netblue30 / firejail

Linux namespaces and seccomp-bpf sandbox
https://firejail.wordpress.com
GNU General Public License v2.0
5.77k stars 565 forks source link

media support unavailable since update to Vivaldi 2.9 #3024

Closed milsap1234 closed 4 years ago

milsap1234 commented 4 years ago

Since update to Vivaldi 2.9 from 2.8, html5, flash and widevine media support is not available when Vivaldi is run in firejail. They work when V. is run without firejail.

Vivaldi 2.9.1705.31 MX-Linux 18.3 firejail 0.9.60

$> sudo ./update-ffmpeg Proprietary media codecs (77.0.3865.90) was already present $> sudo ./update-widevine Widevine (4.10.1440.18) is already installed and does not need to be updated $> firejail vivaldi ... 'Proprietary media' support is not installed. Fix this by running: /opt/vivaldi/update-ffmpeg The Widevine CDM is not installed. Fix this by running: /opt/vivaldi/update-widevine /usr/bin/vivaldi: line 60: /dev/fd/62: No such file or directory /usr/bin/vivaldi: line 61: /dev/fd/62: No such file or directory [8:8:1101/111404.827255:ERROR:chrome_content_client.cc(343)] Failed to locate and load the component updated flash plugin. ... browser finishes loading and runs normally but w/o media support


libffmpeg and libwidevine are located in /var/opt/vivaldi in the new release. Tried adding whitelist /var/opt/vivaldi in vivaldi.local: no effect remarking out "blacklist /var/opt" in disable-common.inc skipped the error messages, but html5 still doesn't work. Likewise with firejail --noprofile vivaldi Have not tested widevine or flash

Thanks

rusty-snake commented 4 years ago

So with --noprofile it works? (unsure because of my (or your) english.)

Can you try adding this to vivaldi.local.

noblacklist /var/opt
whitelist /var/opt/vivaldi

3022 is a similar issue looks like vivaldi.profile needs some tweaks.

milsap1234 commented 4 years ago

Either starting with --noprofile or making those changes to vivaldi.local cause the warnings

'Proprietary media' support is not installed. The Widevine CDM is not installed. Failed to locate and load the component updated flash plugin

to disappear at startup, but html5 video does not play.

rusty-snake commented 4 years ago

Wait, what. With firejail --noprofile vivaldi html5-media doesn't work? So we talk about mp4 or webm and not about EME/DRM. Works it with firejail --noprofile --writable-var vivalidi?

milsap1234 commented 4 years ago

With firejail --noprofile vivaldi html5-media doesn't work?

Correct

Works it with firejail --noprofile --writable-var vivaldi

Yes, html5 and widevine both work.

rusty-snake commented 4 years ago

How did you install vivaldi, I try to reproduce.

milsap1234 commented 4 years ago

sudo apt install vivaldi-stable_2.9.1705.31-1_amd64.deb sudo /opt/vivaldi/update-ffmpeg sudo /opt/vivaldi/update-widevine

rusty-snake commented 4 years ago

From vivaldi.com, right? (just give :+1: if so)

aberja commented 4 years ago

I too am experiencing the same issue with the update to Vivaldi 2.9 I'm running LMDE 3. I updated firejail via Git last night (did not resolve the matter. I updated Vivaldi via the automatic update.

Running firejail --noprofile --writeable-var vivaldi appears to work, but I see the following errors:

g752vs@g752vs:~$ firejail --noprofile --writable-var vivaldi Parent pid 22649, child pid 22650 Child process initialized in 28.62 ms Fontconfig warning: "/etc/fonts/fonts.conf", line 100: unknown element "blank" [2:2:1104/132644.645453:ERROR:chrome_content_client.cc(343)] Failed to locate and load the component updated flash plugin. [2:83:1104/132644.721412:ERROR:database.cc(1581)] Calendar sqlite error 1, errno 0: no such column: etag, sql: update events set etag = '' [2:83:1104/132644.721548:ERROR:calendar_database.cc(47)] Calendar DB failed to migrate from version 1. Calendar API will be disabled. [2:83:1104/132644.728539:ERROR:calendar_backend.cc(152)] INIT_TOO_NEW [2:2:1104/132647.240595:ERROR:CONSOLE(0)] "Unchecked runtime.lastError: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0) [2:2:1104/132647.240634:ERROR:CONSOLE(0)] "Unchecked runtime.lastError: The message port closed before a response was received.", source: chrome-extension://mpognobbkildjkofajifpdfhcoklimli/browser.html (0)

aberja commented 4 years ago

From vivaldi.com, right? (just give if so)

The repository I'm using is...

deb http://repo.vivaldi.com/stable/deb/ stable main

milsap1234 commented 4 years ago

Yes, same repo as aberja Thanks for your persistence.

ruario commented 4 years ago

Try running update-ffmpeg without sudo but with the --user option instead, like so:

/opt/vivaldi/update-ffmpeg --user

Alternatively if that does not work, take a copy of the suitable libffmpeg.so (e.g. the one that got installed in ~/.local/lib or /var/opt) and move it into the main Vivaldi install directory (/opt/vivaldi or if snapshot /opt/vivaldi-snapshot), naming it libffmpeg.so.2.9. Then restart the browser.

aberja commented 4 years ago

ty @ruario for the suggestions. Running /opt/vivaldi/update-ffmeg --user now allows live videos in YouTube to play.

