2

I'll try to be brief and concise. I want to run programs that require ALSA with firejail profiles but it probably doesn't have the permission or ability to access the soundcard for some reason probably relating to overlays and/or groups.

I have firejail 0.9.64.2, alsa-utils 1.2.4_1, pulseaudio 14.0_3, and other alsa/pulse emulation packages installed as well as relevant soundcards that probably came with the system install. I installed the pulse packages just in case (pulse also made itself a member of audio). The current condition is that ALSA works decent without firejail and in certain conditions within firejail too, namely without overlays and nogroups options when fiddling with certain profiles. However, I need overlays and filesystem mount abilities for many profiles to work properly with sound. I have already added my user to the supplementary group 'audio' and verified via /etc/group. I checked ownership of folder '/dev/snd' , the files within, all owned by root:audio except a symbolic link 'path-by' owned by root:root linking back to ../controlC0. I am hesitant to change ownership of that as I think it is not the problem and would cause more headache. I did however test the profiles with programs like mpv with overlay options but I get similar error messages about alsa not finding the soundcard. Overlays or nogroups options can ruin alsa in some profiles I tested. I did a few more informative tests, some with logs using firejail's trace function.

$ firejail id
uid=1000(user1) gid=100(users) groups=100(users),12(audio)

Works! It displays my needed groups for sound. (excluding things like mail or wireshark).

$ firejail --overlay-tmpfs id
uid=1000(user1) gid=100(users) groups=100(users)

No audio group while using an overlay? This is important because many firejail profiles utilize overlays and group restrictions. In my case this renders my programs mute due to this problem. That is my guess.

$ firejail aplay -l && aplay -L Works! It displayed all my cards and pcms! It also made the trace log I specified below. I'm assuming /dev/snd/controlC0:5 return is the reason for the successful device listings.

3:bash:exec /usr/bin/bash:0
3:bash:open /dev/tty:4
3:aplay:exec /usr/bin/aplay:0
3:aplay:open /dev/snd/controlC0:5
3:aplay:fopen /usr/share/alsa/alsa.conf:0x564afaf56540
3:aplay:access /usr/etc/alsa/conf.d:-1
3:aplay:access /etc/alsa/conf.d:-1
3:aplay:access /etc/asound.conf:0
3:aplay:fopen /etc/asound.conf:0x564afaf56540
3:aplay:access /home/user1/.asoundrc:-1
3:aplay:access /home/user1/.config/alsa/asoundrc:-1
3:aplay:open /dev/snd/controlC0:5
3:aplay:open /dev/snd/controlC1:-1
3:aplay:open /dev/aloadC1:-1
3:aplay:open /dev/snd/controlC2:-1
3:aplay:open /dev/aloadC2:-1
3:aplay:open /dev/snd/controlC3:-1
3:aplay:open /dev/aloadC3:-1

$ firejail --overlay-tmpfs aplay -l && aplay -L Fail! It only displayed the pcms, no soundcards. It made the log below.

3:bash:exec /usr/bin/bash:0
3:bash:open /dev/tty:4
3:aplay:exec /usr/bin/aplay:0
3:aplay:open /dev/snd/controlC0:-1
3:aplay:open /dev/aloadC0:-1
3:aplay:open /dev/snd/controlC1:-1
3:aplay:open /dev/aloadC1:-1
3:aplay:open /dev/snd/controlC2:-1
3:aplay:open /dev/aloadC2:-1
3:aplay:open /dev/snd/controlC3:-1
3:aplay:open /dev/aloadC3:-1

$ firejail alsabat-test.sh It made some sounds. Yes, regular video and sounds also work in the window manager. It also makes sounds in a separate TTY terminal with no graphical windows.

