Bug 261927 – [GTK] V4L2 Hardware Decode does not work (Missing /dev/video*) (Flatpak Specific)

• Status: RESOLVED
• Resolution: MOVED
• Component: WebKitGTK

[Abhinav Praveen]

V4L2 Hardware Decode does not work on (only) the flatpak version of Epiphany. It does work on my (Gentoo) distribution package manager install. I start epiphany with `flatpak run --device=all org.gnome.Epiphany` and `flatpak info --show-permissions org.gnome.Epiphany` shows `devices=dri;all;`. I believe this is because `WebKitWebProcess` does not have access to `/dev/video*` inside its sub-sandbox even when the epiphany parent has access to this device.

The code that controls availability of these devices is: https://github.com/WebKit/WebKit/blob/bcba489ee3565d49032694ec6bd67912fdfae6bb/Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp#L51 . For GStreamer's V4L2 Decode to work, ideally, if the webkit application (in this case epiphany), has permissions to enable access to `/dev/video*` (currently it has `devices=all;` permissions), then the sub-sandbox for `WebKitWebProcess` should be allowed access to these `/dev/video*` devices.

As WebKit is AFAIK, the only browser engine on Linux that supports hardware decode on Rockchip devices (RK3399 (mainline support) and potentially soon RK3588 (not yet mainlined)) it would be nice if this is fixed for the Flatpak version.

Related issues:
https://github.com/flatpak/flatpak/issues/5524
https://gitlab.gnome.org/GNOME/epiphany/-/issues/2183

A suitable test video is:
https://www.youtube.com/watch?v=aqz-KE-bpKQ

Flatpak Versions (broken HW decode):
- Epiphany: 44.6
- WebKitGTK: 2.40.4
- GStreamer: 1.20.6
- Distributor: Flathub

System Versions (working HW decode): 
- Epiphany: 44.2
- WebKitGTK: 2.40.1
- GStreamer: 1.20.4
- Distributor: Gentoo

[Michael Catanzaro]

So I've been thinking about this more....

> I start epiphany with `flatpak run --device=all org.gnome.Epiphany`

We're not going to run the web process with --device=all (or --filesystem=, which could also be used to mount /dev/video* devices).

I'm thinking nobody has yet considered how hardware-accelerated video decoding is supposed to work for Flatpak applications. If access to /dev/video* is not security-sensitive, then Flatpak should just mount it automatically IMO. But I'm guessing it's moderately-sensitive, in which case a new permission, say --device=video, would make sense: we would use the new permission when launching the web process, then it would work if the application itself also uses the same permission. Another option *might* be a new desktop portal, but I'm thinking that's probably not suitable for this.

[Michael Catanzaro]

I finally noticed your flatpak issue https://github.com/flatpak/flatpak/issues/5524 that you linked to above. Let's discuss there.

[Michael Catanzaro]

Hi, I'm going to close this with MOVED status for the time being. When the flatpak issue is fixed, then feel free to reopen this issue and we can add a new permission --device=video or --device=videocodes (or whatever it gets named) to the flatpak-spawn command used to launch the web process in FlatpakLauncher.cpp.

I'm not willing to add any --filesystem permissions or --device=all to the web process, so there is nothing more to done here in WebKit until Flatpak provides a new permission for this.