copy protected DVDs don't play with vlc/totem and firejail

[frank-github]

Hi,

totem and vlc do not play copy protected DVDs, if totem or vlc are running under firejail control
using distributed default configuration for totem or vlc
looks like vlc/totem can not find libdvdcss2/libdvdread8

if running totem/vlc without firejail control DVDs running well.

how can I change the configurations that libdvdcss2/libdvdread8 are found?

Linux debian 5.18.0-0.bpo.1-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.2-1~bpo11+1 (2022-06-14) x86_64 GNU/Linux
firejail version 0.9.70-1~bpo11+1

bye, frank

[reinerh]

I think libdvdcss stores the keys in ~/.dvdcss, which is not allowed in the current profile.
Can you try adding the following to totem.local?

mkdir ${HOME}/.dvdcss
whitelist ${HOME}/.dvdcss

[frank-github]

Hi,
does not help

I found this messages starting totem in a terminal
libdvdread: Attempting to use device /dev/sr1 mounted on /media/frank/HP_AND_THE_PRISONER_OF_AZKABAN for CSS authentication libdvdread: Could not open /dev/sr1 with libdvdcss. libdvdread: Can't open /dev/sr1 for reading libdvdread: Device /dev/sr1 inaccessible, CSS authentication not available. libdvdread: Attempting to use device /dev/sr1 mounted on /media/frank/HP_AND_THE_PRISONER_OF_AZKABAN for CSS authentication libdvdread: Could not open /dev/sr1 with libdvdcss. libdvdread: Can't open /dev/sr1 for reading libdvdread: Device /dev/sr1 inaccessible, CSS authentication not available. libdvdnav: Can't read name block. Probably not a DVD-ROM device. libdvdnav: vm: dvd_read_name failed
maybe some more hints.
I'm running this debian in a vm,
if I use this vm on vmhost with internal dvd-drive, totem/vlc can play dvd, even running under firejail
if vmhost do not have an internal dvd-drive and I use an external usb-dvd-drive, totem/vlc can not play movie with firejail, but without

[reinerh]

Sounds like /dev/srX is not available in the jail. Can you try adding ignore private-dev to totem.local?

[reinerh]

Also it looks like the device is already mounted. That shouldn't be needed when playing a DVD. No idea if this might conflict.

[frank-github]

Hey you got it :-)

with this three lines for vlc and totem dvd are running now

mkdir ${HOME}/.dvdcss
whitelist ${HOME}/.dvdcss
ignore private-dev

do "ignore private-dev" have any disadvantage?

[reinerh]

Ok, I have no optical drive in my laptop currently, so I wasn't able to check how they are usually named. :)

[rusty-snake]

The problem is that we only mount sr0. Adding sr0..9 range, would fix it.

firejail/src/firejail/fs_dev.c

Line 80 in 393c5be

{"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players

[frank-github]

Though I think there is also a bug in firejail. According to the firejail-profiles manpage, private-dev should still allow disc drives, and there is an additional setting nodvd that could be used to forbid dvd drives.

I do not think it's a bug in general, because it works with internal dvd devices
my current laptop do not have a optical device anymore, so I have to use an external usb-device.
Only with this szenario firejail seems to have a problem

[reinerh]

The problem is that we only mount sr0. Adding sr0..9 range, would fix it.

Ah, nice finding! 👍

[frank-github]

The problem is that we only mount sr0. Adding sr0..9 range, would fix it.

I had wonder myself, why my external dvd device has sr1
at the moment it occurred to me why this is so.
my vm has a DVD device mounted by default, this is used when the VM host has an internal drive. So /dev/sr0 is already occupied.
Now when I connect the external DVD drive, this of course gets /dev/sr1