3:bash:exec /usr/bin/bash:0
3:bash:open /dev/tty:4
3:alsabat-test.sh:exec /usr/bin/bash:0
3:alsabat-test.sh:open /dev/tty:5
3:alsabat-test.sh:open /bin/alsabat-test.sh:5
4:mkdir:exec /usr/bin/mkdir:0
4:mkdir:mkdir tmp:-1
3:alsabat-test.sh:access /usr/share/terminfo/s/st-256color:0
3:alsabat-test.sh:fopen /usr/share/terminfo/s/st-256color:0x556402ad6510
5:alsabat:exec /usr/bin/alsabat:0
5:alsabat:fopen tmp/0.log:0x55b5c9529540
5:alsabat:fopen /usr/share/alsa/alsa.conf:0x7f54bc001c80
5:alsabat:access /usr/etc/alsa/conf.d:-1
5:alsabat:access /etc/alsa/conf.d:-1
5:alsabat:access /etc/asound.conf:0
5:alsabat:fopen /etc/asound.conf:0x7f54bc001c80
5:alsabat:access /home/user1/.asoundrc:-1
5:alsabat:access /home/user1/.config/alsa/asoundrc:-1
5:alsabat:access /usr/lib/alsa-lib:0
5:alsabat:fopen64 /home/user1/.config/pulse/client.conf:0x7f54bc001c80
5:alsabat:access /home/user1/.pulse:-1
5:alsabat:mkdir /home/user1/.config/pulse:-1
5:alsabat:open64 /home/user1/.config/pulse:11
5:alsabat:fopen64 /etc/machine-id:(nil)
5:alsabat:fopen64 /var/lib/dbus/machine-id:0x7f54bc001c80
5:alsabat:mkdir /tmp/pulse-PKdhtXMmr18n:-1
5:alsabat:mkdir /tmp/pulse-2L9K88eMlGn7:0
5:alsabat:socket AF_LOCAL SOCK_STREAM 0:11
5:alsabat:connect 11 /tmp/pulse-2L9K88eMlGn7/native:-1
5:alsabat:socket AF_LOCAL SOCK_STREAM 0:11
5:alsabat:connect 11 /var/run/pulse/native:-1
5:alsabat:fopen /usr/share/alsa/cards/aliases.conf:0x7f54bc001c80
5:alsabat:fopen /usr/share/alsa/pcm/default.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/dmix.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/dsnoop.conf:0x7f54bc01b3c0
5:alsabat:open /dev/snd/controlC0:7
5:alsabat:open /dev/snd/controlC0:7
5:alsabat:access /usr/share/alsa/cards/HDA-Intel.conf:0
5:alsabat:fopen /usr/share/alsa/cards/HDA-Intel.conf:0x7f54bc001c80
5:alsabat:fopen /usr/share/alsa/pcm/front.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/surround21.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/surround40.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/surround41.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/surround50.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/surround51.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/surround71.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/iec958.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/hdmi.conf:0x7f54bc01b3c0
5:alsabat:fopen /usr/share/alsa/pcm/modem.conf:0x7f54bc01b3c0
5:alsabat:open /dev/snd/controlC1:-1
5:alsabat:open /dev/aloadC1:-1
5:alsabat:open /dev/snd/controlC2:-1
5:alsabat:open /dev/aloadC2:-1
5:alsabat:open /dev/snd/controlC3:-1
5:alsabat:open /dev/aloadC3:-1

