[GH-ISSUE #552] freshplayerplugin Flash causing graphics glitching under firejail

gitea-mirror commented

2026-05-05 05:45:11 -06:00

Owner

Originally created by @laniakea64 on GitHub (Jun 1, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/552

Since upgrading firejail from 0.9.38 to a .deb self-build of a81568d4f0 , running SeaMonkey in firejail with --overlay-tmpfs where freshplayerplugin Flash is now causing bad graphics glitches (mostly on scrollbars, but can be anything in SeaMonkey). This is the possibly-relevant output in the Terminal:

libGL error: MESA-LOADER: could not create udev device for fd 20

[fresh] [error] [NP] caught Xlib error 178
[fresh] [error] [NP] caught Xlib error 178
[fresh] [warning] ppb_graphics3d_create, glXCreateContextAttribsARB returned NULL
[ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?)
[ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?)
[ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?)
[ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?)
[ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?)

I don't think all Flash objects are affected, one example URL where this issue occurs is http://www.yoarcade.net/ability/cubefield_content.html where also the entire screen is frozen for around 15 seconds upon allowing the game Flash object in NoScript.

Nothing except firejail has changed between when it worked and when this issue started.

Lubuntu 14.04, PPAPI Flash 21.0.0.182, unknown freshplayerplugin version (but judging by date modified I think it's 7ba5f2de0e), system theme is oxygen-gtk
Also I use a custom firejail profile for SeaMonkey which I can provide if needed.

Originally created by @laniakea64 on GitHub (Jun 1, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/552 Since upgrading firejail from 0.9.38 to a .deb self-build of https://github.com/netblue30/firejail/commit/a81568d4f03a12817ab2b0ad6d52159eb5a9eb10 , running SeaMonkey in firejail with `--overlay-tmpfs` where freshplayerplugin Flash is now causing bad graphics glitches (mostly on scrollbars, but can be anything in SeaMonkey). This is the possibly-relevant output in the Terminal: ``` libGL error: MESA-LOADER: could not create udev device for fd 20 ``` ``` [fresh] [error] [NP] caught Xlib error 178 [fresh] [error] [NP] caught Xlib error 178 [fresh] [warning] ppb_graphics3d_create, glXCreateContextAttribsARB returned NULL [ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?) [ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?) [ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?) [ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?) [ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?) ``` I don't _think_ all Flash objects are affected, one example URL where this issue occurs is http://www.yoarcade.net/ability/cubefield_content.html where also the **entire screen** is frozen for around 15 seconds upon allowing the game Flash object in NoScript. Nothing except firejail has changed between when it worked and when this issue started. --- Lubuntu 14.04, PPAPI Flash 21.0.0.182, unknown freshplayerplugin version (but judging by date modified I think it's https://github.com/i-rinat/freshplayerplugin/commit/7ba5f2de0e7a8b6f6bbb1e66abab86300dcc4db9), system theme is oxygen-gtk Also I use a custom firejail profile for SeaMonkey which I can provide if needed.

gitea-mirror

2026-05-05 05:45:11 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:45:15 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 1, 2016):

Does it work if you install version 0.9.40 from https://sourceforge.net/projects/firejail/files/firejail/ ?
Also, does it work if you run the sandbox without a profile "firejail --noprofile seamonkey"

@netblue30 commented on GitHub (Jun 1, 2016): Does it work if you install version 0.9.40 from https://sourceforge.net/projects/firejail/files/firejail/ ? Also, does it work if you run the sandbox without a profile "firejail --noprofile seamonkey"

gitea-mirror commented

2026-05-05 05:45:17 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jun 1, 2016):

Thanks for the fast reply.

Issue does occur with official release 0.9.40.
Issue still occurs using --noprofile.

