IceCat lacks WebGL support

OpenSubmitted by Ludovic Courtès.
Details
5 participants
  • Jonathan Brielmaier
  • Julien Lepiller
  • Ludovic Courtès
  • Tobias Geerinckx-Rice
  • Ricardo Wurmus
Owner
unassigned
Severity
normal
L
L
Ludovic Courtès wrote on 19 Jan 2019 16:49
(name . Bug Guix)(address . bug-guix@gnu.org)
87o98cr6kx.fsf@gnu.org
Hello,
If you enable WebGL support in ‘about:config’, then stop it and run:
Toggle snippet (26 lines)$ export LIBGL_DRIVERS_PATH=$(guix build mesa)/lib/dri$ icecat https://get.webgl.org1547912837231 addons.webextension.tortm-browser-button@jeremybenthum WARN Please specify whether you want browser_style or not in your browser_action options.1547912837231 addons.webextension.https-everywhere@eff.org WARN Please specify whether you want browser_style or not in your browser_action options.1547912837232 addons.webextension.{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} WARN Please specify whether you want browser_style or not in your browser_action options.JavaScript warning: moz-extension://b84ee99d-7e50-4975-9d16-3806d330a3b2/lib/adblockplus.js, line 0: Successfully compiled asm.js code (total compilation time 1ms; not stored in cache (too small )libGL error: MESA-LOADER: failed to retrieve device informationlibGL error: unable to load driver: i915_dri.solibGL error: driver pointer missinglibGL error: failed to load driver: i915libGL error: MESA-LOADER: failed to retrieve device informationlibGL error: unable to load driver: i915_dri.solibGL error: driver pointer missinglibGL error: failed to load driver: i915libGL error: unable to load driver: swrast_dri.solibGL error: failed to load driver: swrastJavaScript warning: https://get.webgl.org/, line 193: Error: WebGL warning: Failed to create WebGL context: WebGL creation failed: * Error during native OpenGL init.* Exhausted GL driver caps.* Exhausted GL driver options.JavaScript warning: https://get.webgl.org/, line 197: Error: WebGL warning: Failed to create WebGL context: WebGL creation failed: * Error during native OpenGL init.* Exhausted GL driver caps.* Exhausted GL driver options.
and the web page reads:
While your browser seems to support WebGL, it is disabled or unavailable.
Weird thing is that glxgears and glxinfo (from ‘mesa-utils’) both workwell.
Thoughts?
Ludo’.
J
J
Julien Lepiller wrote on 19 Jan 2019 18:07
(address . 34135@debbugs.gnu.org)
20190119180750.13c17654@lepiller.eu
Le Sat, 19 Jan 2019 16:49:02 +0100,Ludovic Courtès <ludo@gnu.org> a écrit :
Toggle quote (51 lines)> Hello,> > If you enable WebGL support in ‘about:config’, then stop it and run:> > --8<---------------cut here---------------start------------->8---> $ export LIBGL_DRIVERS_PATH=$(guix build mesa)/lib/dri> $ icecat https://get.webgl.org> 1547912837231> addons.webextension.tortm-browser-button@jeremybenthum WARN> Please specify whether you want browser_style or not in your> browser_action options. 1547912837231> addons.webextension.https-everywhere@eff.org WARN Please> specify whether you want browser_style or not in your browser_action> options. 1547912837232> addons.webextension.{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}> WARN Please specify whether you want browser_style or not in your> browser_action options. JavaScript warning:> moz-extension://b84ee99d-7e50-4975-9d16-3806d330a3b2/lib/adblockplus.js,> line 0: Successfully compiled asm.js code (total compilation time> 1ms; not stored in cache (too small ) libGL error: MESA-LOADER:> failed to retrieve device information libGL error: unable to load> driver: i915_dri.so libGL error: driver pointer missing libGL error:> failed to load driver: i915 libGL error: MESA-LOADER: failed to> retrieve device information libGL error: unable to load driver:> i915_dri.so libGL error: driver pointer missing libGL error: failed> to load driver: i915 libGL error: unable to load driver:> swrast_dri.so libGL error: failed to load driver: swrast JavaScript> warning: https://get.webgl.org/, line 193: Error: WebGL warning:> Failed to create WebGL context: WebGL creation failed: > * Error during native OpenGL init.> * Exhausted GL driver caps.> * Exhausted GL driver options.> JavaScript warning: https://get.webgl.org/, line 197: Error: WebGL> warning: Failed to create WebGL context: WebGL creation failed: > * Error during native OpenGL init.> * Exhausted GL driver caps.> * Exhausted GL driver options.> --8<---------------cut here---------------end--------------->8---> > and the web page reads:> > While your browser seems to support WebGL, it is disabled or> unavailable.> > Weird thing is that glxgears and glxinfo (from ‘mesa-utils’) both work> well.> > Thoughts?> > Ludo’.
