mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #841] nvidia driver and noroot setting #573
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#573
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @reinerh on GitHub (Oct 6, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/841
A Debian user reported that Steam was segfaulting when run with firejail after upgrading the nvidia driver to 367.44-2.
(Also glxgears behaves wrong with the steam profile)
The problematic line in the steam profile is the "noroot" setting, though I don't know why exactly this is causing issues.
The complete bug report is here.
@netblue30 commented on GitHub (Oct 8, 2016):
I have a fix in
40ed53c20bI don't have a Nvidia card, but I think it will fix the issue. I added video and games to the groups allowed in the user namespace. I close the bug for now and reopen it if necessary. Thanks.
@kevinoid commented on GitHub (Mar 11, 2017):
I'm seeing this same issue with Firejail 0.9.44.8-1 on Debian with an nVidia NVS 5400M. It looks like
40ed53ceither did not fix the issue or it has reappeared.I compiled from the current master (
22414ad) and captured thestraceoutput forglxgearswith and without--norootand posted it as a gist: https://gist.github.com/kevinoid/cb1c4ed6c8f073d41b1c4e1039e04e99#file-glxgears-strace-diffNotably, when running with
--norootit tries and fails tochmod/dev/nvidia-modeset,/dev/nvidia-modeset, and/dev/nvidia0then forks a child which fails tochmodthe device, then opens it (which succeeds, since the devices are stillroot:root0666whichstatshowed beforechmod). It also does not try to write anything to~/.nv/GLCache(although the train may have left the tracks before this point). It doesn't make much sense to me. Any ideas?Thanks,
Kevin
@chiraag-nataraj commented on GitHub (Aug 19, 2018):
I have an Nvidia card and have used
norootwith withnvidiadriver for a while now with no issues. Is anyone still seeing this issue?@kevinoid commented on GitHub (Aug 19, 2018):
I can confirm that this is still an issue for me on Debian with firejail 0.9.54-1, nvidia 390.77-1, and Linux 4.18.0 (from kernel.org, without Debian patches).
firejail --noprofile glxgearsworks fine, butfirejail --noprofile --noroot glxgearsshows a black window without the spinning gears. I updated the gist at https://gist.github.com/kevinoid/cb1c4ed6c8f073d41b1c4e1039e04e99#file-glxgears-strace-diff with thestracedifferences between the two.@chiraag-nataraj commented on GitHub (Aug 19, 2018):
That's very interesting. I'm on Debian sid/experimental, with firejail 0.9.55 (from git), nvidia 396.51-1, and Linux 4.17.8 (custom-built from linux-source-4.17). Both
firejail --noprofile glxgearsandfirejail --noprofile --noroot glxgearsgive me the normal window (spinning gears).@chiraag-nataraj commented on GitHub (Aug 23, 2018):
@kevinoid I'm curious to see if you run into the issue with a Debian stock kernel. Can you test and report back?
@kevinoid commented on GitHub (Aug 23, 2018):
@chiraag-nataraj Sure. I can confirm that the same behavior occurs when running kernel 4.17.0-1-amd64 from the linux-image-4.17.0-1-amd64 package (version 4.17.8-1) with nVidia modules built using nvidia-kernel-dkms (version 390.77-1).
@chiraag-nataraj commented on GitHub (Aug 23, 2018):
Damn, that's weird. So I have a newer version of
nvidia-driver, but I've never had this issue, so I suspect that the driver version doesn't really matter too much.@SkewedZeppelin commented on GitHub (Aug 23, 2018):
Multiple monitors? Different outputs?
it has always been arbitrary when the driver calls its suid binary iirc
@kevinoid commented on GitHub (Aug 23, 2018):
I agree. I don't think it is version-specific. I'm currently using the laptop screen. I can test the VGA output soon.
If you run
firejail --noprofile --noroot strace -f -o glxgears.strace glxgearsdo you see anychmod("/dev/nvidiactl", 0666)calls inglxgears.strace? I'm curious whether it is making those calls and whether the call succeeds.Also, for reference, my system has nVidia Optimus, so it has both an Intel graphics card and an nVidia card. The problem does not occur when using Mesa on the Intel card.