$ firejail --overlay-tmpfs alsabat-test.sh

3:bash:exec /usr/bin/bash:0
3:bash:open /dev/tty:4
3:alsabat-test.sh:exec /usr/bin/bash:0
3:alsabat-test.sh:open /dev/tty:5
3:alsabat-test.sh:open /bin/alsabat-test.sh:5
4:mkdir:exec /usr/bin/mkdir:0
4:mkdir:mkdir tmp:-1
3:alsabat-test.sh:access /usr/share/terminfo/s/st-256color:0
3:alsabat-test.sh:fopen /usr/share/terminfo/s/st-256color:0x55a7e137d510
5:alsabat:exec /usr/bin/alsabat:0
5:alsabat:fopen tmp/0.log:0x561c3c323540
5:alsabat:fopen /usr/share/alsa/alsa.conf:0x7f09f0001c80
5:alsabat:access /usr/etc/alsa/conf.d:-1
5:alsabat:access /etc/alsa/conf.d:-1
5:alsabat:access /etc/asound.conf:0
5:alsabat:fopen /etc/asound.conf:0x7f09f0001c80
5:alsabat:access /home/user1/.asoundrc:-1
5:alsabat:access /home/user1/.config/alsa/asoundrc:-1
5:alsabat:access /usr/lib/alsa-lib:0
5:alsabat:fopen64 /home/user1/.config/pulse/client.conf:0x7f09f0001c80
5:alsabat:access /home/user1/.pulse:-1
5:alsabat:mkdir /home/user1/.config/pulse:-1
5:alsabat:open64 /home/user1/.config/pulse:11
5:alsabat:fopen64 /etc/machine-id:(nil)
5:alsabat:fopen64 /var/lib/dbus/machine-id:0x7f09f0001c80
5:alsabat:mkdir /tmp/pulse-PKdhtXMmr18n:-1
5:alsabat:mkdir /tmp/pulse-2L9K88eMlGn7:-1
5:alsabat:mkdir /tmp/pulse-CcctT9RwKSB1:0
5:alsabat:socket AF_LOCAL SOCK_STREAM 0:11
5:alsabat:connect 11 /tmp/pulse-CcctT9RwKSB1/native:-1
5:alsabat:socket AF_LOCAL SOCK_STREAM 0:11
5:alsabat:connect 11 /var/run/pulse/native:-1
5:alsabat:fopen /usr/share/alsa/cards/aliases.conf:0x7f09f0001c80
5:alsabat:fopen /usr/share/alsa/pcm/default.conf:0x7f09f001b3c0
5:alsabat:fopen /usr/share/alsa/pcm/dmix.conf:0x7f09f001b3c0
5:alsabat:fopen /usr/share/alsa/pcm/dsnoop.conf:0x7f09f001b3c0
5:alsabat:open /dev/snd/controlC0:-1
5:alsabat:open /dev/aloadC0:-1
5:alsabat:open /dev/snd/controlC1:-1
5:alsabat:open /dev/aloadC1:-1
5:alsabat:open /dev/snd/controlC2:-1
5:alsabat:open /dev/aloadC2:-1
5:alsabat:open /dev/snd/controlC3:-1
5:alsabat:open /dev/aloadC3:-1

Fail! controlC0:-1 in those logs means it failed. No sounds heard! I cut all logs off at aloadC3 as it just continues to return with the -1 error over 30 times repeating the same iterations.

I tried removing my user from audio group, rebooting, and did aplay -l and a firejail overlay test. Nothing. All it did was remove my access to soundcards /dev/snd/ altogether. I read on firejail wiki some overlay issues occur on the more current linux kernels so I even tried booting on a LTS linux kernel before the stated version but had the same failure. I could try downgrading firejail. I could also downgrade other relevant audio packages but I don't want to mess around with dependencies and cause unnecessary issues. I could try removing ALSA from the default runit boot and invoke it with bash. But ALSA works fine without firejail so its just hopeless guessing. I'm not going any further until I get a good diagnosis from someone who is more familiar with this than I. Currently no user or entity is using /dev/snd/ so I'm still assuming this is a firejail privilege problem or group issue. Unless the current firejail version is bugged.

EDIT:

$ firejail --overlay-tmpfs id

OverlayFS configured in /run/firejail/mnt directory
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized in 181.47 ms
uid=1000(user1) gid=100(users) groups=100(users)

firejail --overlay-tmpfs --allusers id

OverlayFS configured in /run/firejail/mnt directory
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Child process initialized in 180.15 ms
uid=1000(user1) gid=100(users) groups=100(users)

The trace logs are identical, just id binary being ran.

$ firejail --overlay-tmpfs --allusers aplay -l && aplay -L

aplay -l fails to show sound cards

aplay: device_list:274: no soundcards found...

aplay -L successfully lists my pcms just like the other test. The trace log looks as if it hadn't changed despite --allusers.

