I am currently using qutebrowser with the webengine backend on NixOS. I noticed something peculiar while trying to get `libwidevinecdm.so` to load. If I specify the location of the library file with `widevine-path=/nix/store/absd.../lib/libwidevinecdm.so` then widevine fails with `Operation not permitted` unless I also add the `no-sandbox` flag.

However if I put `libwidevinecdm.so` into a path that webengine searches by default, e.g. `/opt/google/chrome/libwidevinecdm.so` then widevine works fine even with the sandbox enable.

Without going any further I assume maybe the library isn't copied into the sandbox when specified manually via flag.