ALSA support should be improved.

[crocket]

When I installed Gentoo Linux, I blocked systemd and pulseaudio. I also wanted to block dbus, but I couldn't.

I have used ALSA for years. I may consider pipewire or jack, but pulseaudio's model seemed broken to me after having tried to make ALSA and pulseaudio do what I wanted for months. At least, ALSA and jack allowed me to do what I wanted without troubles because they have straightforward audio models. Pipewire seems to fix pulseaudio's broken audio model.

ALSA is still used by default in some distros, and ALSA support is still important.

I inserted

ignore nogroups

in ~/.config/firejail/globals.local. But, this wasn't documented anywhere. I had to search issues and pull requests to find this.

ALSA support should be better than a veteran linux user debugging the issue for hours and finally finding one line fix among issues and pull requests. Because the error messages were cryptic, I couldn't really know that sandboxed applications didn't have read/write access to /dev/snd.

At the very least, ways to make ALSA work should be documented somewhere conspicuous.

firejail is supposed to be easy. There is something wrong if using ALSA with firejail isn't easy. ALSA isn't something that isn't used anymore. It still has a userbase.

[rusty-snake]

I would say a FAQ point is good for now.

As a long-term we need something like override recipes for globals.local.
While it is good to place program specific overrides like for gnome-logs (Add 'ignore read-only ${HOME}' to your gnome-logs.local if you export logs to a file under your ${HOME}.) in the profile, we can not do this for global overrided templates like

• fcitx

  dbus-user.talk org.freedesktop.portal.Fcitx
  

• raw alsa

  ignore nogroups
  

• keyring

  dbus-user.talk org.freedesktop.secrets
  

[crocket]

I added https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions#why-is-there-no-sound-in-alsa-applications

[rusty-snake]

LGTM

Nitpick: Every system uses ALSA (if it has any speakers in use) nobody uses OSS.
Suggestions: raw ALSA (in the description)

And FYI: #2042

[crocket]

How would override recipe look like in firejail?

[rusty-snake]

How would override recipe look like in firejail?

IDK. I see nothing in my 🔮. Perhaps it would be a wiki page listing "you want A then add B".

[crocket]

I moved ALSA support to https://github.com/netblue30/firejail/wiki/Troubleshooting

[kmk3]

For reference, this issue and device access in general on non-(e)logind systems
should be fixed as of:

• Keep some groups regardless of nogroups and restore nogroups on nvidia #4725
• Fix keeping certain groups with nogroups #4732