But I'm still receiving numerous errors including The Widevine CDM is not installed. Fix this by running: /opt/vivaldi/update-widevine

I thought I would also try --user with the above line, i.e. /opt/vivaldi/update-widevine --user

But the system returns an error:

g752vs@g752vs:/opt/vivaldi$ /opt/vivaldi/update-widevine --user rm: cannot remove '/opt/vivaldi/WidevineCdm': Permission denied

If I use sudo, it complains about ffmpeg... g752vs@g752vs:/opt/vivaldi$ sudo /opt/vivaldi/update-widevine --user [sudo] password for g752vs:
Widevine (4.10.1440.18) installed successfully (PLEASE RESTART VIVALDI)

However, support for 'proprietary media' is not installed. Fix this by running: /opt/vivaldi/update-ffmpeg

I also tried your second suggestion of copying libffmpeg.so into /opt/vivaldi and rerunning the Widevine command, but I get the same thing.

rusty-snake commented 4 years ago

Now I found time to test this. This Patch should work:

diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile
index b62cc6df..52df554f 100644
--- a/etc/vivaldi.profile
+++ b/etc/vivaldi.profile
@@ -5,6 +5,13 @@ include vivaldi.local
 # Persistent global definitions
 include globals.local

+# Allow  HTML5 Proprietary Media & DRM/EME (Widevine)
+ignore apparmor
+ignore noexec /var
+noblacklist /var/opt
+whitelist /var/opt/vivaldi
+writable-var
+
 noblacklist ${HOME}/.cache/vivaldi
 noblacklist ${HOME}/.config/vivaldi
 noblacklist ${HOME}/.local/lib/vivaldi
milsap1234 commented 4 years ago

@ruario thank you for your suggestions; I got results similar to aberja @rusty-snake Thank you, these changes worked. :)
Note: I tested widevine with amazon video, html5 with https://tekeye.uk/html/html5-video-test-page

rusty-snake commented 4 years ago

I simply used the test video from https://help.vivaldi.com/article/widevinecdm-eme-drm-support-on-linux/ and https://help.vivaldi.com/article/html5-proprietary-media-on-linux/.

aberja commented 4 years ago

I've installed the patch and I'm still getting the Widevine CDM is not installed message.

Accordingly, I am unable to play DRM video. For example: https://demo.castlabs.com/ The 3 non DRM videos play, but the two Big Buck Bunny DRM videos do not play

https://bitmovin.com/demos/drm It states Encrypted Media Extension – EME is not supported by your current browser. I can only play the non DRM videos

Note: HTML5 videos i.e. live YouTube videos do work after the patch.

rusty-snake commented 4 years ago

My test setup:

  1. Install MX Linux 19 in a VM
  2. Update System
  3. Install firejail lastet git
  4. Install vivaldi trough wget <vivaldi.deb> ; sudo dpkg -i vivaldi.deb
  5. sudo firecfg
  6. start vivaldi and open DRM/EME videos. All workt.
milsap1234 commented 4 years ago

@aberja, This might be worth a try; you're probably way ahead of me, though. To get rid of my experiments, I returned to freshly-installed /etc/firejail folder (no vivaldi.local). Then I modified vivaldi.profile according to rusty-snake and saved it as ~/.config/firejail/vivaldi.profile. $> firejail vivaldi invokes this profile and media work for me.

aberja commented 4 years ago

Thanks @rusty-snake & @milsap1234

Since this was working for both of you, I realized that it must be something on my computer. I first uninstalled all extensions...same issue. Second, I deleted the firejail folder, cloned and reinstalled...same issue. Finally, I reinstalled vivaldi...bingo, this worked.

I'm still seeing a lot of errors in the terminal window, but I can now watch widevine DRM videos.

rusty-snake commented 4 years ago

I'm still seeing a lot of errors in the terminal window

Me too, but as long as nothing is broken I think we can ignore it.

ruario commented 4 years ago

This will fix it for you

sudo rm /opt/vivaldi/WidevineCdm
sudo mkdir -p /opt/vivaldi/WidevineCdm/_platform_specific/linux_x64
wget -O- https://dl.google.com/widevine-cdm/4.10.1582.1-linux-x64.zip | head -c3999760 | zcat | sudo tee /opt/vivaldi/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so >/dev/null