apparmor profile freezes Firefox when using Java

[Dr. Rossi]

Binary package hint: apparmor

When trying to access Java applets in Firefox 3.5,
Firefox freezes, when I open a webpage that contains a Java applet.
(e.g. http://www.java.com/de/download/help/testvm.xml).

I have the"Sun JRE 1.6.0-15" and the latest "apparmor-profiles" installed.

But, when I uninstall apparmor everthing works fine.

The reason might be, that apparmor has any rules,
that prohibit the Sun Java plugin to work properly.

Affected packages:
* Firefox 3.5
* Sun JRE 1.6.0
* apparmor(-profiles)

[Jamie Strandboge (jdstrand)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. To help fix the bug, please follow the instructions found in https://wiki.ubuntu.com/DebuggingApparmor. This will greatly help us in tracking down your problem.

[Jamie Strandboge (jdstrand)]

http://www.java.com/de/download/help/testvm.xml works fine here. I have sun-java6-plugin installed and it is registered in about:plugins. Still need you to anwer request in comment #1.

[starslights (starslights)]

hi Jamie,

I have no more audit in my kern.log, so i dunno what can debbug in my case.

Without apparmor enable, i can run java without any problems, in "about:plugins" java are registred and enable.

When i have try to use the java test page , the first time i have a seg fault in npviewer.bin

2009-12-15 12:10:04 moon kernel [307250.731508] npviewer.bin[6856]: segfault at f4c58030 ip 00000000f704fded sp 00000000ffd3c810 error 4 in libpthread-2.10.1.so[f7048000+15000]
 i am surprise while that many time a problem with it.

About jondo test, i have no more crash of the browser but still a grey case. ( i will add screens )
most of time when i load a java applet, the browser hang on and don't have reaction anymore and are blocked and must killed...

screens: http://lookpic.com/i/814/DK9qVrut.png [IMG]http://lookpic.com/i/814/DK9qVrut.png[/IMG]

http://lookpic.com/i/652/MK6BcFzt.png [IMG]http://lookpic.com/i/652/MK6BcFzt.png[/IMG]

on decloak too, because of java, the browser crash and if i disable java, teh page work and flash too.

So are really something with java...

i hope that will help you a bit and any suggestion how debug it are welcome

best regards

[Adam Gignac (mcivor)]

Same thing here, but I'm using IcedTea instead of Sun Java.
I just run
sudo /etc/init.d/apparmor stop
to kill apparmor before I have to do anything involving Java.

[Alistair Buxton (a-j-buxton)]

I've marked a bunch of bugs as dupes of this one as it seems to be the closest to identifying the root cause. Anyone having freezes with firefox and java should try disabling apparmor as described above, and if that does not help, remove the duplicate status from your bug.

On #478263: "I can't run java applets in firefox 3.5.4 (after I upgraded from jaunty to karmic)"

I also upgraded rather than a fresh install, maybe that's the key? What about everyone else?

[Micah Gersten (micahg)]

No one should disable apparmor entirely. You can disable the Firefox profile if you need to per the release notes:
http://www.ubuntu.com/getubuntu/releasenotes/910overview#New%20profiles

It is disabled by default in Karmic.

[Alistair Buxton (a-j-buxton)]

Thanks for that tip. Looks like I and several other people have been affected by https://bugs.launchpad.net/ubuntu/+source/firefox-3.5/+bug/436221 and thus have apparmor enabled on firefox without realising it is supposed to be disabled by default.

[Alistair Buxton (a-j-buxton)]

I also cannot get any kind of audit from apparmor. I first enabled the profile since I had disabled it:

sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5

Now Firefox freezes when loading Java, but the only output on kern.log is the following:

Dec 27 11:55:53 al-desktop kernel: [226309.268382] type=1505 audit(1261914953.903:24): operation="profile_load" pid=6147 name=/usr/lib/firefox-3.5.*/firefox

Then I tried putting apparmor into complain mode:

sudo aa-complain /usr/bin/firefox-3.5
sudo aa-complain /usr/lib/firefox-3.5.*/firefox
sudo aa-complain
                                                                                                                                                             Please enter the program to switch to complain mode: firefox
Setting /etc/apparmor.d/usr.bin.firefox-3.5 to complain mode.

After the third attempt I saw this on kern.log:

Dec 27 12:18:27 al-desktop kernel: [227662.623186] type=1505 audit(1261916307.256:25): operation="profile_replace" pid=7541 name=/usr/lib/firefox-3.5.*/firefox

However, Firefox still freezes with no audit log, even though in complain mode, nothing is supposed to be enforced.

