Fix Spotify and misc Electron apps under firejail

[reedriley]

I believe this fixes #153430 and other related issues.

I haven't confirmed if this is a complete fix for discord - but I have confirmed that it fixes at least spotify and signal-desktop.

Motivation for this change

See #153430; something about how firejail sets up the private-etc mount requires a workaround for a large number of applications.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.05 Release Notes (or backporting 21.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[vs49688]

I'm apprehensive about this, it's why I didn't send a PR when I posted the workaround originally. It's hacky. This should be fixed in Firejail itself.

Could you please file this as an issue with Firejail?
I'd do it myself, but I don't have any of the affected applications installed currently.

[reedriley]

@vs49688: That's a totally fair point.

And after poking around a bit; it looks like this might be a legit firejail bug. Specifically; if /etc/fonts is a symlink to a directory, then the /run/firejail/lib/fcopy invocation doesn't resolve it to a directory before deciding whether to copy it or copy files from it.

[reedriley]

Filed this issue to discuss with firejail devs: netblue30/firejail#4887

[vs49688]

Superseded by #153430