3:bash:exec /usr/bin/bash:0
3:bash:open /dev/tty:4
3:aplay:exec /usr/bin/aplay:0
3:aplay:open /dev/snd/controlC0:-1
3:aplay:open /dev/aloadC0:-1
3:aplay:open /dev/snd/controlC1:-1
3:aplay:open /dev/aloadC1:-1
3:aplay:open /dev/snd/controlC2:-1
3:aplay:open /dev/aloadC2:-1
3:aplay:open /dev/snd/controlC3:-1
3:aplay:open /dev/aloadC3:-1

Overlays just don't get group access to audio nor the soundcard.

EDIT 2 (EVEN MORE TESTS):

$ firejail --debug id

Autoselecting /bin/bash as shell
Building quoted command line: 'id'
Command name #id#
Attempting to find default.profile...
Found default.profile profile in /etc/firejail directory
Found disable-common.inc profile in /etc/firejail directory
Found disable-passwdmgr.inc profile in /etc/firejail directory
Found disable-programs.inc profile in /etc/firejail directory
Using the local network stack
Using the local network stack
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file
Build protocol filter: unix,inet,inet6
sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol
Mounting /proc filesystem representing the PID namespace
Basic read-only filesystem:
Mounting read-only /etc
mountid=80 fsname=/etc dir=/etc fstype=ext4
Mounting noexec /etc
mountid=81 fsname=/etc dir=/etc fstype=ext4
Mounting read-only /var
mountid=82 fsname=/var dir=/var fstype=ext4
Mounting noexec /var
mountid=83 fsname=/var dir=/var fstype=ext4
Mounting read-only /usr
mountid=84 fsname=/usr dir=/usr fstype=ext4
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Cannot find /run/user/1000 directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
Disable /run/firejail/appimage
blacklist /run/firejail/dbus
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules (requested /lib/modules)
Disable /boot
Disable /dev/port
Disable /dev/kmsg
Disable /proc/kmsg
Disable /home/user1/.bash_history
Disable /home/user1/.lesshst
Disable /home/user1/.viminfo
Disable /home/user1/.xinitrc
Disable /etc/xdg/autostart
Mounting read-only /home/user1/.Xauthority
...
Disable /etc/rc.conf
Disable /var/mail
Disable /var/opt
Disable /run/acpid.socket (requested /var/run/acpid.socket)
Disable /var/mail (requested /var/spool/mail)
Disable /etc/cron.daily
Disable /etc/profile.d
Disable /etc/rc.local
Disable /etc/kernel.d
Disable /etc/grub.d
Disable /etc/apparmor
Disable /etc/apparmor.d
Mounting read-only /home/user1/.bash_logout
...
Disable /home/user1/.gnupg
Disable /home/user1/.netrc
Disable /home/user1/.pki
Disable /home/user1/.local/share/pki
Disable /etc/group-
Disable /etc/gshadow
Disable /etc/gshadow-
Disable /etc/passwd-
Disable /etc/shadow
Disable /etc/shadow-
Disable /etc/ssh
Disable /usr/local/sbin
Disable /usr/bin/chage (requested /bin/chage)
Disable /usr/bin/chage
Disable /usr/bin/chage (requested /usr/sbin/chage)
Disable /usr/bin/chage (requested /sbin/chage)
Disable /usr/bin/chfn (requested /bin/chfn)
Disable /usr/bin/chfn
Disable /usr/bin/chfn (requested /usr/sbin/chfn)
Disable /usr/bin/chfn (requested /sbin/chfn)
Disable /usr/bin/chsh (requested /bin/chsh)
Disable /usr/bin/chsh
Disable /usr/bin/chsh (requested /usr/sbin/chsh)
Disable /usr/bin/chsh (requested /sbin/chsh)
Disable /usr/bin/expiry (requested /bin/expiry)
Disable /usr/bin/expiry
Disable /usr/bin/expiry (requested /usr/sbin/expiry)
Disable /usr/bin/expiry (requested /sbin/expiry)
Disable /usr/bin/fusermount (requested /bin/fusermount)
Disable /usr/bin/fusermount
Disable /usr/bin/fusermount (requested /usr/sbin/fusermount)
Disable /usr/bin/fusermount (requested /sbin/fusermount)
Disable /usr/bin/gpasswd (requested /bin/gpasswd)
Disable /usr/bin/gpasswd
Disable /usr/bin/gpasswd (requested /usr/sbin/gpasswd)
Disable /usr/bin/gpasswd (requested /sbin/gpasswd)
Disable /usr/bin/mount (requested /bin/mount)
Disable /usr/bin/mount
