Dear Maintainer,

After upgraded to 97.0.4692.71-0.1, Chromium running inside firejail can no
longer play sound (e.g. when playing an online video), while bare Chromium
can. It is shown with PulseAudio Manager that the Chromium running inside
firejail cannot connect to the sound server while the bare Chromium can.

Hi Mad Horse,

I had a similar issue initially as well. But it turned out to be related
to my custom sound setup (using pipewire with run directory in ~/pipewire).
There are also no sound-related Chromium issue known in the upstream
firejail bug tracker.

So I think it also has to be related to your setup.
It might be related to some whitelist in the chromium{-common}.profile,
as this causes the parent directory to get blocked.
Can you please try to figure out which path needs to be whitelisted
on your system to get it working again?

Kind regards,
  Reiner

Hi Reine,

I do not have any custom setup on my pipewire, nor custom firejail
profile for chromium.

Started within firejail, chromium reported:
/run/firejail/mnt/dbus/system do have permission 600, owned by root.

When trying to play sound, chromium in firejail reported:

but there is a unix domain socket /run/user/1000/pulse/native, owned by
UID 1000, with permission 666,
and the permission of
/usr/lib/x86_64-linux-gnu/alsa-lib/libasound_module_pcm_pulse.so is
root,644.
Both were inspected inside firejail for chromium.

Do you have any idea about these?

Kind regards,

Mad Horse

Do I understand it correctly that you are also using pipewire?

I think they are not related. I see these messages as well, but sound is
working for me.

Assuming that you are using pipewire, can you please add the following
to your chromium.profile (or chromium.local):

Kind regards,
  Reiner

Dear Maintainer,
I am in the same situation, audio managed by pipewire,
chromium version 98.0.4758.102-1.

If I run "firejail chromium" I get the error
"Failed to create secure directory (/run/user/1000/pulse)"
and no sound.

After reading this post:
<https://github.com/netblue30/firejail/issues/4855#issuecomment-1013831885>
I created the file "~/.config/firejail/whitelist-runuser-common.local"
that contains a single line:
whitelist ${RUNUSER}/pulse

Now chromium can play sounds.

The file "/etc/firejail/whitelist-runuser-common.inc" contains the line:
[...]
whitelist ${RUNUSER}/pulse/native
[...]
and apparently is not sufficient; curiously chromium does not create
files inside /run/user/1000/pulse

We believe that the bug you reported is fixed in the latest version of
firejail, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1003650@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reiner Herrmann <reiner@reiner-h.de> (supplier of updated firejail package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 09 Jun 2022 19:14:08 +0200
Source: firejail
Architecture: source
Version: 0.9.70-1
Distribution: unstable
Urgency: medium
Maintainer: Reiner Herrmann <reiner@reiner-h.de>
Changed-By: Reiner Herrmann <reiner@reiner-h.de>
Closes: 1003650
Changes:
 firejail (0.9.70-1) unstable; urgency=medium
 .
   * New upstream release.
     - fix sound playback in chromium (Closes: #1003650)
   * Drop patches applied upstream.
   * Enable new IDS feature during build.
   * Mark nvm.profile as removed.
   * Extend lintian-override match to include profstats.
   * Move profiles tests back from smoke- to simple-tests, as they
     are too environment dependent.
   * Add procps to test dependencies.
Checksums-Sha1:
 a649d67462c36c3ebc99668f8a36a544dc6c8753 2479 firejail_0.9.70-1.dsc
 8b3773efd60ebea28bb674d48d1eb0b6da0c9209 485096 firejail_0.9.70.orig.tar.xz
 ccfb55cde1cc120ea00d2337f3df3aeac779508a 488 firejail_0.9.70.orig.tar.xz.asc
 02eb4d09fda9935ec038310207a8bfd212bc3c10 15780 firejail_0.9.70-1.debian.tar.xz
 f119f2b0fdd28dabef97a8dee0cc33acf18d02eb 6603 firejail_0.9.70-1_source.buildinfo
Checksums-Sha256:
 273f075657660e9055a2fc4abbe848156fc4c3740f4f68b61e266d74ad03ed85 2479 firejail_0.9.70-1.dsc
 b77b67a4db7c01d69cb033a50aa7b1132dfaeb2cd97ce6412285235265b71b17 485096 firejail_0.9.70.orig.tar.xz
 145461097f6efcacba3f6a97f15de3f2e4da05cdf419ccd95af3f4ef26c1aa20 488 firejail_0.9.70.orig.tar.xz.asc
 d98b7e248f400dcc76f1e3b969e47961793f9f5f51194aa182778dda3d3ac774 15780 firejail_0.9.70-1.debian.tar.xz
 0e105ae70453ac56a4aa209b807560e921ba6ee77a4fc28b1dfedd742b8b7b92 6603 firejail_0.9.70-1_source.buildinfo
Files:
 0b8dea81b7e522dbc68e75194a5e2dd0 2479 utils optional firejail_0.9.70-1.dsc
 3a32b2c71a02c15d91c77511180de717 485096 utils optional firejail_0.9.70.orig.tar.xz
 7ca3db9f60f983086bf97a7e7fcfd145 488 utils optional firejail_0.9.70.orig.tar.xz.asc
 13fdd06728d705ae501dd6932f68e062 15780 utils optional firejail_0.9.70-1.debian.tar.xz
 43bea364e214276a046f47fbe17254d7 6603 utils optional firejail_0.9.70-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2Pb6feok2Q1urHM7zPBJKNsO6qcFAmKiLOcACgkQzPBJKNsO
6qdIrw/+OwoWy7khW4tCZlzioTOo7NQKfe4+aYiDWHtPacLpDJ5ywIuO+v9rw2OH
/EkSptrNGKUo9Ke8Dw9ila2C4NelICVpGZzWXzc2CxHV8M7C9Poam5xceAYnUqqY
hIENmxHAQeyBSnAiUtxt0XTG2BkG3L7baEYPCQoKZ9MjkRAFkP7pKjvXHaMDm74o
6aQbBNj+7x3/uGqhRQbXFd3SaDqjr5kuzM6Mb852cMHZyTVNEBWQeIFm86yEgAqN
6ucJtVSAH495sCszC4yk5CeQlgqBhcSOSMM5w48BLnCl7+GMhLxr6TynRyWvf4qe
5XYwp2DA35oqcbK1aFCFa/E4g/VtiQIFjbwwQioPsIXZWAfXl6IeB4phlKSIuR0q
bRzqWTDKrsgnl+4yk4wBbHmuKWePDn/d9r0e1b8g68CuYE/P82b4wCZo9BFVP48M
tF5ZxLx7pqpqvFWLk+yeb+sXnc2BJZj6TEXlA4LFMEBpNTUdAt5qFF2YncftLxi3
2qpVfg4nH2nWlqR20tCuD5JsckMUAJ3cCy33xBH0mK0+hSXIpT0nC/Sepn/5856P
9vHnNNF42GbSX8X4ePKcudP9D0LSEXTrjmpcECUDX1i9Lq471yMKCXvlk3CYL/Dm
BCJ63Xp6kvdFjK45O75LEAg/Wr5trODE4nNOI2+osD0hIpRUOS8=
=fAXc
-----END PGP SIGNATURE-----