Frigate 0.16.4 broke the implementation

[pedromrg]

Hi there,

Not sure if this happened to your model but after upgrading to 0.16.4 I get a lot of errors.

`2026-01-30 15:47:26.446033533  127.0.0.1 - - [30/Jan/2026:15:47:26 +0000] "" 400 0 "-" "-" "-"

2026-01-30 15:47:31.943931012  15:47:31.943 WRN [rtsp] error="streams: read tcp 127.0.0.1:47360->127.0.0.1:8554: i/o timeout" stream=door_v2

2026-01-30 15:47:31.944478001  15:47:31.944 WRN github.com/AlexxIT/go2rtc/internal/rtsp/rtsp.go:260 > error="write tcp 127.0.0.1:8554->127.0.0.1:49244: write: broken pipe"

2026-01-30 15:47:31.988051338  15:47:31.987 WRN [rtsp] error="streams: read tcp 127.0.0.1:47376->127.0.0.1:8554: i/o timeout" stream=door_v2_hd

2026-01-30 15:47:31.988565790  15:47:31.988 WRN github.com/AlexxIT/go2rtc/internal/rtsp/rtsp.go:260 > error="write tcp 127.0.0.1:8554->127.0.0.1:41620: write: broken pipe"

2026-01-30 15:47:32.064879630  [2026-01-30 15:47:32] watchdog.door_v2               ERROR   : Ffmpeg process crashed unexpectedly for door_v2.

2026-01-30 15:47:32.065220228  [2026-01-30 15:47:32] watchdog.door_v2               ERROR   : The following ffmpeg logs include the last 100 lines prior to exit.

2026-01-30 15:47:32.065474031  [2026-01-30 15:47:32] ffmpeg.door_v2.detect          ERROR   : rtsp://127.0.0.1:8554/door_v2?video=copy&backchannel=0: Invalid data found when processing input

2026-01-30 15:47:32.065752268  [2026-01-30 15:47:32] watchdog.door_v2               INFO    : Restarting ffmpeg...

2026-01-30 15:47:32.068560181  [2026-01-30 15:47:32] watchdog.door_v2               ERROR   : No new recording segments were created for door_v2 in the last 120s. restarting the ffmpeg record process...

2026-01-30 15:47:32.068946889  [2026-01-30 15:47:32] watchdog.door_v2               INFO    : Terminating the existing ffmpeg process...

2026-01-30 15:47:32.069221386  [2026-01-30 15:47:32] watchdog.door_v2               INFO    : Waiting for ffmpeg to exit gracefully...

2026-01-30 15:47:41.945010178  15:47:41.944 WRN [rtsp] error="streams: read tcp 127.0.0.1:53874->127.0.0.1:8554: i/o timeout" stream=door_v2

2026-01-30 15:47:41.945224397  15:47:41.945 WRN github.com/AlexxIT/go2rtc/internal/rtsp/rtsp.go:260 > error="write tcp 127.0.0.1:8554->127.0.0.1:49274: write: broken pipe"

2026-01-30 15:47:41.990167789  15:47:41.990 WRN [rtsp] error="streams: read tcp 127.0.0.1:53880->127.0.0.1:8554: i/o timeout" stream=door_v2_hd

2026-01-30 15:47:41.990441894  15:47:41.990 WRN github.com/AlexxIT/go2rtc/internal/rtsp/rtsp.go:260 > error="write tcp 127.0.0.1:8554->127.0.0.1:45872: write: broken pipe"

2026-01-30 15:47:42.074489872  [2026-01-30 15:47:42] watchdog.door_v2               ERROR   : No new recording segments were created for door_v2 in the last 120s. restarting the ffmpeg record process...

2026-01-30 15:47:42.074851868  [2026-01-30 15:47:42] watchdog.door_v2               INFO    : Terminating the existing ffmpeg process...

2026-01-30 15:47:42.075293552  [2026-01-30 15:47:42] watchdog.door_v2               INFO    : Waiting for ffmpeg to exit gracefully...

2026-01-30 15:47:42.194132803  [2026-01-30 15:47:42] frigate.video                  ERROR   : door_v2: Unable to read frames from ffmpeg process.

2026-01-30 15:47:42.194606230  [2026-01-30 15:47:42] frigate.video                  ERROR   : door_v2: ffmpeg process is not running. exiting capture thread...