Setting this bug back to "new" because we cannot get the requested information with the supplied instructions.

[Alistair Buxton (a-j-buxton)]

Posting on correct bug this time. Full audit log, logging everything. I don't see any failures. I froze Firefox twice while generating this log.

[Jamie Strandboge (jdstrand)]

Alistair, the easiest way to put the profile into complain mode is:
$ sudo aa-complain /etc/apparmor.d/usr.bin.firefox-3.5

You can then check the status of the profile with:
$ sudo aa-status
...
1 profiles are in complain mode.
   /usr/lib/firefox-3.5.*/firefox
...

[Jamie Strandboge (jdstrand)]

Can people affected by this bug add to /etc/apparmor.d/usr.bin.firefox-3.5:
  network inet dgram,
  network inet6 dgram,

Then perform:
$ sudo apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.firefox-3.5
$ sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5

Please report back if this works for you.

[Jamie Strandboge (jdstrand)]

Alistair, can you also give the URLs for the sites that cause problems firefox to freeze?

[Jamie Strandboge (jdstrand)]

With the 'dgram' lines added to the profile, going to http://decloak.net/ and clicking 'Start test' the browser does not hang. http://www.java.com/de/download/help/testvm.xml also works fine.

[Alistair Buxton (a-j-buxton)]

OK, I have used aa-complain and aa-status as described, giving:

1 profiles are in complain mode.
   /usr/lib/firefox-3.5.*/firefox
...
1 processes are in complain mode.
   /usr/lib/firefox-3.5.*/firefox (13374)

And I have also added the 'dgram' lines. No difference at all. Firefox still freezes on visiting the second page which uses Java plugin, without logging anything, and regardless of whether in complain or enforce mode. I am using http://www.java.com/de/download/help/testvm.xml to test this, but any page with Java causes the freeze.

[Eugene Crosser (crosser)]

On Karmic, I try to run IBM Java 6 and I have apparmor enabled for Firefox 3.5.
Testing with http://www.java.com/en/download/help/testvm.xml
On first try after starting Firefox, I see just grey window where applet output should be.
On reload/second try, firefox freezes.
After I put apparmor in complain mode, a message started to appear in the applet box:
"Error. Click for details" When clicked, "Java Console" window appears saying:
[...]
java.lang.StringIndexOutOfBoundsException
 at java.lang.String.substring(String.java:1092)
 at testvm2.Main.init(Main.java:79)
 at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Plugin2Manager.java:1540)
 at java.lang.Thread.run(Thread.java:736)
Exception: java.lang.StringIndexOutOfBoundsException

Attached aa profile and ecerpt from kern.log

[Jamie Strandboge (jdstrand)]

Eugene, your issue is a separate bug, as the IBM jre is not currently supported by the profile. You should be able to get it to work by adding to /etc/apparmor.d/usr.bin.firefox-3.5 the following:
  /usr/lib/j2re1.6-ibm/jre/bin/java Uxr,

and then perform:
$ sudo apparmor_parser -W -T -r /etc/apparmor.d/usr.bin.firefox-3.5

[Jamie Strandboge (jdstrand)]

Eugene, there are probably some support files in /etc that also need to be allowed. Please file a new bug against firefox-3.5 for supported the IBM jre.

[Jamie Strandboge (jdstrand)]

I cannot reproduce this issue. For people who are having these problems, please do all of the following:

1. make sure the the profile is enabled:
$ sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5

2. give the output of the following command:
$ sudo aa-status

3. give the output of the following command:
$ dpkg -l | egrep '(iced|java)'

4. attach your /var/log/kern.log at the time of the crash

5. give the list of URLs with instructions on how to reproduce the issue

6. give the output of the following:
$ lsb_release -a ; uname -m

[Jamie Strandboge (jdstrand)]

Ok, I was able to reproduce this with the icedtea plugin:
1. profile is enabled
$ md5sum /etc/apparmor.d/usr.bin.firefox-3.5
97d80b2693f5e7d9141a4275b91bd883 /etc/apparmor.d/usr.bin.firefox-3.5

2. sudo aa-status
apparmor module is loaded.
14 profiles are loaded.
14 profiles are in enforce mode.
   ...
   /usr/lib/firefox-3.5.*/firefox
   ...
4 processes are in enforce mode :
   /usr/lib/firefox-3.5.*/firefox (5638)
   ...

