mpv: lua plugins cannot load shared libraries

[hyiltiz]

See open-dynaMIX/simple-mpv-webui#106 for more detail.

Bug and expected behavior

• Please see above link.

No profile or disabling firejail

• What changed calling firejail --noprofile PROGRAM in a shell? Works.
• What changed calling the program by path=without firejail (check whereis PROGRAM, firejail --list, stat $programpath)? Works.

Reproduce
Steps to reproduce the behavior:

1. Run in bash firejail mpv a.mp3
2. See error ERROR (see above link).
3. Run /usr/bin/mpv a.mp3 so it works.

Environment

• Linux distribution and version (ie output of lsb_release -a) See above link.
• Firejail version (output of firejail --version) exclusive or used git commit (git rev-parse HEAD)

firejail version 0.9.62

Compile time support:
        - AppArmor support is enabled
        - AppImage support is enabled
        - chroot support is enabled
        - file and directory whitelisting support is enabled
        - file transfer support is enabled
        - firetunnel support is enabled
        - networking support is enabled
        - overlayfs support is enabled
        - private-home support is enabled
        - seccomp-bpf support is enabled
        - user namespace support is enabled
        - X11 sandboxing support is enabled

• What other programs interact with the affected program for the functionality? Mpv and lua libraries.
• Are these listed in the profile? Mpv profile: https://termbin.com/7cye

Additional context
Other context about the problem like related errors to understand the problem.

Checklist

• The upstream profile (and redirect profile if exists) have no changes fixing it.
• The upstream profile exists (find / -name 'firejail' 2>/dev/null/fd firejail to locate profiles ie in /usr/local/etc/firejail/PROGRAM.profile)
• Programs needed for interaction are listed.
• Error was checked in search engine and on issue list without success.

debug output

OUTPUT OF `firejail --debug PROGRAM`
This scraps way too much information that are tangential to the issue at hand. Reserving for privacy reasons. 

[rusty-snake]

Can you try firejail --whitelist=/usr/share/lua /usr/bin/mpv foo.mp3.

[hyiltiz]

Just tried. Exactly the same error.

[glitsj16]

@hyiltiz Compared to our current mpv profile, the version from 0.9.62 that you have blacklists Lua (by including disable-interpreters.inc). I think that's the cause of your issues. You can try adding the below in a mpv.local file and retest:

# Allow lua (blacklisted by disable-interpreters.inc)
include allow-lua.inc

whitelist /usr/share/lua
whitelist /usr/share/lua*
whitelist /usr/share/vulkan

[hyiltiz]

Hmm, pasting that to ~/.config/firejail/mpv.local fixed it, thanks!