I have additionally noticed since the initial report, that another symptom is that fonts in every window title looked "smudged" - worst-rendered character I saw was "I" (capital i). Had to reboot the computer to set that straight.
Plus I can't reproduce this issue in a VM 😢

(Would using firejail's X11 [Xephyr] sandbox feature help work around this at all, to at least confine the graphics weirdness/freezing to stuff inside the sandbox?)

@laniakea64 commented on GitHub (Jun 1, 2016): Thanks for the fast reply. Issue **does** occur with official release 0.9.40. Issue still occurs using `--noprofile`. I have additionally noticed since the initial report, that another symptom is that fonts in _every_ window title looked "smudged" - worst-rendered character I saw was "I" (capital i). Had to reboot the computer to set that straight. Plus I can't reproduce this issue in a VM :cry: (Would using firejail's X11 [Xephyr] sandbox feature help work around this at all, to at least confine the graphics weirdness/freezing to stuff inside the sandbox?)

gitea-mirror commented

2026-05-05 05:45:19 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 2, 2016):

If it doesn't run with "--noprofile", there is nothing we can do. Some programs are breaking when you run them inside user namespaces, a common example is PulseAudio.

My problem with your setup is nobody tested SeaMonkey with freshplayerplugin, at least not freshplayerplugin developers. I would stay with more mainstream software. For example I use Firefox with the regular flash plugin from Adobe. Mozilla and Adobe developers are testing it, they even give you notifications to update the plugin when security problems are fixed.

@netblue30 commented on GitHub (Jun 2, 2016): If it doesn't run with "--noprofile", there is nothing we can do. Some programs are breaking when you run them inside user namespaces, a common example is PulseAudio. My problem with your setup is nobody tested SeaMonkey with freshplayerplugin, at least not freshplayerplugin developers. I would stay with more mainstream software. For example I use Firefox with the regular flash plugin from Adobe. Mozilla and Adobe developers are testing it, they even give you notifications to update the plugin when security problems are fixed.

gitea-mirror commented

2026-05-05 05:45:22 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jun 2, 2016):

If it doesn't run with "--noprofile", there is nothing we can do.

But this works flawlessly under firejail 0.9.38, even now if I downgrade firejail back to 0.9.38 it's working well as before. Are you saying that it's only working due to bug(s) in firejail 0.9.38 that has been fixed for 0.9.40?

Maybe I wasn't clear on something. The Flash object itself seems to work fine once it starts. All of the graphics "glitches" are outside the Flash object, and seem to happen when it starts loading.

I would stay with more mainstream software.

Unfortunately that is not possible for me.
There are significant accessibility issues and privacy concerns with Firefox itself that make it not an option. SeaMonkey has exactly the same backend as Firefox, things like plugin handling are part of the shared backend and thus work the same.

I would personally prefer to use the standard Adobe Flash plugin from apt-get but it's "too old" for many Flash content, and the only way to get Flash player > 11.2 on Linux is PPAPI / through freshplayerplugin.

@laniakea64 commented on GitHub (Jun 2, 2016): > If it doesn't run with "--noprofile", there is nothing we can do. But this works flawlessly under firejail 0.9.38, even now if I downgrade firejail back to 0.9.38 it's working well as before. Are you saying that it's only working due to bug(s) in firejail 0.9.38 that has been fixed for 0.9.40? Maybe I wasn't clear on something. The Flash object itself seems to work fine once it starts. All of the graphics "glitches" are outside the Flash object, and seem to happen when it starts loading. > I would stay with more mainstream software. Unfortunately that is not possible for me. There are significant accessibility issues and privacy concerns with Firefox itself that make it not an option. SeaMonkey has exactly the same backend as Firefox, things like plugin handling are part of the shared backend and thus work the same. I would personally prefer to use the standard Adobe Flash plugin from apt-get but it's "too old" for many Flash content, and the only way to get Flash player > 11.2 on Linux is PPAPI / through freshplayerplugin.

gitea-mirror commented

2026-05-05 05:45:24 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 2, 2016):

It is very simple, look at the error you are getting:

[ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?)