@kevinoid commented on GitHub (Aug 23, 2018):
I can confirm the same behavior occurs when using the VGA output with LVDS (the laptop screen) disabled.
@chiraag-nataraj commented on GitHub (Aug 23, 2018):
I doubt the output itself would matter, since the same driver would be driving whichever screen(s) you're using.
I actually do see those calls and they do fail with
EPERM (Operation not permitted)andglxgearsworks just fine regardless.Yup, I have Optimus as well.
@chiraag-nataraj commented on GitHub (May 20, 2019):
Is this still an issue?
@kevinoid commented on GitHub (May 20, 2019):
Thanks for checking in. I can confirm that this is still an issue for me on Debian with firejail built from the current master branch (
feae44c4), nvidia 390.116-1, and Linux 5.1.2 (from kernel.org, without Debian patches).firejail --noprofile glxgearsworks fine, butfirejail --noprofile --noroot glxgearsshows a black window without the spinning gears.@chiraag-nataraj commented on GitHub (May 20, 2019):
Hmm, I see. Is this an issue if you use the Debian-supplied kernel instead of the custom build?
@kevinoid commented on GitHub (May 20, 2019):
Yep. I can confirm that the same symptoms occur with firejail built from
feae44c, nvidia 390.116-1, and Linux 4.19.0-5-amd64 (from the linux-image-4.19.0-5-amd64 Debian package version 4.19.37-3).@chiraag-nataraj commented on GitHub (May 20, 2019):
I'm wondering if it just has to do with something they changed on their end, since I'm on 418.74...
@chiraag-nataraj commented on GitHub (May 20, 2019):
But looking back, that doesn't seem to matter...I'm stumped.
@chiraag-nataraj commented on GitHub (May 20, 2019):
If you do
firejail --noroot --noprofile glxinfo, what is the output?@kevinoid commented on GitHub (May 20, 2019):
I added the output of
firejail --noroot --noprofile glxinfoto the gist with the strace outputs: https://gist.github.com/kevinoid/cb1c4ed6c8f073d41b1c4e1039e04e99#file-glxinfo-noroot-txt@chiraag-nataraj commented on GitHub (May 20, 2019):
Hold on. Your
glxinfooutput is showing thatglxinfohas no problem accessing your Nvidia card. Something's really screwy here, since you're reporting thatglxgearshas the problem, but your output shows thatglxinfodoes not.@kevinoid commented on GitHub (May 20, 2019):
That is correct. On my system
glxinfoappears to work fine with--noroot.glxgearsdoes not work with--noroot.@chiraag-nataraj commented on GitHub (May 21, 2019):
That's so odd...I would presume they'd both attempt to access the Nvidia driver the same way...
@czka commented on GitHub (Mar 15, 2020):
For the record: similar thing with
nvidiadriver390.132-32on Arch Linux, trying to run Operation Flashpoint (aka Arma: Cold War Assult these days) on Steam1.0.0.61-4in Gnome3.36.0,X11mode.With
norootdisabled in/etc/firejail/steam.profilethe game runs fine. Whennorootis set (as per Firejail's default) game's video freezes as long as its full-screen "window" is focused. However, when I pressalt+tabto switch windows, I can see the game's video unfreezed underneath the list of windows. And so forth - once I switch to game's window, the video gets stuck, and when I pressalt+tabI can see the game actually runnig fine underneath the list of my active windows.@netblue30 Maybe add a hint regarding
norootinsteam.profilefor people trying to run games on Linux+Steam+Nvidia? I took me a long moment to figure this out.@rusty-snake commented on GitHub (Mar 15, 2020):
@czka done.
@czka commented on GitHub (Mar 22, 2020):
@rusty-snake Kewl!
@matu3ba commented on GitHub (Sep 8, 2020):
@rusty-snake Could you close due fixed and no feedback?
@rusty-snake commented on GitHub (Sep 9, 2020):
Maybe we want to keep it open until we have a better fix then adding a note that nvidia-users should add
ignore norootto some profiles. I'm not sure.@netblue30 commented on GitHub (Oct 2, 2020):
Temporary fix in for the next release: I disable nogroups if /dev/nvidiactl is detected in the system. If it is working we go with it in the next release and find a better way to do it later.