3. $ dpkg -l | egrep '(iced|java)'
...
ii icedtea-6-jre-cacao 6b16-1.6.1-3ubuntu1 Alternative JVM for OpenJDK, using Cacao
ii icedtea6-plugin 6b16-1.6.1-3ubuntu1 web browser plugin based on OpenJDK and Iced
ii java-common 0.30ubuntu5 Base of all Java packages
...

4. There are no denied messages in kern.log/audit.log

5. Steps to reproduce:
 a. start firefox with: firefox -safe-mode
 b. disable all addons
 c. go to 'about:plugins' no plugins should be displayed
 d. go to Tools/Addons/Plugins and enable the IcedTea plugin
 e. close firefox
 f. start firefox, then go to 'about:plugins' to verify that icedtea is enabled
 g. navigate to http://www.gnu.org/software/classpath/ (though http://java.com/en/download/help/testvm.xml should lockup firefox too)

6. $ lsb_release -a ; uname -m
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 9.10
Release: 9.10
Codename: karmic
i686

WORKAROUND (ie, disable the firefox profile):
$ sudo apparmor_parser -R /etc/apparmor.d/usr.bin.firefox-3.5
$ sudo touch /etc/apparmor.d/disable/usr.bin.firefox-3.5

$HOME/.xsession-errors shows various errors, but they don't seem directly related to this bug. What is most interesting is that while the profile doesn't show any denials, java nonetheless does not work.

[Jamie Strandboge (jdstrand)]

Added linux task since this seems to be a kernel issue (lack of auditing at least).

[Jamie Strandboge (jdstrand)]

Just to be sure the profile wasn't masking denied messages, I used the attached profile which explicitly allows (rather than denies) all lines starting with 'deny', comments out all 'audit deny' rules, comments out the abstractions/private-files include, and adds the dgram rules too. This is a test profile and not intended to fix the problem (ie, don't use it unless you are trying to fix the problem). Firefox still locks up with the above URL.

[Eugene Crosser (crosser)]

Jamie,

 > You should be able to get it to work by adding to
 > /etc/apparmor.d/usr.bin.firefox-3.5 the following:
 > /usr/lib/j2re1.6-ibm/jre/bin/java Uxr,

Like your later messages indicate, this (and a couple more rules) made the audit messages go away but did not fix the original problem. Just to confirm your findings.

[Alistair Buxton (a-j-buxton)]

I don't have the icedtea plugin installed afaik:

# dpkg -l | egrep '(iced|java)'
rc gjdoc 0.7.9-4.1 documentation generation framework for java source files
ii java-common 0.30ubuntu5 Base of all Java packages
rc libantlr-java-gcj 2.7.7-11ubuntu1 language tool for constructing recognizers, compilers etc
rc libecj-java-gcj 3.5.1-0ubuntu1 Eclipse Java compiler (native library)
rc libjaxp1.3-java-gcj 1.3.04-5ubuntu2 Java XML parser and transformer APIs (DOM, SAX, JAXP, TrAX)
rc liblog4j1.2-java-gcj 1.2.15-4ubuntu1 Logging library for java (native code)
rc libxerces2-java-gcj 2.9.1-4ubuntu1 Validating XML parser for Java with DOM level 3 support (native
ii sun-java6-bin 6-16-0ubuntu1.9.04 Sun Java(TM) Runtime Environment (JRE) 6 (architecture dependent
ii sun-java6-jdk 6-16-0ubuntu1.9.04 Sun Java(TM) Development Kit (JDK) 6
ii sun-java6-jre 6-16-0ubuntu1.9.04 Sun Java(TM) Runtime Environment (JRE) 6 (architecture independe
ii sun-java6-plugin 6-16-0ubuntu1.9.04 The Java(TM) Plug-in, Java SE 6

# lsb_release -a ; uname -m
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 9.10
Release: 9.10
Codename: karmic
i686

[John Johansen (jjohansen)]

On my system using the Sun JRE, AppArmor is causing the the following 2 rejects:

type=APPARMOR_DENIED msg=audit(1263353292.755:25): operation="mkdir" pid=2014 parent=1 profile="/usr/lib/firefox-3.5*/firefox{,*[^s][^h]}" requested_mask="w::" denied_mask="w::" fsuid=1000 ouid=1000 name="/usr/share/mozilla/extensions/{ec8030f7-c20a-464f-9b0e-13a3a9e97384}/"
type=APPARMOR_DENIED msg=audit(1263353292.775:26): operation="mknod" pid=2014 parent=1 profile="/usr/lib/firefox-3.5*/firefox{,*[^s][^h]}" requested_mask="w::" denied_mask="w::" fsuid=1000 ouid=1000 name="/usr/lib/firefox-3.5.7/update.test"

these are caused by the following rule in the firefox profile
  deny /usr/share/mozilla/extensions/**/ w,
  ^
  notice the deny part of the rule? In AppArmor this will also cause auditing of matching rejects to not log rejects. This
  is because the deny rule is a way of documenting known rejects, which in most cases you wouldn't want to fill your
  logs with. This can be worked around at the rule level by prepending the audit keyword.

