steamwebhelper crashloops due to reading /run/current-system/sw/lib/libbeidpkcs11.so from ~/.pki/nssdb/pkcs11.txt on NixOS 24.05.20240323.44d0940 (Uakari) x86_64 #298662
Comments
|
Following bugreport is a duplicate of this one. That other bugreport contains a workaround (uninstalling eid-mw), but I would like this bug to be solved, as I would like to be able to use eid-mw and steam on the same PC at the same time.... |
That's... terrible. The package appears to be ancient and would not be accepted in its current state were it added today. It should not rely on any globally-installed shared library; that breaks just about every design decision in Nix. I can't help you with fixing that but doing it the Nix way would solve the issue. I do wonder how this global library path that nothing on NixOS should ever use for anything ends up being picked up by steam though; that appears to be the actionable bug here. |
|
@Atemu: thanks for your feedback. Indeed, could you maybe edit the Steam code so that it does not try to use libbeidpkcs11.so during startup? It would be best if Steam also ignores libpcsclite.so.1 (see logs above). Both libraries are used for accessing Belgian electronic ID cards. |
|
We'll first have to figure out how it even gets discovered by steam because that path is never explicitly passed to it AFAICT. What's your |
|
|
|
|
|
I do not understand how Steam discovers this path then. A quick hack could be to use an extraBwrapArg to mount a tmpfs at |
|
I only started using NixOS in June 2023. So compared to you, I am pretty much a novice :-) I am not sure how to perform that hack.... I think that reproducible builds - one of the many strengths of NixOS - should mean that the bugs should be reproducible as well, on (almost) any PC. If you install the steam package from nixpkgs, and then enable following configuration, you should be able to reproduce my issue on your PC as well. |
|
The problem is that I don't have your hardware or state or ability to use eid-mw in any way. The way to do what I suggested would be to set |
|
I configured the following: programs.steam = {
enable = true;
remotePlay.openFirewall = true; # Open ports in the firewall for Steam Remote Play
dedicatedServer.openFirewall = true; # Open ports in the firewall for Source Dedicated Server
package = pkgs.steam.override { extraBwrapArgs = [ "--tmpfs /run/current-system/sw/lib/" ]; };
};When I now try to launch steam, I get: Same for steam-run: |
|
Added following eid-mw specialists into this bug report, as it may be better to get this solved on the eid-mw side, not the steam package side.... : eid-mw maintainers: eid-mw contributor: If one of the maintainers above lives in Belgium and has an eid card reader, it would be great if that person tried to recreate this bug on their own PC. But to be honest, you don't even need an eid card reader, nor an eid card; you just need to install eid-mw as system package and install steam too..... Then steam will crashloop... |
|
I use both steam and eid-mw, and do not encounter this issue. One important difference though is that I use Firefox, so I don't do the nssdb step. Presumably steam's web helper is chromium based, which would explain how it picks up eid: through the nssdb. |
|
That leaves 2 options:
The instructions state: "To use eIDs in NSS-compatible browsers like Chrom{e,ium} or Firefox, each user must first execute: ~$ eid-nssdb add (Running the script once as root with the –system option enables eID support for all users, but will not work when using Chrom{e,ium}!) Before uninstalling this package, it is a very good idea to run ~$ eid-nssdb [–system] remove and remove all ~/.pki and/or /etc/pki directories no longer needed." If the instructions tell me to run eid-nssdb add and this causes a crashloop of steam, there clearly is a problem |
|
Maybe we should first verify that nssdb is the problem here? Can you follow the uninstall instructions and then check that steam starts up correctly? |
|
I added steam to my system and switched. It seems to be working. \\ \\ // myname@mysystem
==\\__\\/ // ---------
// \\// OS: NixOS x86_64
==// //== Host: LENOVO 21FAS0PU00
//\\___// Kernel: 6.7.10
// /\\ \\== Uptime: 1 day, 29 mins
// \\ \\ Packages: 1124 (nix-system), 2231 (nix-user)
Shell: zsh 5.9
Resolution: 3840x2400
WM: sway
Theme: Breeze [GTK2/3]
Icons: Papirus [GTK2/3]
Terminal: foot
CPU: 13th Gen Intel i9-13950HX (32) @ 5.300GHz
GPU: Intel Raptor Lake-S UHD Graphics
Memory: 50.38GiB / 125.45GiB (40%) I'm currently not using the Nvidia, it's on a specialisation for offload |
|
I tested on both my laptop and desktop PC. Running "eid-nssdb remove" solved the issue on both PCs, but that means support for chromium and brave browsers is removed. I would prefer option 1 (fixing the eid-nssdb code), so we don't depend on using just one webbrowser (firefox) @chvp : can you run "eid-nssdb add" and then launch steam to confirm that this bug is reproducible? |
|
Running |
|
OK, thanks for confirming the bug. |
|
Can one of the eid-mw maintainers maybe look into this tomorrow or Sunday? |
|
Sorry, forgot about this. I did some more investigating. It seems that |
|
I am no coding expert, especially in C++. But maybe it will help to analyze the following 11 code segments in the eid-mw source code that mention https://github.com/search?q=repo%3AFedict%2Feid-mw+libbeidpkcs11.so&type=code The coredump shows "./steamwebhelper --no-sandbox" So steamwebhelper is not running sandboxed. So I guess it is up to eid-mw to sandbox libbeidpkcs11.so. Of course, all of this could be obvious to you :-) |
|
As far as I could find, there's no way to configure NSS so that libbeidpkcs11.so gets picked up by e.g. chrome but not by steamwebhelper. The sandbox is not really relevant here, NSS runs outside of the sandbox anyway. |
|