Try setting security.sandbox.content.read_path_whitelist to /gnu/store/(with a leading /) in about:config.
L
L
Ludovic Courtès wrote on 20 Jan 2019 23:45
(name . Julien Lepiller)(address . julien@lepiller.eu)(address . 34135@debbugs.gnu.org)
87womzlzhm.fsf@gnu.org
Hi Julien,
Julien Lepiller <julien@lepiller.eu> skribis:
Toggle quote (3 lines)> Try setting security.sandbox.content.read_path_whitelist to /gnu/store/> (with a leading /) in about:config.
Setting it to “/gnu/store/” (with a trailing slash) works, thank you!
It turns out that setting LIBGL_DRIVERS_PATH is even unnecessary.
I suppose we should patch the default value of‘security.sandbox.content.read_path_whitelist’ in our package. What dopeople think?
Thanks,Ludo’.
R
R
Ricardo Wurmus wrote on 21 Jan 2019 09:24
(name . Ludovic Courtès)(address . ludo@gnu.org)
87d0oqe7u2.fsf@elephly.net
Ludovic Courtès <ludo@gnu.org> writes:
Toggle quote (15 lines)> Hi Julien,>> Julien Lepiller <julien@lepiller.eu> skribis:>>> Try setting security.sandbox.content.read_path_whitelist to /gnu/store/>> (with a leading /) in about:config.>> Setting it to “/gnu/store/” (with a trailing slash) works, thank you!>> It turns out that setting LIBGL_DRIVERS_PATH is even unnecessary.>> I suppose we should patch the default value of> ‘security.sandbox.content.read_path_whitelist’ in our package. What do> people think?
It isn’t much of a sandbox if all of /gnu/store would be permitted. Canthis be reduced to the paths of store items that are known at buildtime?
-- Ricardo
J
J
Julien Lepiller wrote on 21 Jan 2019 09:49
(address . 34135@debbugs.gnu.org)
7A88B01C-EAB9-47BA-98EC-16F91C7993E7@lepiller.eu
Le 21 janvier 2019 09:24:53 GMT+01:00, Ricardo Wurmus <rekado@elephly.net> a écrit :
Toggle quote (25 lines)>>Ludovic Courtès <ludo@gnu.org> writes:>>> Hi Julien,>>>> Julien Lepiller <julien@lepiller.eu> skribis:>>>>> Try setting security.sandbox.content.read_path_whitelist to>/gnu/store/>>> (with a leading /) in about:config.>>>> Setting it to “/gnu/store/” (with a trailing slash) works, thank you!>>>> It turns out that setting LIBGL_DRIVERS_PATH is even unnecessary.>>>> I suppose we should patch the default value of>> ‘security.sandbox.content.read_path_whitelist’ in our package. What>do>> people think?>>It isn’t much of a sandbox if all of /gnu/store would be permitted. >Can>this be reduced to the paths of store items that are known at build>time?
You'll have to list every library and there dependencies. Is that possible? Also I think icecat has read permission to /usr by default, so setting permission to the store is similar.
L
L
Ludovic Courtès wrote on 21 Jan 2019 10:54
(name . Julien Lepiller)(address . julien@lepiller.eu)
874la2l4j3.fsf@gnu.org
Julien Lepiller <julien@lepiller.eu> skribis:
Toggle quote (29 lines)> Le 21 janvier 2019 09:24:53 GMT+01:00, Ricardo Wurmus <rekado@elephly.net> a écrit :>>>>Ludovic Courtès <ludo@gnu.org> writes:>>>>> Hi Julien,>>>>>> Julien Lepiller <julien@lepiller.eu> skribis:>>>>>>> Try setting security.sandbox.content.read_path_whitelist to>>/gnu/store/>>>> (with a leading /) in about:config.>>>>>> Setting it to “/gnu/store/” (with a trailing slash) works, thank you!>>>>>> It turns out that setting LIBGL_DRIVERS_PATH is even unnecessary.>>>>>> I suppose we should patch the default value of>>> ‘security.sandbox.content.read_path_whitelist’ in our package. What>>do>>> people think?>>>>It isn’t much of a sandbox if all of /gnu/store would be permitted. >>Can>>this be reduced to the paths of store items that are known at build>>time?>> You'll have to list every library and there dependencies. Is that> possible?
That would be possible, yes, though we’d have the build-timedependencies rather than the run-time dependencies (since we cannot knowthe run-time dependencies until IceCat is built.)
