firefox-3.5 cannot use mouse themes because of apparmor restrictions

[LGB [Gábor Lénárt]]

Binary package hint: firefox-3.5

firefox-3.5 cannot utilize the selected cursor theme because of apparmor restrictions. I can see things like this in the kernel log:

[341280.454445] type=1503 audit(1254131836.992:161): operation="open" pid=24879 parent=1 profile="/usr/lib/firefox-3.5.*/firefox" requested_mask="::r" denied_mask="::r" fsuid=1000 ouid=0 name="/etc/X11/cursors/oxy-white.theme"
[341280.454516] type=1503 audit(1254131836.992:162): operation="open" pid=24879 parent=1 profile="/usr/lib/firefox-3.5.*/firefox" requested_mask="::r" denied_mask="::r" fsuid=1000 ouid=0 name="/etc/X11/cursors/oxy-white.theme"
[341983.475021] type=1503 audit(1254132540.012:163): operation="open" pid=24879 parent=1 profile="/usr/lib/firefox-3.5.*/firefox" requested_mask="::r" denied_mask="::r" fsuid=1000 ouid=0 name="/etc/X11/cursors/oxy-white.theme"
[341983.475107] type=1503 audit(1254132540.012:164): operation="open" pid=24879 parent=1 profile="/usr/lib/firefox-3.5.*/firefox" requested_mask="::r" denied_mask="::r" fsuid=1000 ouid=0 name="/etc/X11/cursors/oxy-white.theme"

firefox-3.5:
  Installed: 3.5.3+build1+nobinonly-0ubuntu2
  Candidate: 3.5.3+build1+nobinonly-0ubuntu2
  Version table:
 *** 3.5.3+build1+nobinonly-0ubuntu2 0
        500 http://archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status
apparmor:
  Installed: 2.3.1+1403-0ubuntu22
  Candidate: 2.3.1+1403-0ubuntu22
  Version table:
 *** 2.3.1+1403-0ubuntu22 0
        500 http://archive.ubuntu.com karmic/main Packages
        100 /var/lib/dpkg/status

[Micah Gersten (micahg)]

Thank you for reporting this to Ubuntu. There appears to be enough information for a developer to look at this. Please report any other issues you may find.

[Jamie Strandboge (jdstrand)]

I'm going to fix this in the X abstraction, so moving away from firefox.

[Jamie Strandboge (jdstrand)]

Can you add the following to /etc/apparmor.d/abstractions/X:
  # mouse themes
  /etc/X11/cursors/ r,
  /etc/X11/cursors/** r,

Then perform:
$ sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox-3.5

and let me know if it fixes the problem for you?

[Jamie Strandboge (jdstrand)]

Actually, that command should have been:
$ apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.firefox-3.5

[LGB [Gábor Lénárt] (lgb)]

Well, just that command after editing etc/apparmor.d/abstractions/X didn't helped but after an /etc/init.d/apparmor reload it does, with your suggestions firefox has the wanted mouse theme and also no more message from apparmor in kernel log.

I am not sure it's ok to mention here, but I also got another problem I've just found while looking at output of command dmesg:

[440079.454359] type=1503 audit(1254230635.992:356): operation="file_mmap" pid=14648 parent=1 profile="/usr/lib/firefox-3.5.*/firefox" requested_mask="mr::" denied_mask="m::" fsuid=1000 ouid=1000 name="/<email address hidden>/plugins/libmoonloaderxpi.so"
[440079.454982] type=1503 audit(1254230635.992:357): operation="file_mmap" pid=14648 parent=1 profile="/usr/lib/firefox-3.5.*/firefox" requested_mask="mr::" denied_mask="m::" fsuid=1000 ouid=1000 name="/<email address hidden>/plugins/libmoonloaderxpi.so"

That's Moonlight extension for firefox, and it seems I have problems with that. Is it possible that this can cause the bug 438575 ? Maybe upgrading extensions has problem because with the new one it stops at moonlight because of apparmor restrictions so I have pending 'restart to firefox' messages in add-ons window all the time even after restarting. But just guessing .... Sorry for the noise here, I will test to disable apparmor and see if extension upgrade process is ok then or not, and I will report at the other bug, I've subscribed. Thanks for the patience.

[Jamie Strandboge (jdstrand)]

Regarding apparmor reload> you'll want to restart firefox to make sure it works. When you reload apparmor in this manner it unloads then loads the profile out from under the application and firefox is likely running unconfined.

The extension bug you mentioned is bug #433128. The fix for this will be in the next upload. In the meantime, feel free to add this to your profile:
  @{HOME}/.mozilla/**/extensions/** mixr,

[LGB [Gábor Lénárt] (lgb)]

Sure I restarted firefox too after I did that apparmor_parser command you have mentioned, but it didn't helped then tried to use the init script of apparmor and restart firefox again, after it, cursor them problem really went away. Thanks for the comment about the extension bug, what do you suggest, should I comment that bug now with some more information you told me, or it hasn't got too much sense to do it ... ? Now I've just made my bug report as a duplication of bug #433128. Thanks for your suggestion!

[Jamie Strandboge (jdstrand)]

You don't have to do anything. The fix is committed and will be in the next upload of firefox-3.5. If you want to get this working right away, add the previously mentioned line to your profile and reload the profile.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apparmor - 2.3.1+1403-0ubuntu24

---------------
apparmor (2.3.1+1403-0ubuntu24) karmic; urgency=low

  * abstractions/X: allow mouse themes (LP: #438051)

 -- Jamie Strandboge <email address hidden> Thu, 01 Oct 2009 16:07:25 -0500