: x86_64 bits: 64 Desktop: GNOME v: 42.2 Distro: EndeavourOS CPU: Info: dual core Intel Core i5-5300U [MT MCP] speed (MHz): avg: 1323 min/max: 500/2900 Graphics: Device-1: Intel HD Graphics 5500 driver: i915 v: kernel Device-2: Chicony Integrated Camera type: USB driver: uvcvideo Display: wayland server: X.org v: 1.21.1.3 with: Xwayland v: 22.1.2 compositor: gnome-shell driver: X: loaded: intel unloaded: fbdev,modesetting,vesa gpu: i915 resolution: 1920x1200~60Hz OpenGL: renderer: Mesa Intel HD Graphics 5500 (BDW GT2) v: 4.6 Mesa 22.1.1 ``` ### Checklist <!-- Note: Items are checked with an "x", like so: - [x] This is a checked item. --> - [ ] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [ x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages)
Author
Owner

@rusty-snake commented on GitHub (Jun 9, 2022):

ignore seccomp

This isn't the way you fix seccomp errors.

4231f1a063/etc/templates/syscalls.txt (L89-L112)

<!-- gh-comment-id:1151379458 --> @rusty-snake commented on GitHub (Jun 9, 2022): > `ignore seccomp` This isn't the way you fix seccomp errors. https://github.com/netblue30/firejail/blob/4231f1a063b1d608044001539ae6e32b66f5f8d7/etc/templates/syscalls.txt#L89-L112
Author
Owner

@rsramkis commented on GitHub (Jun 9, 2022):

These are the logs I captured from terminal while launching Steam and the game:
wot-GE-7-18-game-corrupt.txt
wot-GE-7-18-game-no-firejail.txt

<!-- gh-comment-id:1151381923 --> @rsramkis commented on GitHub (Jun 9, 2022): These are the logs I captured from terminal while launching Steam and the game: [wot-GE-7-18-game-corrupt.txt](https://github.com/netblue30/firejail/files/8872477/wot-GE-7-18-game-corrupt.txt) [wot-GE-7-18-game-no-firejail.txt](https://github.com/netblue30/firejail/files/8872478/wot-GE-7-18-game-no-firejail.txt)
Author
Owner

@rsramkis commented on GitHub (Jun 10, 2022):

I tried following the recommended procedure but the game still failed to sign in. Are the below steps correct?

(1) Filter the journal for seccomp messages

journalctl --grep=SECCOMP --follow

Jun 09 20:04:52 mani audit[5713]: SECCOMP auid=1000 uid=1000 gid=1000 ses=4 subj==unconfined pid=5713 comm="wotblitz.exe" exe="/home/rsruser/.local/share/Steam/compatibilitytools.d/GE-Proton7-18/files/bin/wine-preloader" sig=0 arch=40000003 syscall=347 compat=1 ip=0xf7f47549 code=0x7ffc0000

(2) Launch Steam with Firejail

❯ firejail --seccomp-error-action=log /usr/local/bin/steam

(3) Use Firejail debug with the syscall=347

Command: firejail --debug-syscalls | grep NUMBER

For 64 bit process:
❯ firejail --debug-syscalls | grep 347

(no results returned).

For 32 bit process:
❯ firejail --debug-syscalls32 | grep 347
347 - process_vm_readv

(4) Now you can add a seccomp exception to "~/.config/firejail/steam.local" using format seccomp !NAME.

seccomp !process_vm_readv

<!-- gh-comment-id:1151762184 --> @rsramkis commented on GitHub (Jun 10, 2022): I tried following the recommended procedure but the game still failed to sign in. Are the below steps correct? (1) Filter the journal for seccomp messages journalctl --grep=SECCOMP --follow ``` Jun 09 20:04:52 mani audit[5713]: SECCOMP auid=1000 uid=1000 gid=1000 ses=4 subj==unconfined pid=5713 comm="wotblitz.exe" exe="/home/rsruser/.local/share/Steam/compatibilitytools.d/GE-Proton7-18/files/bin/wine-preloader" sig=0 arch=40000003 syscall=347 compat=1 ip=0xf7f47549 code=0x7ffc0000 ``` (2) Launch Steam with Firejail ``` ❯ firejail --seccomp-error-action=log /usr/local/bin/steam ``` (3) Use Firejail debug with the syscall=347 Command: `firejail --debug-syscalls | grep NUMBER` For 64 bit process: ❯ firejail --debug-syscalls | grep 347 (no results returned). For 32 bit process: ❯ firejail --debug-syscalls32 | grep 347 347 - process_vm_readv (4) Now you can add a seccomp exception to "~/.config/firejail/steam.local" using format `seccomp !NAME`. seccomp !process_vm_readv
Author
Owner

