vlc: playlist export error: Permission denied

[YASOONA]

Hello,

I'm new to Firejail and a "experienced beginner" when it comes to Linux.
I ran into problems with Firejail. One of them is VLC.

Environment:

• Mx Linux 23.2 Minimal version (Debian)
• Firejail 0.9.72-2
• Firetools 0.9.72-1

When I run firejail vlc, I get the following error:

$ firejail vlc
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Warning: networking feature is disabled in Firejail configuration file

** Note: you can use --noprofile to disable default.profile **

Parent pid 4825, child pid 4826
Child process initialized in 72.65 ms
VLC media player 3.0.21 Vetinari (revision 3.0.21-0-gdd8bfdbabe8)
[00005582fdc85550] main libvlc error: cannot open config file (/home/UserMe/.config/vlc/vlcrc): Permission denied
[00005582fdc85550] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
[00005582fdd16400] main playlist: playlist is empty
[00005582fdd35f40] main playlist export error: could not create playlist file /home/UserMe/.local/share/vlc/ml.xspf.tmp5: Permission denied

I also get:

$ ls -l /home/UserMe/.config/vlc/vlcrc
-rw-r--r-- 1 UserMe UserMe [...]
$ ls -l /home/Userxxxx/.local/share/vlc/ml.xspf
-rw-r--r-- 1 UserMe UserMe [...]

I can add and remove files from /home/UserMe/.config/vlc/.

After firejail --noprofile vlc, VLC will open normally.

Any idea what is going wrong here? Thanks!

[glitsj16]

Reading profile /etc/firejail/default.profile

That output indicates that vlc is not running its dedicated /etc/firejail/vlc.profile. And as /etc/firejail/default.profile does not grant access to vlc's configuration files in ${HOME}/.config/vlc, ot errors out.

If you or your OS uses firecfg for easy desktop integration, that creates symlinks in /usr/local/bin, for example /usr/local/bin/vlc. Because this location has precedence in your $PATH over /usr/bin, it forces vlc to be run in a firejail sandbox. The side-effect though is that when you want to run vlc from command line with firejail, you must use its absolute path.

Please post the output of the below commands:

$ which -a vlc

$ firejail /usr/bin/vlc

HTH

[YASOONA]

Not sure what it al means but thanks.

$ which -a vlc
/usr/bin/vlc
/bin/vlc

$ firejail /usr/bin/vlc
Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Warning: networking feature is disabled in Firejail configuration file

** Note: you can use --noprofile to disable default.profile **

Parent pid 2820, child pid 2821
Child process initialized in 87.29 ms
VLC media player 3.0.21 Vetinari (revision 3.0.21-0-gdd8bfdbabe8)
[0000563cc86e3550] main libvlc error: cannot open config file (/home/UserMe/.config/vlc/vlcrc): Permission denied
[0000563cc86e3550] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
[0000563cc8774400] main playlist: playlist is empty

After closing VLC:

[0000563cc8793f40] main playlist export error: could not create playlist file /home/UserMe/.local/share/vlc/ml.xspf.tmp6: Permission denied

Parent is shutting down, bye...

[glitsj16]

Seems like your firejail setup is incomplete. I'm not familiar with Mx Linux, but as it is a Debian derivative it is very likely you need to install firejail-profiles. Debian packages the dedicated sandbox profiles in a separate package, and that seems to be missing on your machine.

After installing that package, run sudo firecfg so all the needed symlinks and desktop integration are in place. Currently things are not 'automagically' sandboxed on your machine, beware of that.

[YASOONA]

Thanks! After installing that package and running sudo firecfg I got:

$ sudo firecfg
Removing all firejail symlinks:
 
Configuring symlinks in /usr/local/bin based on firecfg.config 
   baobab created
   conky created
   cvlc created
   display created
   display-im6.q16 created
   dnsmasq created
   file-roller created
   gapplication created
   host created
   libreoffice created
   librewolf created
   lobase created
   localc created
   lodraw created
   loffice created
   lofromtemplate created
   loimpress created
   lomath created
   loweb created
   lowriter created
   man created
   onboard created
   patch created
   pavucontrol created
   photoflare created
   ping created
   soffice created
   ssh created
   strings created
   thunderbird created
   torbrowser-launcher created
   vlc created
   wget created
   whois created
   xcalc created
   xfce4-screenshooter created

Adding user UserMe to Firejail access database in /etc/firejail/firejail.users
Creating /etc/firejail/firejail.users

Fixing desktop files in /home/UserMe/.local/share/applications
   librewolf.desktop created
   org.gnome.baobab.desktop created
   vlc.desktop created
   thunderbird.desktop created
UserMe@xxxxxx:~
$ firejail vlc
Reading profile /etc/firejail/vlc.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-player-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 2996, child pid 3000
5 programs installed in 9.29 ms
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: Cannot confine the application using AppArmor.
Maybe firejail-default AppArmor profile is not loaded into the kernel.
As root, run "aa-enforce firejail-default" to load it.
Child process initialized in 158.88 ms
VLC media player 3.0.21 Vetinari (revision 3.0.21-0-gdd8bfdbabe8)
[000055aeb1acf550] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.

(vlc:15): dbind-WARNING **: 08:15:55.398: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: File or folder doesn't exist
[000055aeb1b6ae80] main playlist: playlist is empty

[kmk3]

Thanks! After installing that package and running sudo firecfg I got:

[...]
UserMe@xxxxxx:~
$ firejail vlc
[...]
VLC media player 3.0.21 Vetinari (revision 3.0.21-0-gdd8bfdbabe8)
[000055aeb1acf550] main libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.

(vlc:15): dbind-WARNING **: 08:15:55.398: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: File or folder doesn't exist
[000055aeb1b6ae80] main playlist: playlist is empty

So does it work now?

[YASOONA]

It seems to work now. Just wanted to know if the above warnings mean anything, or can I ignore them? AppArmor is not installed BTW, so this one can be ignored anyway. Thanks.

[kmk3]

It seems to work now. Just wanted to know if the above warnings mean
anything, or can I ignore them? AppArmor is not installed BTW, so this one
can be ignored anyway. Thanks.

Warning: networking feature is disabled in Firejail configuration file

It depends on what you're trying to do, but it's probably not a good idea to
disable it unless you know what you're doing; feel free to open a discussion
about it if you're unsure.

Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.

Use net <your network interface> or net none in vlc.local if you don't need
networking.

Warning: cleaning all supplementary groups

Ignore this.

(vlc:15): dbind-WARNING **: 08:15:55.398: Couldn't connect to accessibility bus: Failed to connect to socket /run/user/1000/at-spi/bus_0: File or folder doesn't exist

I think that this warning is relatively common; it should be fine unless you
use screen readers or something similar.

[kmk3]

@YASOONA

(Offtopic)

Please see the following links for how to format code blocks in markdown:

• https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/creating-and-highlighting-code-blocks
• https://github.github.com/gfm/#fenced-code-blocks