Disable /usr/bin/mount (requested /usr/sbin/mount)
Disable /usr/bin/mount (requested /sbin/mount)
Disable /usr/bin/newgidmap (requested /bin/newgidmap)
Disable /usr/bin/newgidmap
Disable /usr/bin/newgidmap (requested /usr/sbin/newgidmap)
Disable /usr/bin/newgidmap (requested /sbin/newgidmap)
Disable /usr/bin/newgrp (requested /bin/newgrp)
Disable /usr/bin/newgrp
Disable /usr/bin/newgrp (requested /usr/sbin/newgrp)
Disable /usr/bin/newgrp (requested /sbin/newgrp)
Disable /usr/bin/newuidmap (requested /bin/newuidmap)
Disable /usr/bin/newuidmap
Disable /usr/bin/newuidmap (requested /usr/sbin/newuidmap)
Disable /usr/bin/newuidmap (requested /sbin/newuidmap)
Disable /usr/bin/sg (requested /bin/sg)
Disable /usr/bin/sg
Disable /usr/bin/sg (requested /usr/sbin/sg)
Disable /usr/bin/sg (requested /sbin/sg)
Disable /usr/bin/su (requested /bin/su)
Disable /usr/bin/su
Disable /usr/bin/su (requested /usr/sbin/su)
Disable /usr/bin/su (requested /sbin/su)
Disable /usr/bin/sudo (requested /bin/sudo)
Disable /usr/bin/sudo
Disable /usr/bin/sudo (requested /usr/sbin/sudo)
Disable /usr/bin/sudo (requested /sbin/sudo)
Disable /usr/bin/umount (requested /bin/umount)
Disable /usr/bin/umount
Disable /usr/bin/umount (requested /usr/sbin/umount)
Disable /usr/bin/umount (requested /sbin/umount)
Disable /usr/bin/unix_chkpwd (requested /bin/unix_chkpwd)
Disable /usr/bin/unix_chkpwd
Disable /usr/bin/unix_chkpwd (requested /usr/sbin/unix_chkpwd)
Disable /usr/bin/unix_chkpwd (requested /sbin/unix_chkpwd)
Disable /usr/bin/xev (requested /bin/xev)
Disable /usr/bin/xev
Disable /usr/bin/xev (requested /usr/sbin/xev)
Disable /usr/bin/xev (requested /sbin/xev)
Disable /usr/bin/xinput (requested /bin/xinput)
Disable /usr/bin/xinput
Disable /usr/bin/xinput (requested /usr/sbin/xinput)
Disable /usr/bin/xinput (requested /sbin/xinput)
Disable /proc/config.gz
Disable
Disable /home/user1/.config/mpv
...
Disable /sys/fs
Disable /sys/module
Mounting noexec /run/firejail/mnt/pulse
...
Current directory: /home/user1
Install protocol filter: unix,inet,inet6
configuring 20 seccomp entries in /run/firejail/mnt/seccomp/seccomp.protocol
sbox run: /usr/lib64/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp.protocol
configuring 101 seccomp entries in /run/firejail/mnt/seccomp/seccomp.32
sbox run: /usr/lib64/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp.32
Dual 32/64 bit seccomp filter configured
configuring 134 seccomp entries in /run/firejail/mnt/seccomp/seccomp
sbox run: /usr/lib64/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp
seccomp filter configured
Mounting read-only /run/firejail/mnt/seccomp
228 77 0:43 /seccomp /run/firejail/mnt/seccomp ro,nosuid - tmpfs tmpfs rw,mode=755,inode64
mountid=228 fsname=/seccomp dir=/run/firejail/mnt/seccomp fstype=tmpfs
Seccomp directory:
ls /run/firejail/mnt/seccomp
drwxr-xr-x root     root             160 .
drwxr-xr-x root     root             240 ..
-rw-r--r-- user1 users           1072 seccomp
-rw-r--r-- user1 users            808 seccomp.32
-rw-r--r-- user1 users            114 seccomp.list
-rw-r--r-- user1 users              0 seccomp.postexec
-rw-r--r-- user1 users              0 seccomp.postexec32
-rw-r--r-- user1 users            160 seccomp.protocol
Active seccomp files:
cat /run/firejail/mnt/seccomp/seccomp.list
/run/firejail/mnt/seccomp/seccomp.protocol
/run/firejail/mnt/seccomp/seccomp.32
/run/firejail/mnt/seccomp/seccomp
Dropping all capabilities
noroot user namespace installed
Dropping all capabilities
NO_NEW_PRIVS set
Drop privileges: pid 1, uid 1000, gid 100, nogroups 0
Supplementary groups: 12
Starting application
LD_PRELOAD=(null)
Running 'id'  command through /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: 'id'
uid=1000(user1) gid=100(users) groups=100(users),12(audio)

