usr.bin.firefox profile blocks access to the AMD GPU

[Jean-Philippe Guérard]

When I launch Firefox with apparmor enabled, I get the following errors:

Mar 6 13:10:11 tigreraye kernel: [ 1090.388691] audit: type=1400 audit(1457266211.486:104): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/proc/ati/major" pid=5705 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.389259] audit: type=1400 audit(1457266211.486:105): apparmor="DENIED" operation="exec" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/usr/bin/amd-console-helper" pid=5706 comm="firefox" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.391940] audit: type=1400 audit(1457266211.490:106): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.392116] audit: type=1400 audit(1457266211.490:107): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.392126] audit: type=1400 audit(1457266211.490:108): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.392133] audit: type=1400 audit(1457266211.490:109): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.392140] audit: type=1400 audit(1457266211.490:110): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.392146] audit: type=1400 audit(1457266211.490:111): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.392152] audit: type=1400 audit(1457266211.490:112): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0
Mar 6 13:10:11 tigreraye kernel: [ 1090.392159] audit: type=1400 audit(1457266211.490:113): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/ati/card0" pid=5705 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0

Adding the following lines to the apparmor profile fixes the issue:

/dev/ati/card0 rw,
/proc/ati/major r,
/proc/ati/0/name r,

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Daniel Richard G. (skunk)]

Hello Jean-Philippe, do you still see this issue if those AppArmor permissions are commented out?

Are you using the fglrx driver?