To test if deny rules were causing rejects to be suppressed I did the following
  sudo echo -n noquiet >/sys/modules/apparmor/parameters/audit
This tells apparmor to not do any quieting of any denied events.

after disabling the rule, http://www.java.com/de/download/help/testvm.xml worked for me. Further more once firefox had executed successfully and created the files it needed, I was able to enable the rule and java continued to work.

[John Johansen (jjohansen)]

Note, in my above testing I was using a Lucid kernel

[Jamie Strandboge (jdstrand)]

In the profile that I attached, I had commented out that rule and still had freezes (on karmic):
  #deny /usr/lib/firefox-3.*/update.test w,
  #deny /usr/lib/mozilla/extensions/**/ w,
  #deny /usr/lib/xulrunner-addons/extensions/**/ w,
  #deny /usr/share/mozilla/extensions/**/ w,

Note that http://www.java.com/de/download/help/testvm.xml would sometimes work for me, even with the deny rule.

[Jamie Strandboge (jdstrand)]

I have not tested on a Lucid kernel yet (but will). Can other people seeing this problem try on Lucid?

[Jamie Strandboge (jdstrand)]

Still affects me on Lucid using this URL: http://www.gnu.org/software/classpath/

$ cat /proc/version_signature
Ubuntu 2.6.32-10.14-generic

[Jamie Strandboge (jdstrand)]

Meant to say that I am using the icedtea6-plugin. Also, the terminal gives a little bit more info:

With profile enabled (and after killing it):
$ firefox
Looking for 0xaf955ed8 0xafb02750 0xb70066fc (document)
/usr/lib/jvm/java-6-openjdk/jre/lib/i386/../../bin/java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory
/usr/lib/jvm/java-6-openjdk/jre/lib/i386/../../bin/java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory
Killed
[137]

With profile disabled:
$ firefox
Looking for 0xb0fb3098 0xb3317350 0xb7478384 (document)
java version "1.6.0_17"
OpenJDK Runtime Environment (IcedTea6 1.7) (6b17-0ubuntu1)
OpenJDK Client VM (build 16.0-b10, mixed mode, sharing)

[Jamie Strandboge (jdstrand)]

strace -f firefox 2> firefox.strace

[Jamie Strandboge (jdstrand)]

Here is another profile with all 'deny' and 'audit deny' changed to allow rules.

[Jamie Strandboge (jdstrand)]

While not an option for a shipped profile, changing these lines:
  /usr/lib/jvm/java-6-openjdk/jre/bin/java Uxr,
  /usr/lib/jvm/java-*-sun-1.*/jre/bin/java Uxr,

to:
  /usr/lib/jvm/java-6-openjdk/jre/bin/java uxr,
  /usr/lib/jvm/java-*-sun-1.*/jre/bin/java uxr,

worked. Apparently too much is being scrubbed from the environment.

[cryptokid (cryptokid)]

Above solution confirmed as working.

Additional notes:
1. profiles are located in /etc/apparmor.d/

2. after edit it will need to be reloaded with sudo invoke-rc.d apparmor reload

[Jamie Strandboge (jdstrand)]

I've committed a fix to firefox-3.6.head that will be included in the next upload to Lucid. It uses a child profile instead of Ux so the environment doesn't get scrubbed:
http://bazaar.launchpad.net/~mozillateam/firefox/firefox-3.6.head/revision/545

[Jamie Strandboge (jdstrand)]

Marking "Won't Fix" for firefox-3.5. People can use 'ux' as a work-around or manually add the child profile from the above commit.

[Jamie Strandboge (jdstrand)]

Actually, the child profile approach won't even work with 9.10's AppArmor -- 9.10 users will have to use 'ux' for java.

[Jamie Strandboge (jdstrand)]

Closing the linux task. While it would be nice to be able to selectively scrub the environment, that is a feature request and is not required to address this bug.

[Jamie Strandboge (jdstrand)]

People wanting to try this in Lucid before firefox has the fix should look at the following commits: r545, r548 and r549.

[Jamie Strandboge (jdstrand)]

Correction: commits r545, r548 and r549 should work ok on Karmic-- you just can't use the Lucid profile on Karmic since it includes abstractions that don't exist in Karmic. I'll update the Karmic profile for dailies users.

