Steam freezes on start #3267
Comments
|
First I was thinking that !$123 simplie does not work. So I check with Looks like you have a AMD GPU. see #3219. |
Thanks, I do indeed have AMDGPU and Mesa-19.3.4. If there's nothing wrong with the command, does Steam being a 32-bit executable perhaps affect the seccomp filters ? My system and most other applications are 64-bit (x86_64). |
|
Arch Linux Having the same issue with |
|
@TheOneric @polyzen can (one of) you try this:
|
|
@rusty-snake This improves the situation, but doesn't completely work. |
|
@TheOneric is anything in the journal? Has you tried to commet @topimiettinen looks like exceptions only working for the native arch. Is that wated? cf. |
syscalls 117(setresuid), 144(sched_setscheduler), 203(sched_setaffinity) and arch=c000003e(afaik x86_64). |
|
Typically only one arch is ever used and then you want to block the secondary archs. Steam is indeed an exception where 64-bit and 32-bit code is mixed (are there any others?). The problem here is that currently we can only translate system call names to numbers for the native arch. Ideally the user should be able to specify different filters for each arch, something like Also the error about Nothing impossible, but needs a bit thought. |
wine |
|
@TheOneric I get messed up with the seccomp groups, can you try again with this seccomp.drop. |
This one works without any visible problems, thanks. |
|
suggestion diff --git a/etc/steam.profile b/etc/steam.profile
index bc90af83..cd9bb745 100644
--- a/etc/steam.profile
+++ b/etc/steam.profile
@@ -38,8 +38,6 @@ include disable-programs.inc
include whitelist-var-common.inc
-# allow-debuggers needed for running some games with proton
-allow-debuggers
caps.drop all
#ipc-namespace
netfilter
@@ -54,9 +52,11 @@ nou2f
# novideo should be commented for VR
novideo
protocol unix,inet,inet6,netlink
-# seccomp cause sometimes issues (see #2860, #2951),
+# seccomp cause sometimes issues (see #2951, #3267),
# comment it or add 'ignore seccomp' to steam.local if so.
-seccomp
+# @default without kcmp, ptrace is needed by proton.
+# seccomp exception only work for the native architectur at the moment.
+seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,umount,userfaultfd,acct,bpf,chroot,mount,nfsservctl,pivot_root,setdomainname,sethostname,umount2,vhangup
shell none
# tracelog disabled as it breaks integrated browser
#tracelog |
|
I made a draft PR #3276 for this. |
System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Lists of supported system calls are also updated. Fixes part of netblue30#3267. Signed-off-by: Topi Miettinen <[email protected]>
System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Lists of supported system calls are also updated. Fixes part of netblue30#3267. Signed-off-by: Topi Miettinen <[email protected]>
System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Lists of supported system calls are also updated. Error out if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes netblue30#3267. Signed-off-by: Topi Miettinen <[email protected]>
System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes netblue30#3267. Signed-off-by: Topi Miettinen <[email protected]>
System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes netblue30#3267. Signed-off-by: Topi Miettinen <[email protected]>
System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes netblue30#3267. Signed-off-by: Topi Miettinen <[email protected]>
System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes netblue30#3267. Signed-off-by: Topi Miettinen <[email protected]>
`nogroups` should not have been causing issues with rendering on nvidia since commit 623e682 ("temporary fix for nvidia/nogroups/noroot issue (netblue30#3644, netblue30#841)", 2020-10-02) and commit cb460c3 ("more nvidia (netblue30#3644)", 2020-10-03), which had made it a no-op on nvidia. And the handling of the "render" and "video" groups are independent to the handling of `nogroups` now; see the previous 3 commits. Commits which introduced the comments on each profile: * kodi.profile: commit ce462b6 ("fix netblue30#3501", 2020-07-16) * mpsyt.profile: commit e17b48f ("new profile mpsyt.profile", 2018-11-28) * mpv.profile: commit cc7c489 ("Document netblue30#1945", 2018-07-25) * steam.profile: commit d6f8169 ("steam fixes; netblue30#841, netblue30#3267", 2020-03-15) Commands used to find the comments: git grep -i nvidia -- etc/profile-* | grep -v private-etc Relates to netblue30#4632.
and others
I checked recently opened and closed issues with steam beforehand, but couldn't find a solution. Apologies if I missed something and this has been reported before.
I used to run steam with
firejail --ignore=private-dev steamand it worked fine. Ignore private-dev is needed for my controller to work.However now starting steam like this will cause steam to hang up on start. A steam icon is in the tray, but cannot be interacted with, no window opens, but the programm doen't crash.
Using
-alllow-debuggersas suggested in another issue did nothing.--ignore-seccompdoes work. Checking journalctl I can see the blocked syscall is349, but using--seccomp=!$349does nothing and I would prefer to not disable seccomp completely.journalctl output:
I am using firejail 0.9.62 on Manjaro.
The text was updated successfully, but these errors were encountered: