1755180 - VA-API does not work in Flatpak. libva error: dlopen of /usr/lib/x86_64-linux-gnu/dri/intel-vaapi-driver/i965_drv_video.so failed: libdrm_intel.so.1: cannot open shared object file: No such file or directory

Status: RESOLVED WORKSFORME

(Core :: Security: Process Sandboxing, defect, P3)

Description

[godvino]

Attachment: Firefox logs with MOZ_SANDBOX_LOGGING=1 LD_DEBUG=libs MOZ_LOG="PlatformDecoderModule:5"

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:97.0) Gecko/20100101 Firefox/97.0

Steps to reproduce:

Run Firefox 97 from Flathub with media.ffmpeg.vaapi.enabled set to true and MOZ_ENABLE_WAYLAND=1 and play a video in a wayland session (GNOME 41 on Fedora Silverblue 35)

Actual results:

va-api fails with libva error: dlopen of /usr/lib/x86_64-linux-gnu/dri/intel-vaapi-driver/i965_drv_video.so failed: libdrm_intel.so.1: cannot open shared object file: No such file or directory. But libdrm_intel.so.1 is present at /usr/lib/x86_64-linux-gnu/GL/default/lib/libdrm_intel.so.1 inside the flatpak sandbox and running Firefox with MOZ_DISABLE_RDD_SANDBOX=1 makes va-api work (verified with intel_gpu_top). Running ldconfig -p inside the Flatpak sandbox does list libdrm_intel.so.1 (libc6,x86-64) => /usr/lib/x86_64-linux-gnu/GL/default/lib/libdrm_intel.so.1

Expected results:

va-api should have worked without any error. I have attached logs of Firefox run with MOZ_SANDBOX_LOGGING=1 LD_DEBUG=libs MOZ_LOG="PlatformDecoderModule:5" (with and without MOZ_DISABLE_RDD_SANDBOX=1)

Comment 1

[godvino]

Attachment: Firefox logs with MOZ_SANDBOX_LOGGING=1 LD_DEBUG=libs MOZ_LOG="PlatformDecoderModule:5" MOZ_DISABLE_RDD_SANDBOX=1

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Gtk' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 3

[Teoh Han Hui]

Similarly:

libva info: VA-API version 1.12.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/radeonsi_drv_video.so
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/intel-vaapi-driver/radeonsi_drv_video.so
libva info: Trying to open /usr/lib/x86_64-linux-gnu/GL/lib/dri/radeonsi_drv_video.so
libva error: dlopen of /usr/lib/x86_64-linux-gnu/GL/lib/dri/radeonsi_drv_video.so failed: libLLVM-12.so: cannot open shared object file: No such file or directory
libva info: va_openDriver() returns -1

Comment 4

[Robert Mader [:rmader]]

IIRC this was fixed in Firefox 98 (current beta), together with many other problems. As hardware acceleration is a experimental feature the fix will not get backported to stable, so I'm afraid this is a wont-fix for 97. If hardware decoding is very important for you, you can update to beta via the flathub beta repo: flatpak remote-add flathub-beta https://flathub.org/beta-repo/flathub-beta.flatpakrepo (it works here, using the iHD_drv_video.so driver though).

Comment 5

[Teoh Han Hui]

Attachment: flatpak firefox 98.0b4

Using the same MOZ_SANDBOX_LOGGING=1 LD_DEBUG=libs MOZ_LOG="PlatformDecoderModule:5" as above, this is what I get with the flatpak version of Firefox 98.0b4

It's not even trying the correct radeonsi_drv_video.so (/usr/lib/x86_64-linux-gnu/GL/default/lib/dri/radeonsi_drv_video.so)

Comment 6

[Teoh Han Hui]

Attachment: firefox flatpak 98.0b4 when playing h264 video

Sorry, this is the relevant part when trying to play a h264 video

Comment 7

[godvino]

I tried the beta version from flathub-beta (98) and am still getting the same error. But if I run the stable version of firefox from Flathub with the environment variable LD_PRELOAD=/usr/lib/x86_64-linux-gnu/GL/default/lib/libdrm_intel.so.1 VA_API starts working. WIth the beta version from flathub-beta I am getting Sandbox: seccomp sandbox violation: pid 505, tid 524, syscall 137, args 139871320709235 139871321318032 139871320744348 139871320752128 0 139871533183936.
Sandbox: seccomp sandbox violation: pid 505, tid 524, syscall 137, args 139871320709242 139871321318032 0 139871320752128 0 139871533183936.
on startup and VA_API doesnt work even with LD_PRELOAD.

Comment 8

[Jan Horak [:jhorak]]

It works for me on Fedora 34 and Firefox 97 from flathub out of the box with org.freedesktop.Platform.VAAPI.Intel extension installed:

[📦 org.mozilla.firefox ~]$ firefox
Gtk-Message: 14:33:11.426: Failed to load module "canberra-gtk-module"
Gtk-Message: 14:33:11.426: Failed to load module "pk-gtk-module"
Gtk-Message: 14:33:11.426: Failed to load module "canberra-gtk-module"
Gtk-Message: 14:33:11.426: Failed to load module "pk-gtk-module"
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
ATTENTION: default value of option mesa_glthread overridden by environment.
libva info: VA-API version 1.12.0
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/iHD_drv_video.so
libva info: Trying to open /usr/lib/x86_64-linux-gnu/dri/intel-vaapi-driver/iHD_drv_video.so
libva info: Found init function __vaDriverInit_1_12
libva info: va_openDriver() returns 0

Comment 9

[[:estemal]]

I'm having the same problem as @teohhanhui, but not with flatpak.

Comment 10

[BugBot [:suhaib / :marco/ :calixte]]

The bug has a release status flag that shows some version of Firefox is affected, thus it will be considered confirmed.

Comment 11

[Robert Mader [:rmader]]

The sandbox issue was fixed a while ago, closing.