Your flash plugin tries to compile a file and crashes your GPU. I assume the hardware acceleration is off from that moment on, and you are seeing graphics glitches on your screen. Definitely not a firejail problem.

@netblue30 commented on GitHub (Jun 2, 2016): It is very simple, look at the error you are getting: ``` [ERROR:flash/platform/pepper/pep_shader_factory.cpp(410)] Compilation failed - no log (GPU crash?) ``` Your flash plugin tries to compile a file and crashes your GPU. I assume the hardware acceleration is off from that moment on, and you are seeing graphics glitches on your screen. Definitely not a firejail problem.

gitea-mirror commented

2026-05-05 05:45:27 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jun 3, 2016):

Thanks, looks like that is basically what's going on - if I run firejail with --debug, this shows up in the syslog:

kernel: [xxxxxxxxxxxx] [drm] stuck on render ring
kernel: [xxxxxxxxxxxx] [drm] GPU crash dump saved to /sys/class/drm/card0/error
kernel: [xxxxxxxxxxxx] [drm] GPU hangs can indicate a bug anywhere in the entire gfx stack, including userspace.
kernel: [xxxxxxxxxxxx] [drm] Please file a _new_ bug report on bugs.freedesktop.org against DRI -> DRM/Intel
kernel: [xxxxxxxxxxxx] [drm] drm/i915 developers can then reassign to the right component if it's not a kernel issue.
kernel: [xxxxxxxxxxxx] [drm] The gpu crash dump is required to analyze gpu hangs, so please always attach it.
kernel: [xxxxxxxxxxxx] [drm:i915_set_reset_status] *ERROR* render ring hung inside bo (0x88e3000 ctx 0) at 0x88e3004

Since this is not a firejail bug, and I'd like to upgrade firejail, can you please re-open this as tagged "information"?

Still confused that it works fine in 0.9.38... Did some more playing around with my self-built firejail 0.9.41, and I'm wondering if it's that initial MESA-LOADER message that's the key here? Running glxinfo inside the SeaMonkey sandbox shows a similar error:

libGL error: MESA-LOADER: could not create udev device for fd 4

This is not shown running glxinfo outside firejail, nor firejail --noprofile glxinfo, BUT it is shown running firejail --noprofile --overlay-tmpfs glxinfo.
With firejail 0.9.38, firejail --noprofile --overlay-tmpfs glxinfo does not show that error.

So, this issue is related to the use of --overlay-tmpfs, and this not being a firejail bug, the answer here is surely to edit the profiles to allow something back into the sandbox. What options to start looking at?

Thank you again @netblue30 for your time and help.

@laniakea64 commented on GitHub (Jun 3, 2016): Thanks, looks like that is basically what's going on - if I run firejail with `--debug`, this shows up in the syslog: ``` kernel: [xxxxxxxxxxxx] [drm] stuck on render ring kernel: [xxxxxxxxxxxx] [drm] GPU crash dump saved to /sys/class/drm/card0/error kernel: [xxxxxxxxxxxx] [drm] GPU hangs can indicate a bug anywhere in the entire gfx stack, including userspace. kernel: [xxxxxxxxxxxx] [drm] Please file a _new_ bug report on bugs.freedesktop.org against DRI -> DRM/Intel kernel: [xxxxxxxxxxxx] [drm] drm/i915 developers can then reassign to the right component if it's not a kernel issue. kernel: [xxxxxxxxxxxx] [drm] The gpu crash dump is required to analyze gpu hangs, so please always attach it. kernel: [xxxxxxxxxxxx] [drm:i915_set_reset_status] *ERROR* render ring hung inside bo (0x88e3000 ctx 0) at 0x88e3004 ``` Since this is not a firejail bug, and I'd like to upgrade firejail, can you please re-open this as tagged "information"? Still confused that it works fine in 0.9.38... Did some more playing around with my self-built firejail 0.9.41, and I'm wondering if it's that initial MESA-LOADER message that's the key here? Running glxinfo inside the SeaMonkey sandbox shows a similar error: ``` libGL error: MESA-LOADER: could not create udev device for fd 4 ``` This is not shown running glxinfo outside firejail, nor `firejail --noprofile glxinfo`, BUT it is shown running `firejail --noprofile --overlay-tmpfs glxinfo`. With firejail 0.9.38, `firejail --noprofile --overlay-tmpfs glxinfo` does **not** show that error. So, this issue is related to the use of `--overlay-tmpfs`, and this not being a firejail bug, the answer here is surely to edit the profiles to allow something back into the sandbox. What options to start looking at? Thank you again @netblue30 for your time and help.

