bitwarden: MESA: error: Failed to query drm device (intel/no3d)

[hellodword]

I'm using the latest commit of firejail on NixOS with Sway, running on an Intel machine without a dedicated GPU.

The version of Bitwarden Desktop I’m using is 2024.8.1.

Running firejail --ignore=no3d '--profile=/path/to/bitwarden.profile' -- "/path/to/bitwarden" works perfectly for me.

However, when I run firejail '--profile=/path/to/bitwarden.profile' -- "/path/to/bitwarden" , Bitwarden fails to display its UI elements and I encounter the following errors:

MESA: error: Failed to query drm device.
glx: failed to create dri3 screen
failed to load driver: iris

I would like to understand how no3d works and what attack surface it mitigates. Additionally, how can I optimize and minimize the firejail profile instead of simply ignoring no3d?

Relates to:

• flameshot: MESA: error: Failed to query drm device (intel/no3d) #6465

[rusty-snake]

I would like to understand how no3d works

blacklist /dev/dri (intel, amd, nouveau?) and nvidia stuff

what attack surface it mitigates.

Access to hardware accelerated rendering/decoding (GPU). Otherwise software rendering/decoding (CPU) should be used.

Additionally, how can I optimize and minimize the firejail profile instead of simply ignoring no3d?

Not really if you're on a nvidia-free systemd system. Then it's just allow/deny /dev/dri. If you want to fine-tune things there, you need to create a virtual GPU and pipe to/from it.

[hellodword]

Thanks!

[kmk3]

@hellodword on Sep 6:

Bitwarden fails to display its UI elements and I encounter the following errors:

MESA: error: Failed to query drm device.
glx: failed to create dri3 screen
failed to load driver: iris

I'd expect most programs to just fallback to CPU rendering and work normally
when a GPU is not available.

Please consider reporting this also to bitwarden (and NixOS/sway/mesa if
relevant) and linking it here.

[kmille]

If I use firejail (main) and keepassxc:

...
MESA: error: Failed to query drm device.
glx: failed to create dri3 screen
failed to load driver: iris
failed to open /dev/dri/card1: Permission denied
failed to open /dev/dri/card1: Permission denied
failed to load driver: iris

Keepassxc does not show up, but the process is running. Any hints how how to debug?

[rusty-snake]

Any hints how how to debug?

Comment the profile line by line to find the problematic line.

Or read OP: Running firejail --ignore=no3d '--profile=/path/to/bitwarden.profile' -- "/path/to/bitwarden" works perfectly for me.

[kmille]

Thanks. That solved the issue. Sorry for not reading it correctly. But need it definitely for my KeepassXC since my last update.