Subject: Re: [bug#77827] Video playback still fails with 4fd529d

From: Ian Eure <[email-masked]>
Date: Sat, 19 Apr 2025 15:45:12 -0700

Hi Jussi,

Jussi Timperi <[email-masked]> writes:

> Hi,
>
> On 19 April 2025 21:32, Julian Flake <[email-masked]> wrote:
>
>> --8<---------------cut 
>> here---------------start------------->8---
>> ➜  ~ librewolf
>> libva info: VA-API version 1.22.0
>> libva info: Trying to open 
>> /run/current-system/profile/lib/dri/iHD_drv_video.so
>> libva info: va_openDriver() returns -1
>> libva info: Trying to open 
>> /run/current-system/profile/lib/dri/i965_drv_video.so
>> libva info: va_openDriver() returns -1
>> --8<---------------cut 
>> here---------------end--------------->8---
>
> intel-vaapi-driver isn't whitelisted in the RDD sandbox, so it 
> will block
> opening the drivers. Running with MOZ_SANDBOX_LOGGING=1 will 
> show something
> like:
>
>     [30324] Sandbox: SandboxBroker: denied op=open 
>     rflags=2000000 perms=0 
>     path=/gnu/store/jji80qsrw6dm3zsgwxhz5301d5ww0ga8-intel-vaapi-driver-2.4.1/lib/dri/i965_drv_video.so 
>     for pid=30400
>     [30400] Sandbox: Failed errno -13 op open flags 02000000 
>     path /home/jussi/.guix-profile/lib/dri/i965_drv_video.so
>     [30324] Sandbox: SandboxBroker: denied op=access rflags=0 
>     perms=0 
>     path=/gnu/store/jji80qsrw6dm3zsgwxhz5301d5ww0ga8-intel-vaapi-driver-2.4.1/lib/dri/i965_drv_video.so 
>     for pid=30400
>     [30400] Sandbox: Failed errno -13 op access flags 00 path 
>     /home/jussi/.guix-profile/lib/dri/i965_drv_video.so
>     libva info: va_openDriver() returns -1
>
> HW video decoding working with MOZ_DISABLE_RDD_SANDBOX=1 further
> confirms it being the sandbox issue.
>
> Upstream solved it for Nix by whitelisting the entire 
> store[1]. As Ian
> mentioned, there's a patch in #72265[2] trying to do the same 
> for guix.

I pushed the patch provided in #72265, but reverted it, as I got 
bug reports about it breaking live video streams.  I’ve updated 
and reapplied the patch locally a few times, but it’s continued to 
exhibit that problem, _and_ it still complains about being unable 
to open the vaapi drivers with sandbox logging enabled.  The 
specific issue is that with hwaccel enabled, it can’t demux 
AAC-LATM audio streams.  Mullvadb and Torbrowser are both subject 
to this issue, I wrote up #77559 about what I found there, but 
haven’t gotten a response.

I have an idea here, I’ll patch things up a bit and see if the 
situation is improved.

I’m *also* experiencing serious graphics issues with 137.x.  The 
hamburger menu requires two clicks to open, other drop-down menus 
don’t open at all, and some sites exhibit graphical issues 
(flickering / corrupt graphics, scrolling up/down leaves pixel 
trails).  Are any of you seeing those issues?

Thanks,
  -- Ian