refresh problems with multi-process and AppArmor

[Antoine Pitrou]

With Ubuntu's build of Firefox 51, enabling multi-process produces refresh problems when switching tabs. In detail, here is what I did:

1) create a new profile
2) start firefox with that new profile (so no add-ons)
3) display "about:support" and check that multi-process is on
4) open a few other tabs on various web pages
5) switch between tabs: most of the time, the display is not refreshed, the old tab's contents is still there

Then I tried Mozilla's officiel build of Firefox 51 for Linux (specifically the French x86-64 version), and I had no problems: display is refreshed when I switch tabs.

There must be something different in the Ubuntu build. Note I have a NVidia card and use the proprietary driver (I'm assuming detailed info is uploaded as part of the bug report process?).

Additional information: I have Ubuntu's AppArmor profile for Firefox enabled.

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: firefox 51.0.1+build2-0ubuntu0.16.04.1
ProcVersionSignature: Ubuntu 4.4.0-59.80-generic 4.4.35
Uname: Linux 4.4.0-59-generic x86_64
NonfreeKernelModules: zfs zunicode zcommon znvpair zavl nvidia_uvm nvidia_drm nvidia_modeset nvidia
AddonCompatCheckDisabled: False
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: amd64
BuildID: 20170125172221
Channel: Unavailable
CurrentDesktop: XFCE
Date: Sat Jan 28 17:55:13 2017
DefaultProfileIncompatibleExtensions: Default - {972ce4c6-7e08-4474-a285-3208198ce6fd}
DefaultProfilePlugins:
 IcedTea-Web Plugin (using IcedTea-Web 1.6.2 (1.6.2-3ubuntu1)) - /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so (icedtea-8-plugin)
 bjninstallplugin - /usr/lib/firefox-addons/plugins/npbjninstallplugin_2.180.71.8.so
 bjnplugin - /usr/lib/firefox-addons/plugins/npbjnplugin_2.180.71.8.so
 Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin)
 Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin)
DefaultProfilePrefErrors: 'utf-8' codec can't decode byte 0xe9 in position 7414: invalid continuation byte
DefaultProfilePrefSources: [Profile]/extensions/masterpasswordtimeoutplus@vano/defaults/preferences/masterpasswordplus.js
ForcedLayersAccel: False
IfupdownConfig:
 # interfaces(5) file used by ifup(8) and ifdown(8)
 auto lo
 iface lo inet loopback
InstallationDate: Installed on 2013-04-12 (1386 days ago)
InstallationMedia: Xubuntu 13.04 "Raring Ringtail" - Alpha amd64 (20130409)
MostRecentCrashID: bp-eb109c63-e3b5-4c21-a920-d262b2150407
Profile1Extensions: extensions.sqlite corrupt or missing
Profile1IncompatibleExtensions: Unavailable (corrupt or non-existant compatibility.ini or extensions.sqlite)
Profile1Locales: extensions.sqlite corrupt or missing
Profile1Plugins:
 Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin)
 Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin)
 IcedTea-Web Plugin (using IcedTea-Web 1.6.2 (1.6.2-3ubuntu1)) - /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/IcedTeaPlugin.so (icedtea-8-plugin)
 bjninstallplugin - /usr/lib/firefox-addons/plugins/npbjninstallplugin_2.180.71.8.so
 bjnplugin - /usr/lib/firefox-addons/plugins/npbjnplugin_2.180.71.8.so
Profile1PrefSources: prefs.js
Profile1Themes: extensions.sqlite corrupt or missing
Profiles:
 Profile0 (Default) - LastVersion=51.0.1/20170125172221 (In use)
 Profile1 - LastVersion=51.0.1/20170125094131 (Out of date)
RfKill:

RunningIncompatibleAddons: True
SourcePackage: firefox
UpgradeStatus: Upgraded to xenial on 2015-07-27 (550 days ago)
dmi.bios.date: 06/22/2011
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 1801
dmi.board.asset.tag: To be filled by O.E.M.
dmi.board.name: P8H67-M EVO
dmi.board.vendor: ASUSTeK Computer INC.
dmi.board.version: Rev 1.xx
dmi.chassis.asset.tag: Asset-1234567890
dmi.chassis.type: 3
dmi.chassis.vendor: Chassis Manufacture
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr1801:bd06/22/2011:svnSystemmanufacturer:pnSystemProductName:pvrSystemVersion:rvnASUSTeKComputerINC.:rnP8H67-MEVO:rvrRev1.xx:cvnChassisManufacture:ct3:cvrChassisVersion:
dmi.product.name: System Product Name
dmi.product.version: System Version
dmi.sys.vendor: System manufacturer

[Antoine Pitrou (pitrou)]

Update: if I switch AppArmor to complain mode, the refresh problems disappear. Here is a syslog excerpt with the AppArmor audit lines (notice the third one about /dev/nvidia-modeset):

Jan 28 18:06:48 fsol kernel: [24416.113173] audit: type=1400 audit(1485623208.731:2574): apparmor="ALLOWED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/etc/ld.so.preload" pid=6919 comm="plugin-containe" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jan 28 18:06:48 fsol kernel: [24416.229774] audit: type=1400 audit(1485623208.847:2575): apparmor="ALLOWED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/sys/devices/system/node/node0/meminfo" pid=6779 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Jan 28 18:06:48 fsol kernel: [24416.289012] audit: type=1400 audit(1485623208.907:2576): apparmor="ALLOWED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/nvidia-modeset" pid=6779 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Jan 28 18:06:48 fsol kernel: [24416.293270] audit: type=1400 audit(1485623208.911:2577): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined"
Jan 28 18:06:48 fsol kernel: [24416.293291] audit: type=1400 audit(1485623208.911:2578): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined"
Jan 28 18:06:48 fsol kernel: [24416.293373] audit: type=1400 audit(1485623208.911:2579): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined"
Jan 28 18:06:48 fsol kernel: [24416.300618] audit: type=1400 audit(1485623208.919:2580): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined"
Jan 28 18:06:49 fsol dbus[4270]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/gtk/vfs/mounttracker" interface="org.gtk.vfs.MountTracker" member="ListMountableInfo" mask="send" name=":1.25" pid=6919 label="/usr/lib/firefox/firefox{,*[^s][^h]}" peer_pid=4448 peer_label="unconfined"
Jan 28 18:06:56 fsol kernel: [24423.824158] ...

[Antoine Pitrou (pitrou)]

It turns out /dev/nvidia-modeset is a red herring. If I add the following line to /etc/apparmor.d/local/usr.bin.firefox:

  /dev/shm/org.chromium* rw,

the refresh problems disappear.

[Antoine Pitrou (pitrou)]

Ping. Is anyone maintaining the AppArmor profile for Firefox?