gitea-mirror commented

2026-05-05 05:45:30 -06:00

Author

Owner

@requiredregistration commented on GitHub (Jun 3, 2016):

seamonkey is not a project of mozilla anymore, and the latest version of it is behind the latest firefox version. you can disable everything in firefox that could be a privacy issue in your case.

google chrome and opera are based on chromium.

@requiredregistration commented on GitHub (Jun 3, 2016): seamonkey is not a project of mozilla anymore, and the latest version of it is behind the latest firefox version. you can disable everything in firefox that could be a privacy issue in your case. google chrome and opera are based on chromium.

gitea-mirror commented

2026-05-05 05:45:32 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 3, 2016):

One solution is to get rid of --overlay-tmpfs. OverlayFS was introduced in kernel 3.18, and the kernel guys are still fixing bugs big time. Also, there have been some bugfixes in firejail for handling overlayfs, this could explain what's going on.

You can also install 0.9.38 in parallel with 0.9.40, and use 0.9.38 for your seamonkey setup. Grab the source code for 0.9.38 from https://sourceforge.net/projects/firejail/files/firejail/ and:

$ sudo mkdir /opt/firejail
$ tar -xjvf firejail-0.9.38.tar.bz2
$ cd firejail-0.9.38
$ ./configure --prefix=/opt/firejail
$ make
$ sudo make install

To start seamonkey use "/opt/firejail/bin/firejail --overlay-tmpfs seamonkey"

@netblue30 commented on GitHub (Jun 3, 2016): One solution is to get rid of --overlay-tmpfs. OverlayFS was introduced in kernel 3.18, and the kernel guys are still fixing bugs big time. Also, there have been some bugfixes in firejail for handling overlayfs, this could explain what's going on. You can also install 0.9.38 in parallel with 0.9.40, and use 0.9.38 for your seamonkey setup. Grab the source code for 0.9.38 from https://sourceforge.net/projects/firejail/files/firejail/ and: ``` $ sudo mkdir /opt/firejail $ tar -xjvf firejail-0.9.38.tar.bz2 $ cd firejail-0.9.38 $ ./configure --prefix=/opt/firejail $ make $ sudo make install ``` To start seamonkey use "/opt/firejail/bin/firejail --overlay-tmpfs seamonkey"

gitea-mirror commented

2026-05-05 05:45:35 -06:00

Author

Owner

@laniakea64 commented on GitHub (Jun 3, 2016):

I could reproduce the glxinfo thing in a disposable VM, so did some more testing. And apparently X11 [Xephyr] sandboxing completely stops the problem! 😮
(Well, according to glxinfo the Xephyr in my main environment is using a different renderer, but not sure that fully explains it as the Xephyr in the VM uses the same renderer as main X11.)

However, cannot copy+paste from inside the Xephyr sandbox to outside the sandbox. So I've "backport" a few fixes on 0.9.38 and modified the .deb build to A) install to /opt/firejail-0.9.38 like suggested by netblue30, B) allow to install concurrently with "standard" firejail. So far it's working well 👍
Problem solved as much as it can be I guess. Thanks again netblue30!