$ firejail --debug --overlay-tmpfs id

Autoselecting /bin/bash as shell
Building quoted command line: 'id'
Command name #id#
Attempting to find default.profile...
Found default.profile profile in /etc/firejail directory
Found disable-common.inc profile in /etc/firejail directory
Found disable-passwdmgr.inc profile in /etc/firejail directory
Found disable-programs.inc profile in /etc/firejail directory
Using the local network stack
Using the local network stack
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp directory
Creating empty /run/firejail/mnt/seccomp/seccomp.protocol file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec file
Creating empty /run/firejail/mnt/seccomp/seccomp.postexec32 file
Build protocol filter: unix,inet,inet6
sbox run: /run/firejail/lib/fseccomp protocol build unix,inet,inet6 /run/firejail/mnt/seccomp/seccomp.protocol
Linux kernel version 5.10
Mounting OverlayFS
DEBUG: chroot dirs are oroot /run/firejail/mnt/oroot  odiff /run/firejail/mnt/odiff  owork /run/firejail/mnt/owork
DEBUG: overlayhome var holds ##/run/firejail/mnt/oroot/home/user1##
Mounting /dev
Mounting /run
Mounting /tmp
Mounting /proc filesystem representing the PID namespace
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Cleaning /run/user directory
Cannot find /run/user/1000 directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /run/firejail/network
Disable /run/firejail/bandwidth
Disable /run/firejail/name
Disable /run/firejail/profile
Disable /run/firejail/x11
Disable /run/firejail/appimage
blacklist /run/firejail/dbus
Mounting read-only /proc/sys
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules (requested /lib/modules)
Disable /boot
Disable /dev/port
Disable /dev/kmsg
Disable /proc/kmsg
Disable /home/user1/.bash_history
Disable /home/user1/.lesshst
Disable /home/user1/.viminfo
Disable /home/user1/.xinitrc
Disable /etc/xdg/autostart
Mounting read-only /home/user1/.Xauthority
...
fstype=overlay
Disable /etc/rc.conf
Disable /var/mail
Disable /var/opt
Disable /run/acpid.socket (requested /var/run/acpid.socket)
Disable /var/mail (requested /var/spool/mail)
Disable /etc/cron.daily
Disable /etc/profile.d
Disable /etc/rc.local
Disable /etc/kernel.d
Disable /etc/grub.d
Disable /etc/apparmor
Disable /etc/apparmor.d
Mounting read-only /home/user1/.bash_logout
...
Disable /home/user1/.gnupg
Disable /home/user1/.netrc
Disable /home/user1/.pki
Disable /home/user1/.local/share/pki
Disable /etc/group-
Disable /etc/gshadow
Disable /etc/gshadow-
Disable /etc/passwd-
Disable /etc/shadow
Disable /etc/shadow-
Disable /etc/ssh
Disable /usr/local/sbin
Disable /usr/bin/chage (requested /bin/chage)
Disable /usr/bin/chage
Disable /usr/bin/chage (requested /usr/sbin/chage)
Disable /usr/bin/chage (requested /sbin/chage)
Disable /usr/bin/chfn (requested /bin/chfn)
Disable /usr/bin/chfn
Disable /usr/bin/chfn (requested /usr/sbin/chfn)
Disable /usr/bin/chfn (requested /sbin/chfn)
Disable /usr/bin/chsh (requested /bin/chsh)
Disable /usr/bin/chsh
Disable /usr/bin/chsh (requested /usr/sbin/chsh)
Disable /usr/bin/chsh (requested /sbin/chsh)
