github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1040] Application (web browser) freeze when streaming Silverlight video from within an OverlayFS #706

New issue

Closed

opened 2026-05-05 06:29:10 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 06:29:10 -06:00

Owner

Originally created by @xelxebar on GitHub (Jan 11, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1040

Synopsis

Streaming a Silverlight video via Pipelight from within an OverlayFS causes the video and browser to freeze after at most a few minutes.

I encountered this issue while attempting to create separate Pipelight-enabled and Pipelight-disabled browser instances.

Minimal Reproduction

As a minimal demonstration, we try to keep the configurations of firejail, Pipelight and the browser as vanilla as possible. Assuming the relevant software is installed for your distro, we first enable Pipelight and Silverlight on the base filesystem:

$ sudo pipelight-plugin --create-mozilla-plugins
$ pipelight-plugin --enable silverlight5.1

This demo will be using firefox for the browser, but I have also confirmed it with the uzbl browser which runs WebKit. We want to show that OverlayFS is the culprit here, so note that we disable all other potential firejail options with the --noprofile flag. It's also probably a good idea to use the --safe-mode flag with firefox to exclude plugins and customizations:

$ firejail --noprofile --overlay firefox --safe-mode 'https://www.iss.net/media/experiencesmoothstreaming'

That should open firefox to a web page with a Silverlight video at the bottom. Press play and the browser should freeze after a few seconds or minutes of play.

Blaming OverlayFS

To really nail down the blame on OverlayFS, we can then show that the above runs fine if we remove just the --overlay flag:

$ firejail --noprofile firefox --safe-mode 'https://www.iss.net/media/experiencesmoothstreaming'

Extra Details

For good measure, I also did a few tests in both firefox and uzbl to get a sense of how long video would play before conking out:

Firefox (Gecko)

1:31
0:22
2:04

Uzbl (WebKit)

0:11
0:14
0:22

Version Information

Here's the version information on my machine for the applications that the issue demo above used:

$ firejail --version
firejail version 0.9.44.4

Compile time support:
	- AppArmor support is disabled
	- AppImage support is enabled
	- bind support is enabled
	- chroot support is enabled
	- file and directory whitelisting support is enabled
	- file transfer support is enabled
	- networking support is enabled
	- overlayfs support is enabled
	- private-home support is enabled
	- seccomp-bpf support is enabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

$ pipelight-plugin --version
Pipelight 0.2.8.2

$ pipelight-plugin --list-enabled-all
silverlight5.1

$ firefox --version
Mozilla Firefox 50.1.0

$ uzbl-browser --version
Commit: v0.9.1

$ uname -a
Linux celeste 4.8.13-1-ARCH #1 SMP PREEMPT Fri Dec 9 07:24:34 CET 2016 x86_64 GNU/Linux

Final Thoughts

While exploring things a bit, I also ran the above demonstration with the --debug flag on firejail, but to my eye nothing incriminating jumped out. Also, for good measure, I checked out the kernel logs, but it seemed clean anything firejail-related. However, it would be helpful to post those here, please let me know!

I'm at the limit of my debugging abilities at the moment, so even though this might just be a local issue, I'd appreciate any pointers.

Thank you!

Originally created by @xelxebar on GitHub (Jan 11, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1040 ## Synopsis Streaming a Silverlight video via Pipelight from within an OverlayFS causes the video and browser to freeze after at most a few minutes. I encountered this issue while attempting to create separate Pipelight-enabled and Pipelight-disabled browser instances. ## Minimal Reproduction As a minimal demonstration, we try to keep the configurations of firejail, Pipelight and the browser as vanilla as possible. Assuming the relevant software is installed for your distro, we first enable Pipelight and Silverlight on the base filesystem: $ sudo pipelight-plugin --create-mozilla-plugins $ pipelight-plugin --enable silverlight5.1 This demo will be using firefox for the browser, but I have also confirmed it with the [uzbl][1] browser which runs WebKit. We want to show that OverlayFS is the culprit here, so note that we disable all other potential firejail options with the `--noprofile` flag. It's also probably a good idea to use the `--safe-mode` flag with firefox to exclude plugins and customizations: $ firejail --noprofile --overlay firefox --safe-mode 'https://www.iss.net/media/experiencesmoothstreaming' That should open firefox to a web page with a Silverlight video at the bottom. Press play and the browser should freeze after a few seconds or minutes of play. ## Blaming OverlayFS To really nail down the blame on OverlayFS, we can then show that the above runs fine if we remove just the `--overlay` flag: $ firejail --noprofile firefox --safe-mode 'https://www.iss.net/media/experiencesmoothstreaming' ## Extra Details For good measure, I also did a few tests in both firefox and uzbl to get a sense of how long video would play before conking out: - Firefox (Gecko) > 1:31 > 0:22 > 2:04 - Uzbl (WebKit) > 0:11 > 0:14 > 0:22 ## Version Information Here's the version information on my machine for the applications that the issue demo above used: $ firejail --version firejail version 0.9.44.4 Compile time support: - AppArmor support is disabled - AppImage support is enabled - bind support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled $ pipelight-plugin --version Pipelight 0.2.8.2 $ pipelight-plugin --list-enabled-all silverlight5.1 $ firefox --version Mozilla Firefox 50.1.0 $ uzbl-browser --version Commit: v0.9.1 $ uname -a Linux celeste 4.8.13-1-ARCH #1 SMP PREEMPT Fri Dec 9 07:24:34 CET 2016 x86_64 GNU/Linux ## Final Thoughts While exploring things a bit, I also ran the above demonstration with the `--debug` flag on firejail, but to my eye nothing incriminating jumped out. Also, for good measure, I checked out the kernel logs, but it seemed clean anything firejail-related. However, it would be helpful to post those here, please let me know! I'm at the limit of my debugging abilities at the moment, so even though this might just be a local issue, I'd appreciate any pointers. Thank you! [1]:https://www.uzbl.org

gitea-mirror

2026-05-05 06:29:10 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 06:29:18 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 12, 2017):

I'll mark it as a bug for now so I don't forget it. OverlayFS is going through some changes at the moment.

@netblue30 commented on GitHub (Jan 12, 2017): I'll mark it as a bug for now so I don't forget it. OverlayFS is going through some changes at the moment.

gitea-mirror commented

2026-05-05 06:29:21 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 14, 2017):

I put some fixes on mainline for overlayfs - /sys directory wasn't mounted properly - hopefully it fixes the problem.

@netblue30 commented on GitHub (Apr 14, 2017): I put some fixes on mainline for overlayfs - /sys directory wasn't mounted properly - hopefully it fixes the problem.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#706

No description provided.

Rows
Columns