mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #631] Firefox hardware acceleration? #436
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#436
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @haasn on GitHub (Jul 13, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/631
This is mostly a question.
Is it by design that firejail completely disables firefox hardware acceleration? In
about:supportI just get this:I slowly and painstakingly bisected the firefox profile and found out that to get hardware acceleration to work I had to disable all four of these, as each one in isolation was enough to trigger the breakage:
firefox.profile
I'm aware that exposing firefox to a proprietary graphics adapter (nvidia blob) is basically the equivalent of giving anybody on the internet root access to your system, so I'm guessing this is by design?
Even if it's intentional, it might be worth adding a comment or something at least, so users who don't want to suffer through a slow, stuttery and laggy firefox know what to disable and what risk they put themselves to in doing so. Personally, I've gotten used to firefox being very slow so it's not a huge deal.
@netblue30 commented on GitHub (Jul 13, 2016):
No, this is not true. On my setup (AMD A10 with a Radeon chipset integrated) it is detected fine:
nonewprivs gives us a clue: probably your graphics stack uses a SUID binary to bring up the driver. All 4 profile commands you listed are killing SUID executables. What card do you have?
@haasn commented on GitHub (Jul 13, 2016):
It's an NVIDIA GTX 970 with the proprietary drivers (version 367.27). The packages contents are as follows:
Of the libraries in
/usr/lib64/that I checked, none were setuid, so I'm not sure what exact path firefox is trying to traverse here. That said, I'm using a PaX kernel and programs that wish to use the nvidia drivers do requireMPROTECTto be disabled, since the OpenGL drivers require an executable stack for reasons unknown to me.@netblue30 commented on GitHub (Jul 14, 2016):
Let's check what programs are started by firefox:
Close all firefox windows, open a new terminal, and as user root run:
After this, start firefox.
@haasn commented on GitHub (Jul 14, 2016):
I don't get any output from that. I don't seem to get any output from
firemonat all, except when starting it with a jail already running (I get its process printed to stdout and then nothing).Even if I start a program inside firejail and then manually execute other binaries (e.g.
/exec -n lsin weechat), I get no output fromfiremon. Is that normal?I did have to build and load the
connectormodule for it to run at all, maybe I'm missing some other kernel configuration.Edit: I had a look at
strace firemonand all it seems to be doing is this in an infinite loop:Note: Another thing I could do is strace the exec calls of firefox itself, or turn on exec logging in grsec, or use auditd or something. But I'm probably not going to attempt the latter two soon.
@haasn commented on GitHub (Jul 14, 2016):
I checked
strace -e trace=process /usr/bin/firefoxand it performs noexecve()calls whatsoever.@netblue30 commented on GitHub (Jul 14, 2016):
grep exec should report at least firefox starting in the sandbox, something like this:
Start firefox as "firejail firefox"
The environment in the jail is different, they might be starting some other programs.