vlc: cannot play copy-protected dvds (private-dev)

[frank-github]

Hi,

Under firejail totem and vlc cannot play copy-protected DVDs.
Using distributed default configuration for totem or vlc.
Looks like vlc/totem can not find libdvdcss2/libdvdread8

If running totem/vlc without firejail, control DVDs running well.

How can I change the configurations so that libdvdcss2/libdvdread8 are found?

Linux debian 5.18.0-0.bpo.1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.2-1~bpo11+1 (2022-06-14) x86_64 GNU/Linux
firejail version 0.9.70-1~bpo11+1

bye, frank

Relates to:

• profiles: video: add ~/.dvdcss #6468

[reinerh]

I think libdvdcss stores the keys in ~/.dvdcss, which is not allowed in the current profile.
Can you try adding the following to totem.local?

mkdir ${HOME}/.dvdcss
whitelist ${HOME}/.dvdcss

[frank-github]

Hi, that does not help.

I found these messages when starting totem in a terminal:

libdvdread: Attempting to use device /dev/sr1 mounted on /media/frank/HP_AND_THE_PRISONER_OF_AZKABAN for CSS authentication
libdvdread: Could not open /dev/sr1 with libdvdcss.
libdvdread: Can't open /dev/sr1 for reading
libdvdread: Device /dev/sr1 inaccessible, CSS authentication not available.
libdvdread: Attempting to use device /dev/sr1 mounted on /media/frank/HP_AND_THE_PRISONER_OF_AZKABAN for CSS authentication
libdvdread: Could not open /dev/sr1 with libdvdcss.
libdvdread: Can't open /dev/sr1 for reading
libdvdread: Device /dev/sr1 inaccessible, CSS authentication not available.
libdvdnav: Can't read name block. Probably not a DVD-ROM device.
libdvdnav: vm: dvd_read_name failed

Maybe some more hints.

I'm running this debian in a VM.
if I use this VM on vmhost with the internal dvd-drive, totem/vlc can play dvd, even running under firejail.
if vmhost does not have an internal dvd-drive and I use an external usb-dvd-drive, totem/vlc can not play movie with firejail, but only without.

[reinerh]

Sounds like /dev/srX is not available in the jail. Can you try adding ignore private-dev to totem.local?

[reinerh]

Also it looks like the device is already mounted. That shouldn't be needed when playing a DVD. No idea if this might conflict.

[frank-github]

Hey you got it :-)

With these lines for vlc and totem, dvds are running now:

mkdir ${HOME}/.dvdcss
whitelist ${HOME}/.dvdcss
ignore private-dev

Does ignore private-dev have any disadvantages?

[reinerh]

Ok, I have no optical drive in my laptop currently, so I wasn't able to check how they are usually named. :)

[rusty-snake]

The problem is that we only mount sr0. Adding sr0..9 range, would fix it.

firejail/src/firejail/fs_dev.c

Line 80 in 393c5be

{"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players

[frank-github]

Though I think there is also a bug in firejail. According to the firejail-profiles manpage, private-dev should still allow disc drives, and there is an additional setting nodvd that could be used to forbid dvd drives.

I do not think it's a bug in general, because it works with internal dvd devices
my current laptop do not have a optical device anymore, so I have to use an external usb-device.
Only with this szenario firejail seems to have a problem

[reinerh]

The problem is that we only mount sr0. Adding sr0..9 range, would fix it.

Ah, nice finding! 👍

[frank-github]

The problem is that we only mount sr0. Adding sr0..9 range, would fix it.

I had wonder myself, why my external dvd device has sr1
at the moment it occurred to me why this is so.
my vm has a DVD device mounted by default, this is used when the VM host has an internal drive. So /dev/sr0 is already occupied.
Now when I connect the external DVD drive, this of course gets /dev/sr1

[kmk3]

@rusty-snake on Oct 2, 2022:

The problem is that we only mount sr0. Adding sr0..9 range, would fix it.

firejail/src/firejail/fs_dev.c

Line 80 in 393c5be

{"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players

This is being tracked at:

• Use wildcards for handling paths in /dev #2723

Which would probably make this use-case work with private-dev.

[kmk3]

@frank-github

Is ignore private-dev enough or do you actually need these lines for
vlc/totem?

mkdir ${HOME}/.dvdcss
whitelist ${HOME}/.dvdcss

It looks like ~/.dvdcss is just used for caching.

If it's needed, it should probably be added to vlc.profile and to other
profiles that might use use libdvdcss.

[frank-github]

Unfortunately, I can't really say for sure.
I haven't used my external DVD drive in a long time.