Consider nosound and novideo when keeping groups

Even when `nogroups` is not used, avoid keeping the audio and video
groups when `nosound` and `novideo` are used, respectively.

Based on @rusty-snake's suggestion:
https://github.com/netblue30/firejail/issues/4603#issuecomment-944046299

Relates to #4603.

2 files changed, 22 insertions, 11 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index eca2846e2..c10ad17a5 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -3144,17 +3144,21 @@ int main(int argc, char **argv, char **envp) {
                         }
 
                         // add audio group
-                        g = get_group_id("audio");
-                        if (g) {
-                                sprintf(ptr, "%d %d 1\n", g, g);
-                                ptr += strlen(ptr);
+                        if (!arg_nosound) {
+                                g = get_group_id("audio");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
                         }
 
                         // add video group
-                        g = get_group_id("video");
-                        if (g) {
-                                sprintf(ptr, "%d %d 1\n", g, g);
-                                ptr += strlen(ptr);
+                        if (!arg_novideo) {
+                                g = get_group_id("video");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
                         }
 
                         // add games group
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 5bb5c257b..969578aeb 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -142,14 +142,11 @@ static void clean_supplementary_groups(gid_t gid) {
                 goto clean_all;
 
         // clean supplementary group list
-        // allow only firejail, tty, audio, video, games
         gid_t new_groups[MAX_GROUPS];
         int new_ngroups = 0;
         char *allowed[] = {
                 "firejail",
                 "tty",
-                "audio",
-                "video",
                 "games",
                 NULL
         };
@@ -161,6 +158,16 @@ static void clean_supplementary_groups(gid_t gid) {
                 i++;
         }
 
+        if (!arg_nosound) {
+                copy_group_ifcont("audio", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
+        if (!arg_novideo) {
+                copy_group_ifcont("video", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
         if (new_ngroups) {
                 rv = setgroups(new_ngroups, new_groups);
                 if (rv)