That said putting all of /gnu/store wouldn’t be that bad I think—atleast user data remains inaccessible, which is much better than exposing/usr on FHS distros.
Thoughts?
Ludo’.
R
R
Ricardo Wurmus wrote on 21 Jan 2019 15:12
(name . Ludovic Courtès)(address . ludo@gnu.org)
87bm4adrqa.fsf@elephly.net
Ludovic Courtès <ludo@gnu.org> writes:
Toggle quote (6 lines)> That said putting all of /gnu/store wouldn’t be that bad I think—at> least user data remains inaccessible, which is much better than exposing> /usr on FHS distros.>> Thoughts?
Sounds fine to me then.
-- Ricardo
J
J
Jonathan Brielmaier wrote on 12 May 20:19 +0200
IceCat lacks WebGL support
(address . 34135@debbugs.gnu.org)
195c017f-1a5e-6d6a-1cc0-d0ad63849b93@web.de
429c8284d232c3f9fbe3dc87a3da323f3a864c03 did preliminary work for ffmpegwhite listing. So we need to add the WebGL required stuff as well tothat whitelist. I'll see what I can do.
J
J
Jonathan Brielmaier wrote on 17 May 22:24 +0200
(address . 34135@debbugs.gnu.org)
d1ef0d73-93dd-b8c4-9045-58196a3eed3a@web.de
I tried a little around with WebGL today but couldn't get any further.
Setting```webgl.disabled.falsewebgl.msaa-force;truesecurity.sandbox.content.read_path_whitelist;/gnu/store/```
doesn't help. Not even `security.sandbox.content.level;0` changedanything for the good.
So it still says:```JavaScript warning: https://get.webgl.org/,line 197: Error: WebGLwarning: <SetDimensions>: Failed to create WebGL context: WebGL creationfailed:* Refused to create native OpenGL context because of blacklist entry:FEATURE_FAILURE_GLXTEST_FAILED* Exhausted GL driver options.```
I'm on an intel laptop with i965 driver.
J
J
Jonathan Brielmaier wrote on 17 May 22:44 +0200
(address . 34135@debbugs.gnu.org)
23cb317a-0573-e204-eaa9-cc3bdd97d512@web.de
Ah I forgot to mention all the bug reports on the net which are maybecorrelated to this bug.
There seems to be an issue with libdrm-2.4.101 but Guix is still onlibdrm-2.4.100:https://gitlab.freedesktop.org/mesa/drm/-/issues/39The Mozilla upstream bug ishttps://bugzilla.mozilla.org/show_bug.cgi?id=1623885
I also found a bug about hardware acceleration requires LLVM to bewhitelisted, but I couldn't find any "Permission denied" errors in thelogs. While running Icecat with `MOZ_SANDBOX_LOGGING=1` set.https://github.com/netblue30/firejail/issues/2106
T
T
Tobias Geerinckx-Rice wrote on 23 May 23:14 +0200
(name . Jonathan Brielmaier)(address . jonathan.brielmaier@web.de)
875zcmtkv5.fsf@nckx
Jonathan,
Jonathan Brielmaier 写道:
Toggle quote (3 lines)> I tried a little around with WebGL today but couldn't get any > further.
Try this:
- install mesa- export LD_LIBRARY_PATH="$HOME/.guix-profile/lib"- set webgl.disabled = false- set security.sandbox.content.read_path_whitelist = /gnu/store/ (the trailing slash seems to be significant, but you knew that already)
Works for me,
T G-R
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQT12iAyS4c9C3o4dnINsP+IT1VteQUCXsmSHgAKCRANsP+IT1VteXeIAQDiPSNC3pPexiiKr8JiUeTF6onkSvj89YHH0mrzeztXYQEAwuKJjossJxyTNDbRQQcx2/A+A+BbL86HOI1WJ3Bs4g8==d637-----END PGP SIGNATURE-----
J
J
Jonathan Brielmaier wrote on 24 May 00:02 +0200
(name . Tobias Geerinckx-Rice)(address . me@tobias.gr)
9d8a5734-ed0b-ad51-c894-96a3042caef5@web.de
On 23.05.20 23:14, Tobias Geerinckx-Rice wrote:
Toggle quote (15 lines)> Jonathan,>> Jonathan Brielmaier 写道:>> I tried a little around with WebGL today but couldn't get any further.>> Try this:>> - install mesa> - export LD_LIBRARY_PATH="$HOME/.guix-profile/lib"> - set webgl.disabled = false> - set security.sandbox.content.read_path_whitelist = /gnu/store/>  (the trailing slash seems to be significant, but you knew that  already)>> Works for me,
Works not for me :(
?