1

I would like to setup my Fedora Linux install so that I have control over outgoing traffic on a per application basis. In order to achieve this I have setup an firewall policy to drop everything from my default user account (the one I use to graphically log into the desktop), and allow everything from my second user account. I have then setup a pkexec policy to allow me to run Firefox as the second user from my default user account.

The problem I'm having with this setup is that sound doesn't work in Firefox when run as the second user from the default user account. My policy file is as follows:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
 "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
 "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
<policyconfig>

  <action id="org.firefox.user2">
    <description>Run the Firefox web browser</description>
    <message>Authentication is not required to run the Firefox web browser</message>
    <icon_name>firefox</icon_name>
    <defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/firefox</annotate>
    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
  </action>

</policyconfig>

Has anyone else out there tried to achieve something similar, and managed to get sound working?

Is there any danger in allowing no unauthorised access to Firefox, or should I be prompting for authorisation?

Is there another better way to achieve this?

Finally you may be asking why I want to do this.. well I used to be a Windows user and then for a short time an Ubuntu user and both OS's decided to data mine me. So I want control over outgoing traffic.

matt101
  • 13
  • 3
  • 99% of these kinds of problems in Linux are due to user permissions. Verify that the other user can use the sound utilities directly (vs. via Firefox). Check group membership. – fixer1234 Dec 05 '15 at 17:19
  • On Fedora also make sure that it is not forbidden by SELinux. Make sure it works for you in permissive mode. – Jakuje Dec 05 '15 at 21:42
  • Hello, thanks for the replies, I have verified and there is no issue with sound in Firefox when running it logged into the second user account. I will look into SELinux and how to check if it is denying anything (I am currently not familiar with it's operation). – matt101 Dec 06 '15 at 08:59
  • 1
    I was given the following solution by a user of another distro who claimed this made what I wanted work on said distro: ( default-server = /tmp/pulse.native in client.conf so every user can read the socket location and load-module module-native-protocol-unix srbchannel=1 auth-group=pulseaudio socket=/tmp/pulse.native in default.pa, then i can simply add an user to the pulseaudio group to have access to it, and libpulseaudio will make it seamless, i have it even running as systemd service ). This doesn't seem to work on Fedora, has anyone any ideas why? – matt101 Dec 06 '15 at 20:54

0 Answers0