firejail --appimage doesn't have supplementary groups required for device access

[amano-kenji]

Steps to Reproduce

1. Download https://github.com/DCurrent/openbor/releases/download/v6391/OpenBOR.v3.0.Build.6391.7z
2. Extract it
3. Go to LINUX/OpenBOR
4. Run LC_ALL=C firejail --appimage --noprofile ./OpenBOR_3.0_6391.AppImage
5. (Optional) Insert any .pak file from https://openborgames.com/ into Paks folder
6. (Optional) Open a game.
7. (Optional) Close the game.

Expected behavior

ALSA should work. Input devices like game pads should be recognized.

Actual behavior

Device availability is random. Devices are sometimes accessible. Sometimes, they are not.

Parent pid 26782, child pid 26785

** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl **

Mounting appimage type 2
Child process initialized in 17.45 ms
ALSA lib /path/to/alsa-lib-1.2.8/src/confmisc.c:165:(snd_config_get_card) Cannot get card index for D10s
ALSA lib /path/to/alsa-lib-1.2.8/src/confmisc.c:165:(snd_config_get_card) Cannot get card index for D10s

Game pads are sometimes recognized.

Additional context

I work around this issue by extracting files from appimage and executing the embedded executable directly with firejail.

Environment

• Linux distribution and version: Gentoo Linux
• Firejail version (firejail --version)

firejail version 0.9.72

Compile time support:
	- always force nonewprivs support is disabled
	- AppArmor support is enabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file transfer support is enabled
	- firetunnel support is disabled
	- IDS support is disabled
	- networking support is enabled
	- output logging is enabled
	- overlayfs support is disabled
	- private-home support is enabled
	- private-cache and tmpfs as user enabled
	- SELinux support is disabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

Checklist

• The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
• I can reproduce the issue without custom modifications (e.g. globals.local).
• The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
• The profile (and redirect profile if exists) hasn't already been fixed upstream.
• I have performed a short search for similar issues (to avoid opening a duplicate).
  • I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
• I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

[amano-kenji]

I finally found a way to get a shell inside appimage sandbox. I will figure out what went wrong.

[rusty-snake]

If ALSA requires permissions via supplementary groups, the usage of --appimagr is the cause.

[amano-kenji]

I discovered that with --appimage, I do not belong in audio group.
Without --appimage, I belong in audio group.
ALSA requires membership in audio group.

[amano-kenji]

I still don't understand how OpenBOR still has access to ALSA without being in audio group.
However, its access to ALSA is random at best.

Weirdly, game pads are available randomly in appimage sandbox.

[amano-kenji]

What can be done with --appimage, then?

[amano-kenji]

This is a duplicate of #4951