| 2020-11-24 19:23:37 |
Alistair Buxton |
description |
Version:
chromium 87.0.4280.66 1411
Steps to reproduce:
1. Have Chromium snap, with raw-usb plug connected.
2. sudo modprobe usbmon.
3. Open Chromium and try to use a webpage that has webusb.
Result:
Chromium cannot see any USB devices on the system, regardless of whether it has raw-usb or not.
The following errors are printed on dmesg:
```
[3701471.283584] audit: type=1400 audit(1606101844.664:6015): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:4" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283636] audit: type=1400 audit(1606101844.664:6016): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:2" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283700] audit: type=1400 audit(1606101844.664:6017): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:0" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283786] audit: type=1400 audit(1606101844.664:6018): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:7" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283869] audit: type=1400 audit(1606101844.664:6019): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:5" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283982] audit: type=1400 audit(1606101844.664:6020): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:3" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
```
Chromium will then print this on stderr:
And the following error is printed on stderr of Chromium:
```
[3121487:3121626:1123/032552.888385:ERROR:udev_watcher.cc(97)] Failed to begin udev enumeration.
```
Why this happens:
Chromium enumerates USB devices by querying udev. Specifically by using udev_enumerate_scan_devices. When usbmon module is loaded, some new device nodes are created for the monitor endpoints. They are only readable by root. When Chromium scans for normal USB devices, it finds the monitors and tries to probe them. Apparmor blocks it, which causes udev_enumerate_scan_devices to fail.
Impact:
There is no way for the user to know this error has occurred unless they happen to be watching dmesg or the stderr of Chromium (which requires they ran it from a terminal). Unless they check both of these places and realize that the error messages are connected, Chromium will just appear to behave as if there are no USB devices connected to the system at all. If the user does realize that usbmon is causing a problem, they must restart Chromium after unloading it, because it will not retry if enumeration ever fails. |
Version:
chromium 87.0.4280.66 1411
Steps to reproduce:
1. Have Chromium snap, with raw-usb plug connected.
2. sudo modprobe usbmon.
3. Open Chromium and try to use a webpage that has webusb.
Result:
Chromium cannot see any USB devices on the system, regardless of whether it has raw-usb or not.
The following errors are printed on dmesg:
```
[3701471.283584] audit: type=1400 audit(1606101844.664:6015): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:4" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283636] audit: type=1400 audit(1606101844.664:6016): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:2" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283700] audit: type=1400 audit(1606101844.664:6017): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:0" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283786] audit: type=1400 audit(1606101844.664:6018): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:7" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283869] audit: type=1400 audit(1606101844.664:6019): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:5" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
[3701471.283982] audit: type=1400 audit(1606101844.664:6020): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/run/udev/data/c508:3" pid=3120526 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
```
Chromium will then print this on stderr:
```
[3121487:3121626:1123/032552.888385:ERROR:udev_watcher.cc(97)] Failed to begin udev enumeration.
```
Why this happens:
Chromium enumerates USB devices by querying udev. Specifically by using udev_enumerate_scan_devices. When usbmon module is loaded, some new device nodes are created for the monitor endpoints. They are only readable by root. When Chromium scans for normal USB devices, it finds the monitors and tries to probe them. Apparmor blocks it, which causes udev_enumerate_scan_devices to fail.
Impact:
There is no way for the user to know this error has occurred unless they happen to be watching dmesg or the stderr of Chromium (which requires they ran it from a terminal). Unless they check both of these places and realize that the error messages are connected, Chromium will just appear to behave as if there are no USB devices connected to the system at all. If the user does realize that usbmon is causing a problem, they must restart Chromium after unloading it, because it will not retry if enumeration ever fails. |
|