Disable /usr/bin/expiry (requested /bin/expiry)
Disable /usr/bin/expiry
Disable /usr/bin/expiry (requested /usr/sbin/expiry)
Disable /usr/bin/expiry (requested /sbin/expiry)
Disable /usr/bin/fusermount (requested /bin/fusermount)
Disable /usr/bin/fusermount
Disable /usr/bin/fusermount (requested /usr/sbin/fusermount)
Disable /usr/bin/fusermount (requested /sbin/fusermount)
Disable /usr/bin/gpasswd (requested /bin/gpasswd)
Disable /usr/bin/gpasswd
Disable /usr/bin/gpasswd (requested /usr/sbin/gpasswd)
Disable /usr/bin/gpasswd (requested /sbin/gpasswd)
Disable /usr/bin/mount (requested /bin/mount)
Disable /usr/bin/mount
Disable /usr/bin/mount (requested /usr/sbin/mount)
Disable /usr/bin/mount (requested /sbin/mount)
Disable /usr/bin/newgidmap (requested /bin/newgidmap)
Disable /usr/bin/newgidmap
Disable /usr/bin/newgidmap (requested /usr/sbin/newgidmap)
Disable /usr/bin/newgidmap (requested /sbin/newgidmap)
Disable /usr/bin/newgrp (requested /bin/newgrp)
Disable /usr/bin/newgrp
Disable /usr/bin/newgrp (requested /usr/sbin/newgrp)
Disable /usr/bin/newgrp (requested /sbin/newgrp)
Disable /usr/bin/newuidmap (requested /bin/newuidmap)
Disable /usr/bin/newuidmap
Disable /usr/bin/newuidmap (requested /usr/sbin/newuidmap)
Disable /usr/bin/newuidmap (requested /sbin/newuidmap)
Disable /usr/bin/sg (requested /bin/sg)
Disable /usr/bin/sg
Disable /usr/bin/sg (requested /usr/sbin/sg)
Disable /usr/bin/sg (requested /sbin/sg)
Disable /usr/bin/su (requested /bin/su)
Disable /usr/bin/su
Disable /usr/bin/su (requested /usr/sbin/su)
Disable /usr/bin/su (requested /sbin/su)
Disable /usr/bin/sudo (requested /bin/sudo)
Disable /usr/bin/sudo
Disable /usr/bin/sudo (requested /usr/sbin/sudo)
Disable /usr/bin/sudo (requested /sbin/sudo)
Disable /usr/bin/umount (requested /bin/umount)
Disable /usr/bin/umount
Disable /usr/bin/umount (requested /usr/sbin/umount)
Disable /usr/bin/umount (requested /sbin/umount)
Disable /usr/bin/unix_chkpwd (requested /bin/unix_chkpwd)
Disable /usr/bin/unix_chkpwd
Disable /usr/bin/unix_chkpwd (requested /usr/sbin/unix_chkpwd)
Disable /usr/bin/unix_chkpwd (requested /sbin/unix_chkpwd)
Disable /usr/bin/xev (requested /bin/xev)
Disable /usr/bin/xev
Disable /usr/bin/xev (requested /usr/sbin/xev)
Disable /usr/bin/xev (requested /sbin/xev)
Disable /usr/bin/xinput (requested /bin/xinput)
Disable /usr/bin/xinput
Disable /usr/bin/xinput (requested /usr/sbin/xinput)
Disable /usr/bin/xinput (requested /sbin/xinput)
Disable /proc/config.gz
Disable /home/user1/.config/mpv
Disable /home/user1/.config/straw-viewer
Disable /home/user1/.config/torbrowser
Disable /home/user1/.config/youtube-dl
Disable /home/user1/.links
Disable /home/user1/.local/share/torbrowser
Disable /home/user1/.mozilla
Disable /home/user1/.cache/mozilla
Disable /home/user1/.cache/straw-viewer
Disable /home/user1/.cache/torbrowser
Disable /sys/fs
Disable /sys/module
Mounting noexec /run/firejail/mnt/pulse
251 87 0:43 /pulse /run/firejail/mnt/pulse rw,nosuid,nodev,noexec - tmpfs tmpfs rw,mode=755,inode64
mountid=251 fsname=/pulse dir=/run/firejail/mnt/pulse fstype=tmpfs
Mounting /run/firejail/mnt/pulse on /home/user1/.config/pulse