Closing this issue since I'm good to go for now, but I might later try to find the exact git commit where the problem first appears.

@laniakea64 commented on GitHub (Jun 3, 2016): I could reproduce the glxinfo thing in a disposable VM, so did some more testing. And apparently X11 [Xephyr] sandboxing **completely stops the problem**! :open_mouth: (Well, according to glxinfo the Xephyr in my main environment is using a different renderer, but not sure that fully explains it as the Xephyr in the VM uses the same renderer as main X11.) However, cannot copy+paste from inside the Xephyr sandbox to outside the sandbox. So I've "backport" a few fixes on 0.9.38 and modified the .deb build to A) install to /opt/firejail-0.9.38 like suggested by netblue30, B) allow to install concurrently with "standard" firejail. So far it's working well :+1: Problem solved as much as it can be I guess. Thanks again netblue30! Closing this issue since I'm good to go for now, but I might later try to find the exact git commit where the problem first appears.

gitea-mirror commented

2026-05-05 05:45:40 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 4, 2016):

apparently X11 [Xephyr] sandboxing completely stops the problem!

This is because xephyr doesn't have support for hardware acceleration.

cannot copy+paste from inside the Xephyr sandbox to outside the sandbox.

This is because your browser is isolated on a different X11 server. cut&paste works only if both applications are running on the same server.

@netblue30 commented on GitHub (Jun 4, 2016): > apparently X11 [Xephyr] sandboxing completely stops the problem! This is because xephyr doesn't have support for hardware acceleration. > cannot copy+paste from inside the Xephyr sandbox to outside the sandbox. This is because your browser is isolated on a different X11 server. cut&paste works only if both applications are running on the same server.

gitea-mirror commented

2026-05-05 05:45:42 -06:00

Author

Owner

@laniakea64 commented on GitHub (Apr 6, 2017):

I finally had the time to find the commit that affected this, and it looks like c89ebb846a
More specifically, I would suspect the change in how mounting /sys is handled. On my systems, it results in an empty /sys inside the overlay.

@netblue30 Any other insights here based on this finding?

Also, if I were to revert that change locally in a current version of firejail, what would I lose out on?

@laniakea64 commented on GitHub (Apr 6, 2017): I finally had the time to find the commit that affected this, and it looks like https://github.com/netblue30/firejail/commit/c89ebb846a9df5288b482941fe8d205f675be39b More specifically, I would suspect the change in how mounting `/sys` is handled. On my systems, it results in an empty `/sys` inside the overlay. @netblue30 Any other insights here based on this finding? Also, if I were to revert that change locally in a current version of firejail, what would I lose out on?

gitea-mirror commented

2026-05-05 05:45:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 9, 2017):

Indeed, it results in an empty /sys - jsut tested it on debian stable. I'll have to look into it, thanks for the bug.

@netblue30 commented on GitHub (Apr 9, 2017): Indeed, it results in an empty /sys - jsut tested it on debian stable. I'll have to look into it, thanks for the bug.

gitea-mirror commented

2026-05-05 05:45:49 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 13, 2017):

All fixed. You were right, /sys was left unmounted. It was also affecting --chroot setups.

@netblue30 commented on GitHub (Apr 13, 2017): All fixed. You were right, /sys was left unmounted. It was also affecting --chroot setups.

gitea-mirror commented

2026-05-05 05:45:52 -06:00

Author

Owner

@laniakea64 commented on GitHub (Apr 13, 2017):

I confirm that this is all fixed in a self build of e7c7b3171d . Thanks netblue30!

@laniakea64 commented on GitHub (Apr 13, 2017): I confirm that this is all fixed in a self build of https://github.com/netblue30/firejail/commit/e7c7b3171dd2a480592d1bbb3a997cfd0f533864 . Thanks netblue30!

Rows
Columns

[GH-ISSUE #552] freshplayerplugin Flash causing graphics glitching under firejail #388