[Matthias Klose (doko)]

Lamont just figured out that with the profile enabled, the

   .../bin/java: error while loading shared libraries: libjli.s

is caused by apparmor (?) unsetting LD_LIBRARY_PATH, which is required by the java wrapper
(on amd64) to be set to
/usr/lib/jvm/java-6-openjdk/jre/lib/amd64/server:/usr/lib/jvm/java-6-openjdk/jre/lib/amd64:/usr/lib/jvm/java-6-openjdk/jre/../lib/amd64:/usr/lib/firefox-3.6:/usr/lib/firefox-3.6/plugins:/usr/lib/firefox-3.6

the value depends on the vm requested at runtime and the arch. can the unsetting be avoided?

[Jamie Strandboge (jdstrand)]

Commit r555 has the changes for the karmic profile.

[Matthias Klose (doko)]

jdk7 avoids the setting:

  http://blogs.sun.com/darcy/entry/purging_ld_library_path
  sun bug #6367077 (but depending on others)

[Jamie Strandboge (jdstrand)]

Mathias, the 'unsetting' of LD_LIBRARY_PATH can be avoided in the profile by using 'ux', but this not desirable because AIUI none of the environment is scrubbed when using 'ux'. The limitations are based on how glibc does things. That said, the commits I mentioned should work around this deficiency (and bug) by using a child profile for java. These fixes will be available in Lucid in the next firefox upload.

[Launchpad Janitor (janitor)]

This bug was fixed in the package firefox - 3.6.2+nobinonly-0ubuntu1

---------------
firefox (3.6.2+nobinonly-0ubuntu1) lucid; urgency=low

  * New upstream release v3.6.2 (FIREFOX_3_6_2_RELEASE)

  [ Felix Geyer <email address hidden> ]
  * Rebase mozilla-kde.patch for 3.6.2
    - update debian/patches/mozilla-kde.patch

  [ Jamie Strandboge <<email address hidden> > ]
  * AppArmor profile cleanup for Lucid users:
    - remove sys_ptrace now that the kernel DTRT (LP: #498317)
    - don't use @{PROC}/[0-9]*/mounts or /etc/gnome/defaults.list (part of
      gnome abstraction now)
    - don't use @{PROC}/[0-9]*/maps (part of base abstraction)
    - don't use /etc/sound (part of audio abstraction)
    - use 'owner' for Desktop and all dot files and directories in @{HOME}
    - use ubuntu-bittorrent-clients abstraction
    - use ubuntu-media-players abstraction
    - allow access to xubuntu default app list (LP: #500231)
    - add ark and xarchiver for KDE and XFCE archive managers
    - add thunar for XFCE
    - add editors supported by It's All Text, thanks to James Troup
      (LP: #507711)
    - allow RealPlayer plugin and access to /usr/local/lib (LP: #501822)
    - allow Ux for scim and scim-bridge
    - allow ix for gst-plugin-scanner
  * ship different AppArmor profiles for different releases:
    - move usr.bin.firefox.apparmor.in to usr.bin.firefox.apparmor.9.10
    - add usr.bin.firefox.apparmor.10.04
    - debian/rules: ship AppArmor profile based on release:
      + add DISTRIB, DISTRIB_VERSION_MAJOR and DISTRIB_VERSION_MINOR
      + ship 9.10 profile for Karmic and under and 10.04 profile for Lucid
        and later
  * update AppArmor profile to transition to a java child profile rather
    than Ux. This has the added benefit of restricting java a bit more than
    before. This is needed since the java plugins are expecting certain
    environment variables to be present, which get scrubbed with Ux. 'cx'
    doesn't remove these from the environment but allows for better profiling
    over 'ux'. Thanks to John Johansen for discussion and idea. (LP: #484148)

  [ Alexander Sack <email address hidden> ]
  * fix LP: #518422 - Firefox does not start with certain addons installed;
    don't normalize paths for xpti.dat
    - add debian/patches/lp518422.patch
    - update debian/series

  [ Micah Gersten <email address hidden> ]
  * Bump minimum system NSS to 3.12.6 after upstream landing of (bmo: 545755)
    aka Update Mozilla stable branches to NSS 3.12.6 and minimal support for
    RFC 5746
    - update debian/rules
  * Really fix FTBFS for sparc; Add configure flag to correct variable
    - update debian/rules
 -- Micah Gersten <email address hidden> Wed, 24 Mar 2010 01:17:46 -0500