2026-01-30 15:47:51.946414058  15:47:51.946 WRN [rtsp] error="streams: read tcp 127.0.0.1:55784->127.0.0.1:8554: i/o timeout" stream=door_v2

2026-01-30 15:47:51.946778289  15:47:51.946 WRN github.com/AlexxIT/go2rtc/internal/rtsp/rtsp.go:260 > error="write tcp 127.0.0.1:8554->127.0.0.1:41518: write: broken pipe"

2026-01-30 15:47:51.991957113  15:47:51.991 WRN [rtsp] error="streams: read tcp 127.0.0.1:55794->127.0.0.1:8554: i/o timeout" stream=door_v2_hd

2026-01-30 15:47:51.992521018  15:47:51.992 WRN github.com/AlexxIT/go2rtc/internal/rtsp/rtsp.go:260 > error="write tcp 127.0.0.1:8554->127.0.0.1:45896: write: broken pipe"

2026-01-30 15:47:52.080159680  [2026-01-30 15:47:52] watchdog.door_v2               ERROR   : Ffmpeg process crashed unexpectedly for door_v2.

2026-01-30 15:47:52.080795584  [2026-01-30 15:47:52] watchdog.door_v2               ERROR   : The following ffmpeg logs include the last 100 lines prior to exit.

2026-01-30 15:47:52.081288802  [2026-01-30 15:47:52] ffmpeg.door_v2.detect          ERROR   : rtsp://127.0.0.1:8554/door_v2?video=copy&backchannel=0: Invalid data found when processing input

2026-01-30 15:47:52.081735521  [2026-01-30 15:47:52] watchdog.door_v2               INFO    : Restarting ffmpeg...

2026-01-30 15:47:52.085208382  [2026-01-30 15:47:52] watchdog.door_v2               ERROR   : No new recording segments were created for door_v2 in the last 120s. restarting the ffmpeg record process...

2026-01-30 15:47:52.087586575  [2026-01-30 15:47:52] watchdog.door_v2               INFO    : Terminating the existing ffmpeg process...

2026-01-30 15:47:52.087859866  [2026-01-30 15:47:52] watchdog.door_v2               INFO    : Waiting for ffmpeg to exit gracefully...
`

[felipecrs]

You need to set go2rtc_allow_arbitrary_exec option in Frigate add-on config options (in Supervisor) to true.

• Refs 0.16.4 blakeblackshear/frigate-hass-addons#276

I need to document that, though.

[pedromrg]

Hey, well.. running it on Docker... need to figure out how to set it.

[felipecrs]

Oh, that's easy:

https://9eaa7bfe.frigate.pages.dev/configuration/restream/#security-restricted-stream-sources

[pedromrg]

Ohhh thanks a lot!

[dominikg]

You need to set go2rtc_allow_arbitrary_exec option in Frigate add-on config options (in Supervisor) to true.

* Refs [0.16.4 blakeblackshear/frigate-hass-addons#276](https://github.com/blakeblackshear/frigate-hass-addons/pull/276)

I need to document that, though.

hmm, does that go into the frigate addon config.yaml or home assistants global configuration.yaml and whats the subkey if there is any?

Is there a way to do it without that flag or what excatly can happen to lead to arbitrary code execution?

[felipecrs]

It should go in the add-on configuration tab.

[felipecrs]

Is there a way to do it without that flag or what excatly can happen to lead to arbitrary code execution?

Not yet (until there's a dedicated Dahua source in go2rtc).

If someone gets configuration access to your go2rtc, they can add a temporary stream with a script and go2rtc will run that script.

That script can do anything, like sending back to someone the passwords in the go2rtc config, Frigate config, and even your Home Assistant config.

[dominikg]

thank you for the quick response. Took me a while to find, its under <home assistanti>/config/app/ccab4aaf_frigate/config

and you have to check "Show unused optional configuration" to see it.

Does that someone also include other addon authors or scripts running through update processes that could abuse it to escape a sandbox that would normally prevent it?

Thanks a lot for your work and documenting all of this

[felipecrs]

Does that someone also include other addon authors or scripts running through update processes that could abuse it to escape a sandbox that would normally prevent it?

Yes, definitely. Not sure about escaping the container sandbox, but having access to those files I mentioned, which are available to Frigate's container via volume mounts.

All it takes is to have access to go2rtc's HTTP port, which all add-ons have by default.

[dominikg]

uhoh. Is there an open issue for the dedicated dahua source? Or any way to refactor the current implementation to not require it? I'd happily drop another script or more config into my setup if it makes it more secure.

[felipecrs]

• 2-way audio with Dahua CGI HTTP interface AlexxIT/go2rtc#52

There's no other way, I'm afraid.

Maybe if go2rtc had a security mechanism where you could specify which scripts are allowed...

I know there's something like that for specifying which extra binaries are allowed, like ffmpeg.

But I'm personally not interested, and would rather wait for a proper Dahua source implementation.

[githubDiversity]

How I prevent the VTO from reverting it settings at arbitrary times (without the use of exec/echo or what have we in go2rtc) is update them on each connect of my DHIP connection. which I use to react to a putton press.
it also resets the settings every X (configurable) period.

that way I side step the need for exec or echo or scrarry stuff in my setup.