firefox: How to allow execution of the OpenH264 plugin?

[michelesr]

The libgmpopenh264.so is downloaded into the user profile at ~/.mozilla/user.profile/gmp-gmpopenh264/, but Firejail is blocking local binary execution with

firejail/etc/inc/disable-exec.inc

Line 5 in 37e40e0

noexec ${HOME}

, this causes an error in Firefox when trying to use the plugin (e.g. screensharing on https://meet.jit.si under Wayland and Pipewire) ...

                Module /home/michele/.mozilla/firefox/user.profile/gmp-gmpopenh264/2.3.2/libgmpopenh264.so without build-id.
                Stack trace of thread 518:
                #0  0x00007f1a83137c80 n/a (libxul.so + 0x6737c80)
                #1  0x00007f1a831373fc n/a (libxul.so + 0x67373fc)
                #2  0x00007f1a83162309 n/a (libxul.so + 0x6762309)
                #3  0x00007f1a7ff0abc3 n/a (libxul.so + 0x350abc3)
                #4  0x00007f1a7fee5749 n/a (libxul.so + 0x34e5749)
                #5  0x00007f1a7fee378d n/a (libxul.so + 0x34e378d)
                #6  0x00007f1a7fedc54f n/a (libxul.so + 0x34dc54f)
                #7  0x00007f1a7feda989 n/a (libxul.so + 0x34da989)
                #8  0x00007f1a814e466e n/a (libxul.so + 0x4ae466e)
                #9  0x00007f1a7feda6ef n/a (libxul.so + 0x34da6ef)
                #10 0x00007f1a80b84b13 n/a (libxul.so + 0x4184b13)
                #11 0x000055d73d25beb8 n/a (firefox + 0x64eb8)
                #12 0x00007f1a8aa45cd0 n/a (libc.so.6 + 0x27cd0)
                #13 0x00007f1a8aa45d8a __libc_start_main (libc.so.6 + 0x27d8a)
                #14 0x000055d73d26d755 _start (firefox + 0x76755)

                Stack trace of thread 521:
                #0  0x00007f1a8ab2c73d syscall (libc.so.6 + 0x10e73d)
                #1  0x00007f1a80546e2f n/a (libxul.so + 0x3b46e2f)
                #2  0x00007f1a81391dba n/a (libxul.so + 0x4991dba)
                #3  0x00007f1a81f4019b n/a (libxul.so + 0x554019b)
                #4  0x000055d73d261a03 n/a (firefox + 0x6aa03)
                #5  0x00007f1a8aaaa9eb n/a (libc.so.6 + 0x8c9eb)
                #6  0x00007f1a8ab2e7cc n/a (libc.so.6 + 0x1107cc)
                ELF object binary architecture: AMD x86-64

And [Parent 9, IPC I/O Parent] WARNING: process 489 exited on signal 11: file /build/firefox/src/firefox-119.0/ipc/chromium/src/base/process_util_posix.cc:265

I add to add ignore noexec ${HOME} to fix this issue. @netblue30 perhaps it should be added to the profile?

[rusty-snake]

firejail/etc/profile-a-l/firefox-common.profile

Lines 9 to 12 in 37e40e0

	# noexec ${HOME} breaks DRM binaries.
	?BROWSER_ALLOW_DRM: ignore noexec ${HOME}
	# noexec ${RUNUSER} breaks DRM binaries when using profile-sync-daemon.
	?BROWSER_ALLOW_DRM: ignore noexec ${RUNUSER}

[rusty-snake]

--private starts with an empty - $HOME. Did you made sure that firefox already downloaded the openh264 plugin when you tested?

Also are you sure that your issue id caused by a missing openh264 plugin?

What error do you get?

[Endothelin]

--private starts with an empty - $HOME. Did you made sure that firefox already downloaded the openh264 plugin when you tested?

Yes, the file libgmpopenh264.so is in .mozilla/firefox/[...]/gmp-gmpopenh264/2.3.2

Also are you sure that your issue id caused by a missing openh264 plugin?

I am not sure that the plugin is missing, but firefox shows a popup that says this plugin crashed and firejail outputs the same warning as in the first post of this discussion.

What error do you get?

See above.

When not using --private the video is transmitted as expected (when using browser-allow-drm yes or ignore noexec ${HOME}).

[Endothelin]

Sorry for not pasting the exact error messages, here they are:
[Parent 14, IPC I/O Parent] WARNING: process 492 exited on signal 11: file /home/abuild/rpmbuild/BUILD/firefox-122.0.1/ipc/chromium/src/base/process_util_posix.cc:265
and in firefox
The gmpopenh264 plugin crashed.

I tested a bit more and the easiest way to test if the problem persists I found is to start a firefox instance with
firejail --name=T firefox
or
firejail --name=T --ignore='noexec ${HOME}' firefox
or
firejail --name=T --private firefox
or
firejail --name=T --private --ignore='noexec ${HOME}' firefox
(and maybe add --no-remote at the end to prevent interference with other firefox instances)

Then wait a few seconds and run
firejail --join=T bash -c "~/.mozilla/firefox/*.default-release/gmp-gmpopenh264/2.3.2/libgmpopenh264.so"
or
firejail --join=T bash -c "~/.mozilla/firefox/*.default/gmp-gmpopenh264/2.3.2/libgmpopenh264.so"

If the result is

• "Permission denied" -> the plugin does not work
• No Output or Segfault (when executing the library that is probably not designed to be executed this way) -> plugin will work
• "No such file or directory" -> Firefox has not prepared the library (wait a few seconds and try again) or the path-hack does not work

As a reminder: I do not need to use this (anymore), I was just wondering if this behavior is expected.

[rusty-snake]

If you run your teste with firejail [--ignore|--private] --profile=firefox findmnt -U $HOME | grep noexec, does it mount $HOME noexec? Or is something else breaking it.

[Endothelin]

In none of the four possible combinations of [--private, --ignore='noexec ${HOME}'] $HOME is mounted noexec.

EDIT: The output of firejail --private findmnt $HOME is
/home/user /dev/mapper/system-root[/@/home/user] btrfs rw,relatime,ssd,space_cache,subvolid=260,subvol=/@/home. I assumed this would be a tmpfs, but maybe I just misinterpreted the documentation.

EDIT2: By the way, I am still using firejail version 0.9.70.