Asahi Linux

341 readers

8 users here now

Unofficial community for the Asahi Linux project

founded 3 years ago

MODERATORS

sdu@lemmy.world

How do I allow muvm/FEX in Firejail? (lemmy.dbzer0.com)

submitted 2 days ago by thethunderwolf@lemmy.dbzer0.com to c/asahilinux@lemmy.world

4 comments fedilink hide all child comments

output of firejail ./start.sh:

Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/landlock-common.inc

** Note: you can use --noprofile to disable default.profile **

firejail version 0.9.80

Parent pid 63759, child pid 63760
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 22.11 ms
Child process initialized in 56.25 ms
Running Undertale
[binfmt_dispatcher] Using FEX with muvm
Error: Failed to create lock file

Caused by:
    Permission denied (os error 13)

Parent is shutting down, bye...

./start.sh is a shell script that launches the executable, its running the script (hence the "Running Undertale") but the executable (which is x86_64) cannot be run because Firejail restrictions block the muvm/FEX lock file

how do i configure firejail to allow muvm/FEX to launch

you are viewing a single comment's thread
view the rest of the comments

[–] onipa@feddit.org 1 points 1 day ago (1 children)

Hi, I was recently playing around with muvm and FEX too. I am new to FEX, muvm and firejail, though, and I am currently trying to resolve my own issue with adding a library to the FEX rootFS. Anyway, I could replicate your error by running:

$ firejail muvm FEXBash ~/Downloads/Xonotic/xonotic-linux-glx.sh
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/landlock-common.inc

** Note: you can use --noprofile to disable default.profile **

firejail version 0.9.80

Parent pid 7264, child pid 7265
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 23.06 ms
Child process initialized in 79.46 ms
Error: Failed to create lock file

Caused by:
    Permission denied (os error 13)

Parent is shutting down, bye...

I guess this can be resolved by

finding out where it tries to write the lock file
allowing firejail to write the lock file

unfortunately, I currently don't know how to do either

[–] onipa@feddit.org 1 points 1 day ago* (last edited 1 day ago) (1 children)

I guess we need to creat some sort of config similar to the ones for PCSX2 or dolphin-emu

EDIT:

If Firejail can not recognize your application, it will use a very restrictive default profile.

from: https://firejail.wordpress.com/documentation-2/

[–] onipa@feddit.org 1 points 1 day ago* (last edited 1 day ago) (1 children)

I learned two more things:
1.) I could replicate the error with only: firejail muvm FEXBash
2.) I tried to locate the lock file by running muvm FEXBash & ps aux | grep muvm and using the PID in lsof -p $PID, but both /run/user/$(id -u)/muvm.lock and $HOME/.local/share/fex-emu/Server/Server.lock stayed present even after kill muvm ...

EDIT: I checked both mentioned files with fuser $HOME/.local/share/fex-emu/Server/Server.lock and fuser /run/user/$(id -u)/muvm.lock with muvm FEXBash running and not running and it returned the PID of muvm FEXBash (obviously) only while it was running.
So maybe this could be resolved simply by allowing access to those two files.

[–] onipa@feddit.org 1 points 1 day ago

one step closer:

$ firejail --noblacklist=/run/user/$(id -u)/muvm.lock muvm FEXBash
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/landlock-common.inc

** Note: you can use --noprofile to disable default.profile **

firejail version 0.9.80

Parent pid 14335, child pid 14336
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Base filesystem installed in 23.73 ms
Child process initialized in 91.82 ms
Error: Failed to prepare environment variables

Caused by:
    0: Failed to read `/proc/device-tree/compatible`
    1: Permission denied (os error 13)

Parent is shutting down, bye...
$ firejail --noprofile muvm FEXBash
firejail version 0.9.80

Parent pid 14351, child pid 14352
Base filesystem installed in 0.02 ms
Child process initialized in 6.42 ms
Error: Failed to prepare environment variables

Caused by:
    0: Failed to read `/proc/device-tree/compatible`
    1: Permission denied (os error 13)

Parent is shutting down, bye...

But I don't know why it can't read /proc/device-tree/compatible even though I don't use a profile ...