Thanks for the feedback, Charlotte. @Atemu Question for the steam package maintainers: is it possible to create a package override for steam - programmed using the nix language - to force steam and steamwebhelper to skip/ignore any library file starting with libbeidpkcs11* ? I know it sounds like an ugly hack, but then it would solve my issue without having to adapt code in steamwebhelper/steam/eid-mw/eid-nssdb |
|
Only thing I could think of would be to bind-mount /dev/null atop of the nix store path of that so. The code of eid-mw/eid-nssdb needs to be changed anyways. |
|
I have written following ugly hack and added it as package to (pkgs.writeShellScriptBin "eid-card-reader-activation-script" ''
# See https://nixos.wiki/wiki/Web_eID
# kill all open browsers:
killall brave
killall chromium
killall firefox
killall .firefox-wrapped
# Following step PREVENTS crashloop of steam/steamwebhelper client:
rm -rf ~/.pki # delete NSSDB in case it is corrupted by previous operations
# Enable use of Belgian eid card reader in Chromium:
eid-nssdb add # this step CAUSES crashloop of steam/steamwebhelper client
eid-viewer
echo "retest eid card reader on www.cm.be using brave or chromium web browser"
brave www.cm.be
# Following step PREVENTS crashloop of steam/steamwebhelper client:
rm -rf ~/.pki # delete NSSDB in case it is corrupted by previous operations
# Launch steam and make sure steamwebhelper does not crashloop anymore:
steam
'') |
MarkRijckenberg
changed the title
|
After some more digging, I found the following as part of the steam install: steam-runtime-heavy.tar.xz and steam-runtime-sniper.tar.xz contain libnss3 (network security service libraries) Why do the steam-runtimes contain libnss3? libnss3 is useful for web browsers like chromium, but not for gaming clients. |
|
See which shows a link with pkcs11.txt |
Steam has a web browser, using Chromium Embedded Framework (CEF) |
|
Yes, I know that Steam has a web browser component, but do steam-runtime-heavy and SteamLinuxRuntime_sniper NEED libnss3 too? I am not saying to remove the web browser (chromium) component. I am asking to remove the web browser functionalities NOT needed for a gaming client.
|
|
Following documentation confirms that the libnss3 library reads from ~/.pki/nssdb/pkcs11.txt https://discourse.ubuntu.com/t/network-security-services-nss/35168 So as long as the steam client remains bundled with libnss3 (and related support for PKCS security modules), this bug will probably persist. |
|
@MarkRijckenberg Perhaps we could use libredirect to make either of these look in the nix store instead of the |
|
Using libredirect would be a workaround for a security function (PKCS) that should not be supported here in the first place. At least, that is my assumption. And nobody has contradicted me on this yet. If I am wrong in this assumption, please let me know! I looked at https://github.com/NixOS/nixpkgs/blob/master/pkgs/games/steam/steam.nix I would suggest 2 steps:
I support first principles thinking. The best component is no component. |
|
|
@K900 Thanks for your feedback. Does it mean I should close this issue here and reopen it on https://github.com/ValveSoftware/steam-for-linux/issues ? |
|
The issue should probably be reported to Valve, specifically to make them aware that Steam will load mismatched libraries through this specific escape hatch. |
|
@chvp : could you please implement the solution mentioned here? ValveSoftware/steam-runtime#667 This means: Simply replacing This solution means there is no need to adapt the nixpkgs documentation regarding the use of "eid-nssdb add" |
To solve following issues: ValveSoftware/steam-runtime#667 (comment) NixOS#298662 NixOS#309085
The OpenSC module claims it supports the Belgian eID card, but it only supports applet 1.7, not 1.8. The result is that users who have OpenSC installed may or may not successfully authenticate, depending on whether their browser prefers OpenSC over the eID software (or not). To avoid this situation, we can conflict with OpenSC. Users who need OpenSC for other things will hate us for that, but that can't be helped.
|
I have solved the crashlooping issue by performing a complete reinstall of the steam client on NixOS unstable. I ran rm -rf ~/.local/share/Steam |
FliegendeWurst
added
the
6.topic: steam
Describe the bug
steamwebhelper goes into a launch-crash-launch loop forever. This occurs with both nvidia and nouveau drivers.
steam never gets to the startup screen. Sometimes it gets to the login screen and when I type my username and password, the login screen crashes and steam simply opens a new login screen....
libbeidpkcs11.so (part of eid-mw ) causes crash of steamwebhelper on NixOS 24.05.20240323.44d0940 (Uakari) x86_64
See also
nixpkgs/pkgs/tools/security/eid-mw/eid-nssdb.in
Line 6 in 2735b57
Steps To Reproduce
Expected behavior
steam package and eid-mw package should be able to co-exist on the same NixOS 24.05 system. These are totally unrelated packages. steam should be able to launch fine, even if libbeidpkcs11.so is installed via eid-mw package
steamwebhelper should skip/ignore libbeidpkcs11.so which is used for Belgian eid cards.
libbeidpkcs11.so has nothing to do with steam.
Additional context
crashdump of steamwebhelper shows following error:
0x000075bd642dcd40 n/a (libbeidpkcs11.so + 0x22d40)
See more details in logs below, including output of "coredumpctl dump 7511"
Running "eid-nssdb remove" solves crashloop issue, but this should not be necessary.
steamwebhelper (part of steam) is trying to do something with libbeidpkcs11.so , but should skip it instead....
Here is my system configuration:
And here are the logs while using the nouveau drivers:
Notify maintainers
(based on 53c527b)
Steam maintainers:
@Atemu
@eclairevoyant
@jonringer
@K900
@mkg20001
eid-mw maintainers:
@bfortz
@chvp
eid-mw contributor:
@gytars
Metadata
Contents of pcscd.nix file containing the whole eid-mw configuration that I am using:
Add a 👍 reaction to issues you find important.
The text was updated successfully, but these errors were encountered: