1772142 - Snap package fails to create VAAPI texture snapshot unless RDD sandbox is disabled

Status: RESOLVED FIXED

(Core :: Security: Process Sandboxing, defect, P2)

Description

[Kestrel]

Attachment: vaapi-snap-log.txt

Bug 1770407 fixed the non-Snap case for me but the Snap package of Nightly 103.0a1 still fails to use VAAPI unless the RDD sandbox is disabled (MOZ_DISABLE_RDD_SANDBOX=1). Ubuntu 22.04 Wayland.

[RDD 19685: MediaPDecoder #2]: D/PlatformDecoderModule Created new VA-API DMABufSurface UID = 2
[RDD 19685: MediaPDecoder #2]: D/PlatformDecoderModule VideoFrameSurface: creating surface UID = 2
[RDD 19685: MediaPDecoder #2]: D/Dmabuf DMABufSurfaceYUV::VerifyTextureCreation() UID 2
[RDD 19685: MediaPDecoder #2]: D/Dmabuf   failed to create snapshot GLContext
[RDD 19685: MediaPDecoder #2]: D/PlatformDecoderModule   failed to create texture over DMABuf memory!

EGL_MESA_platform_surfaceless is listed as available.

Snap package:
VA-API version 1.7.0
Mesa Gallium driver 21.2.6

Standard package:
VA-API version 1.14.0
Mesa Gallium driver 22.0.1

Comment 1

[Darkspirit]

Attachment: 1772142.txt

Confirmed with Gnome Wayland, Debian Testing, Macbook Pro, Intel:
According to intel_gpu_top, VAAPI only works if Nightly Snap is started with MOZ_DISABLE_RDD_SANDBOX=1.

$ sudo apt install snapd
$ snap install firefox --edge
$ MOZ_LOG="Dmabuf:5,PlatformDecoderModule:5" snap run firefox > 1772142.txt 2>&1
H264 test video: https://bug1619882.bmoattachments.org/attachment.cgi?id=9149605

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

In the attached log, everything seems to work as expected until this point (after the frame is decoded):

[RDD 25943: MediaPDecoder #2]: D/Dmabuf   failed to create snapshot GLContext
[RDD 25943: MediaPDecoder #2]: D/PlatformDecoderModule   failed to create texture over DMABuf memory!

I tried with MOZ_SANDBOX_LOGGING=1, and:

[RDD 77992: MediaPDecoder #2]: V/PlatformDecoderModule ReleaseVideoBufferWrapper: PlanarYCbCrImage=7f10debd27e0
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/void/libEGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/libEGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/x86_64-linux-gnu/libEGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/gnome-platform/lib/x86_64-linux-gnu/libEGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/firefox/libGLdispatch.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/lib/gl/libGLdispatch.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/lib/gl32/libGLdispatch.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/void/libGLdispatch.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/libGLdispatch.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/x86_64-linux-gnu/libGLdispatch.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/gnome-platform/lib/x86_64-linux-gnu/libGLdispatch.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/firefox/libGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/lib/gl/libGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/lib/gl32/libGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/void/libGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/libGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/x86_64-linux-gnu/libGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/gnome-platform/lib/x86_64-linux-gnu/libGL.so
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/firefox/libGLX.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/lib/gl/libGLX.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/lib/gl32/libGLX.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /var/lib/snapd/void/libGLX.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/libGLX.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/usr/lib/x86_64-linux-gnu/libGLX.so.0
Sandbox: Failed errno -2 op open flags 02000000 path /snap/firefox/1418/gnome-platform/lib/x86_64-linux-gnu/libGLX.so.0
Sandbox: SandboxBroker: denied op=open rflags=2204000 perms=0 path=/snap/firefox/1418/gnome-platform/usr/share/glvnd/egl_vendor.d for pid=77992
Sandbox: Failed errno -13 op open flags 02204000 path /snap/firefox/1418/gnome-platform/usr/share/glvnd/egl_vendor.d
[RDD 77992: MediaPDecoder #2]: D/Dmabuf   failed to create snapshot GLContext

Most of those are files that can't be opened because they don't exist, but /snap/firefox/1418/gnome-platform/usr/share/glvnd/egl_vendor.d is actually being denied, and does exist, and we'll need to allow it (and the files within it). It looks like (the equivalent of) $SNAP_DESKTOP_RUNTIME/usr/share/glvnd/egl_vendor.d is what we'd need. (I don't know if that env var is documented; $SNAP/gnome-platform might also work.)

Comment 3

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

…or, really, we could just allow reading the whole $SNAP_DESKTOP_RUNTIME / $SNAP/gnome-platform subtree; the contents of it would be public knowledge anyway, I'd expect.

Comment 4

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Attachment: Bug 1772142 - Fix the RDD sandbox to deal with Snap moving some config files.

In the Snap environment, some system config files aren't in their usual
places, but rather in a subtree rooted at $SNAP/gnome-platform,
which seems to also be $SNAP_DESKTOP_RUNTIME. This includes some
subdirectories of /usr/share that we need for EGL to work.

This could probably also have been fixed in the Snap packaging, given
that Mozilla's and Ubuntu's specs both put /usr/share/libdrm
back into its normal location, but for now it's easiest to adjust
the sandbox, given that (I think?) anything under $SNAP is public
information so we lose nothing by allowing read access. (See also bug
1732580.)

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7f88718e8d46
Fix the RDD sandbox to deal with Snap moving some config files. r=gcp

Comment 6

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/7f88718e8d46