Apparmor crashes GPU acceleration in Firefox 120

[Nadeem]

$ lsb_release -rd
Description: Ubuntu 22.04.3 LTS
Release: 22.04

$ apt-cache policy apparmor
apparmor:
  Installed: 3.0.4-2ubuntu2.3
  Candidate: 3.0.4-2ubuntu2.3
  Version table:
 *** 3.0.4-2ubuntu2.3 500 (phased 20%)
        500 http://us.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.0.4-2ubuntu2 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages

$ apt-cache policy firefox
firefox:
  Installed: 120.0+build2-0ubuntu0.22.04.1~mt1
  Candidate: 120.0+build2-0ubuntu0.22.04.1~mt1
  Version table:
     1:1snap1-0ubuntu2 -1
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
 *** 120.0+build2-0ubuntu0.22.04.1~mt1 1001
       1001 https://ppa.launchpadcontent.net/mozillateam/ppa/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

$ apt-cache policy libglx-mesa0
libglx-mesa0:
  Installed: 23.0.4-0ubuntu1~22.04.1
  Candidate: 23.0.4-0ubuntu1~22.04.1
  Version table:
 *** 23.0.4-0ubuntu1~22.04.1 500
        500 http://us.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     22.0.1-1ubuntu2 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages

Firefox Apparmor profile seems out of date and needs extra permissions.

The issue started happening in Firefox version 120 after an upgrade from 119.0.1.

I do see the lots of DENIED Apparmor errors before the freeze/crash:

AVC apparmor="DENIED" operation="open" class="file" profile="firefox" name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/config" pid=11949 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

AVC apparmor="DENIED" operation="open" class="file" profile="firefox" name="/sys/devices/pci0000:00/0000:00:01.0/0000:01:00.0/revision" pid=11949 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

AVC apparmor="DENIED" operation="open" class="file" profile="firefox" name="/proc/34029/cgroup" pid=34029 comm=49736F6C617465642057656220436F requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

MESA: error: Failed to query drm device.
libEGL warning: egl: failed to create dri2 screen

Adding the following the following permissions to /etc/apparmor.d/local/usr.bin.firefox seems to mitigate the issue:
    /sys/devices/pci*/**/{config,revision} r,
    @{PROC}/[0-9]*/**/comm r,
    @{PROC}/[0-9]*/**/oom_score_adj w,

Disabling the firefox profile also mitigates the issue. It seems the profile needs an update to include permissions required by Firefox 120.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[frank (frankwu)]

thanks for this report and solution, very strange that FF uses dri/mesa when hw-acceleration is disabled (yes, i unchecked both checkboxes).

i had this issue reproducable on google-login (drive.google.com) with clean new profile without extensions

i can verify that the change in usr.bin.firefox file and restarting apparmor solves this issue

[Daniel Tang (daniel-z-tg)]

There is a more official solution at https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/2018439/comments/14 .