@rusty-snake commented on GitHub (Jun 10, 2022):

  1. Are there any other (new) seccomp violations logged?
  2. What does --debug say about the exception list? Are !chroot,!mount,!name_to_handle_at,!pivot_root,!ptrace,!umount2 still allowed?
  3. What happens if you add seccomp.32 !process_vm_readv? (40000003 is i386)
<!-- gh-comment-id:1152118868 --> @rusty-snake commented on GitHub (Jun 10, 2022): 1. Are there any other (new) seccomp violations logged? 2. What does `--debug` say about the exception list? Are `!chroot,!mount,!name_to_handle_at,!pivot_root,!ptrace,!umount2` still allowed? 3. What happens if you add `seccomp.32 !process_vm_readv`? (40000003 is i386)
Author
Owner

@X6B commented on GitHub (Jun 10, 2022):

Just want to add that:

!process_vm_readv and seccomp.32 !process_vm_readv

are needed to launch GTA IV, GTA V and Mafia 2 Definitive Edition.

<!-- gh-comment-id:1152310064 --> @X6B commented on GitHub (Jun 10, 2022): Just want to add that: `!process_vm_readv` and `seccomp.32 !process_vm_readv` are needed to launch GTA IV, GTA V and Mafia 2 Definitive Edition.
Author
Owner

@rusty-snake commented on GitHub (Jun 10, 2022):

Maybe we should a a comment in steam.profile or make it default.

<!-- gh-comment-id:1152331310 --> @rusty-snake commented on GitHub (Jun 10, 2022): Maybe we should a a comment in steam.profile or make it default.
Author
Owner

@rsramkis commented on GitHub (Jun 10, 2022):

I just changed my steam.local file to:

#Used for WOT Blits with Proton > 7.2
# seccomp !process_vm_readv
seccomp.32 !process_vm_readv

So now World of Tanks Blitz is able to complete he login in with Wargaming.net.

What's interesting is GE-Proton7-2 and older Steam Proton versions did not need this exception.

My vote here would be to add the settings to the default steam.profile file. If you check out proton db you will notice some people reporting the problem with newer Proton versions without a fix.

https://www.protondb.com/app/444200

<!-- gh-comment-id:1152350336 --> @rsramkis commented on GitHub (Jun 10, 2022): I just changed my steam.local file to: ``` #Used for WOT Blits with Proton > 7.2 # seccomp !process_vm_readv seccomp.32 !process_vm_readv ``` So now World of Tanks Blitz is able to complete he login in with Wargaming.net. What's interesting is GE-Proton7-2 and older Steam Proton versions did not need this exception. My vote here would be to add the settings to the default steam.profile file. If you check out proton db you will notice some people reporting the problem with newer Proton versions without a fix. https://www.protondb.com/app/444200
Author
Owner

@nutta-git commented on GitHub (Oct 24, 2023):

EA origins (game launcher) won't launch for me if I don't add !process_vm_readv to regular seccomp in steam's profile

<!-- gh-comment-id:1776516159 --> @nutta-git commented on GitHub (Oct 24, 2023): EA origins (game launcher) won't launch for me if I don't add `!process_vm_readv` to regular seccomp in steam's profile
Author
Owner

@ghost commented on GitHub (Oct 24, 2023):

EA origins (game launcher) won't launch for me if I don't add !process_vm_readv to regular seccomp in steam's profile

@nutta-git Can you open a PR for this please?

<!-- gh-comment-id:1777997682 --> @ghost commented on GitHub (Oct 24, 2023): > EA origins (game launcher) won't launch for me if I don't add !process_vm_readv to regular seccomp in steam's profile @nutta-git Can you open a PR for this please?
Author
Owner

@kmk3 commented on GitHub (Oct 24, 2023):

@glitsj16 The original issue as stated was confirmed to be fixed in #5323 and
the fix is already included in 0.9.72. The relevant program is presumably
still working as expected. Please avoid reopening the issue in such cases, as
it's kind of confusing and it makes triaging harder (for example, when sorting
by close date).

<!-- gh-comment-id:1778169378 --> @kmk3 commented on GitHub (Oct 24, 2023): @glitsj16 The original issue as stated was confirmed to be fixed in #5323 and the fix is already included in 0.9.72. The relevant program is presumably still working as expected. Please avoid reopening the issue in such cases, as it's kind of confusing and it makes triaging harder (for example, when sorting by close date).
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2907
No description provided.