[Bug 1945100] [NEW] Widevine violates the sandbox and crashes

[Marcos Alano]

Public bug reported:

I just updated for Impish Indri beta release but Widevine is always crashing. With I disable the GMP sandbox it works fine.
Here is some console logs showing the violations:
```
➜ firefox --ProfileManager     
Gtk-Message: 09:58:02.539: Failed to load module "appmenu-gtk-module"

###!!! [Child][RunMessage] Error: Channel closing: too late to
send/recv, messages will be lost

Gtk-Message: 09:58:10.435: Failed to load module "appmenu-gtk-module"
Sandbox: attempt to open unexpected file /usr/lib/firefox/librt.so.1
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/librt.so.1
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v3/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v2/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/tls/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/tls/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/tls/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/tls/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64-linux-gnu/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v3/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v2/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/tls/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/tls/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/tls/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/tls/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64-linux-gnu/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/glibc-hwcaps/x86-64-v3/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/glibc-hwcaps/x86-64-v2/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/tls/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/tls/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/tls/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/tls/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /lib/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/glibc-hwcaps/x86-64-v3/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/glibc-hwcaps/x86-64-v2/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/tls/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/tls/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/tls/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/tls/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/haswell/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/haswell/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/x86_64/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.
Sandbox: attempt to open unexpected file /usr/lib/librt.so.1
Sandbox: seccomp sandbox violation: pid 24799, tid 24799, syscall 262, args 4294967196 140721817045120 140721817045312 0 4294967295 140721817045120.

###!!! [Parent][MessageChannel::Call] Error: Channel error: cannot
send/recv


###!!! [Parent][RunMessage] Error: Channel closing: too late to send/recv, messages will be lost

Sandbox: Unexpected EOF, op 0 flags 00 path /proc/cpuinfo
```
I'm using the .deb package version, not the Snap one.

** Affects: firefox (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Mozilla
Bugs, which is subscribed to firefox in Ubuntu.
https://bugs.launchpad.net/bugs/1945100

Title:
  Widevine violates the sandbox and crashes

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1945100/+subscriptions