252 101 0:43 /pulse /home/user1/.config/pulse rw,nosuid,nodev,noexec - tmpfs tmpfs rw,mode=755,inode64
mountid=252 fsname=/pulse dir=/home/user1/.config/pulse fstype=tmpfs
Current directory: /home/user1
Install protocol filter: unix,inet,inet6
configuring 20 seccomp entries in /run/firejail/mnt/seccomp/seccomp.protocol
sbox run: /usr/lib64/firejail/fsec-print /run/fire line  OP JT JF    K
...
jail/mnt/seccomp/seccomp.protocol
configuring 101 seccomp entries in /run/firejail/mnt/seccomp/seccomp.32
sbox run: /usr/lib64/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp.32
Dual 32/64 bit seccomp filter configured
configuring 134 seccomp entries in /run/firejail/mnt/seccomp/seccomp
sbox run: /usr/lib64/firejail/fsec-print /run/firejail/mnt/seccomp/seccomp
seccomp filter configured
Mounting read-only /run/firejail/mnt/seccomp
254 87 0:43 /seccomp /run/firejail/mnt/seccomp ro,nosuid - tmpfs tmpfs rw,mode=755,inode64
mountid=254 fsname=/seccomp dir=/run/firejail/mnt/seccomp fstype=tmpfs
Seccomp directory:
ls /run/firejail/mnt/seccomp
drwxr-xr-x root     root             160 .
drwxr-xr-x root     root             300 ..
-rw-r--r-- user1 users           1072 seccomp
-rw-r--r-- user1 users            808 seccomp.32
-rw-r--r-- user1 users            114 seccomp.list
-rw-r--r-- user1 users              0 seccomp.postexec
-rw-r--r-- user1 users              0 seccomp.postexec32
-rw-r--r-- user1 users            160 seccomp.protocol
Active seccomp files:
cat /run/firejail/mnt/seccomp/seccomp.list
/run/firejail/mnt/seccomp/seccomp.protocol
/run/firejail/mnt/seccomp/seccomp.32
/run/firejail/mnt/seccomp/seccomp
Dropping all capabilities
NO_NEW_PRIVS set
Drop privileges: pid 1, uid 1000, gid 100, nogroups 1
No supplementary groups
Starting application
LD_PRELOAD=(null)
Running 'id'  command through /bin/bash
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: 'id'
uid=1000(user1) gid=100(users) groups=100(users)

I got some important relevant debug info, scrubbed some personal details and to reserve character space limits here. I'm just a novice at UNIX so I'm not sure what to do with this info to fix overlay and audio group access. This should be my last info possible.

2
  • Try --allusers. – CL. Feb 3 at 8:26
  • @CL. No dice. The tests in my edit failed. – Sheriff Po Feb 3 at 10:28
1

You can select the group firejail uses by changing your effective group id.

firejail creates a user namespace where only your current effective user and group exist (as well as system users like root and nobody). You need to make the audio group your effective group id (as opposed to one of many groups your user is in):

 $ newgrp audio
 $ id
 uid=1000(user1) gid=12(audio) groups=......
 $ firejail program-that-needs-the-audio-group


 
1
  • Works! uid=1000(user1) gid=100(users) groups=100(users),12(audio),991(wireshark) now reads uid=1000(user1) gid=12(audio) groups=12(audio),100(users),991(wireshark) I'm going to reseach how to make this persistent across multiple terminals. Thanks. – Sheriff Po Feb 3 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.