Firefox apparmor profile generates DENY messages in logs
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
firefox (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
When used with apparmor profile enforced, firefox will generate some DENY logs. Some operations should be either allowed, or explicitely denied to avoid logging. Luckily, these messages only happen on firefox startup, so they don't flood the log.
1) vfs mounttracker
apparmor="DENIED" operation=
2) .ICE-unix socket (?)
apparmor="DENIED" operation="connect" profile=
It does not seem to have any impact, but maybe it's will in a use case that's not mine...
ProblemType: Bug
DistroRelease: Ubuntu 15.04
Package: firefox 36.0.1+
ProcVersionSign
Uname: Linux 3.19.0-10-generic x86_64
AddonCompatChec
ApportVersion: 2.16.2-0ubuntu4
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/
BuildID: 20150306140302
Channel: Unavailable
CurrentDesktop: Unity
Date: Tue Mar 24 17:05:00 2015
Extensions: extensions.sqlite corrupt or missing
ForcedLayersAccel: False
IfupdownConfig:
# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback
IncompatibleExt
InstallationDate: Installed on 2014-12-13 (100 days ago)
InstallationMedia: Ubuntu 14.10 "Utopic Unicorn" - Release amd64 (20141022.1)
IpRoute:
default via 10.0.0.1 dev eth0 proto static metric 1024
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.75
192.168.111.0/24 dev wlan0 proto kernel scope link src 192.168.111.8
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1
Locales: extensions.sqlite corrupt or missing
Plugins:
IcedTea-Web Plugin (using IcedTea-Web 1.5.2 (1.5.2-1ubuntu2)) - /usr/lib/
iTunes Application Detector - /usr/lib/
PrefSources:
prefs.js
[Profile]/<email address hidden>
Profiles: Profile0 (Default) - LastVersion=
RunningIncompat
SourcePackage: firefox
Themes: extensions.sqlite corrupt or missing
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 05/14/2014
dmi.bios.vendor: LENOVO
dmi.bios.version: G7ETA0WW (2.60 )
dmi.board.
dmi.board.name: 2353CTO
dmi.board.vendor: LENOVO
dmi.board.version: Not Defined
dmi.chassis.
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.
dmi.modalias: dmi:bvnLENOVO:
dmi.product.name: 2353CTO
dmi.product.
dmi.sys.vendor: LENOVO
http_proxy: http://
no_proxy: localhost,
@Frank, the vfs mounttracker missing rules are covered in LP: #1533232
The .ICE-unix socket ones are now fixed at least in Xenial as the proper rule was added to abstractions/X