Update: if I switch AppArmor to complain mode, the refresh problems disappear. Here is a syslog excerpt with the AppArmor audit lines (notice the third one about /dev/nvidia-modeset):
Jan 28 18:06:48 fsol kernel: [24416.113173] audit: type=1400 audit(1485623208.731:2574): apparmor="ALLOWED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/etc/ld.so.preload" pid=6919 comm="plugin-containe" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Jan 28 18:06:48 fsol kernel: [24416.229774] audit: type=1400 audit(1485623208.847:2575): apparmor="ALLOWED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/sys/devices/system/node/node0/meminfo" pid=6779 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Jan 28 18:06:48 fsol kernel: [24416.289012] audit: type=1400 audit(1485623208.907:2576): apparmor="ALLOWED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/nvidia-modeset" pid=6779 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0 Jan 28 18:06:48 fsol kernel: [24416.293270] audit: type=1400 audit(1485623208.911:2577): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined" Jan 28 18:06:48 fsol kernel: [24416.293291] audit: type=1400 audit(1485623208.911:2578): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined" Jan 28 18:06:48 fsol kernel: [24416.293373] audit: type=1400 audit(1485623208.911:2579): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined" Jan 28 18:06:48 fsol kernel: [24416.300618] audit: type=1400 audit(1485623208.919:2580): apparmor="ALLOWED" operation="sendmsg" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_mask="send" denied_mask="send" addr=none peer_addr="@6E7669646961666463393761343100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" peer="unconfined" Jan 28 18:06:49 fsol dbus[4270]: apparmor="ALLOWED" operation="dbus_method_call" bus="session" path="/org/gtk/vfs/mounttracker" interface="org.gtk.vfs.MountTracker" member="ListMountableInfo" mask="send" name=":1.25" pid=6919 label="/usr/lib/firefox/firefox{,*[^s][^h]}" peer_pid=4448 peer_label="unconfined" Jan 28 18:06:56 fsol kernel: [24423.824158] audit: type=1400 audit(1485623216.443:2581): apparmor="ALLOWED" operation="mknod" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" name="/dev/shm/org.chromium.T6Ehgv" pid=6919 comm=57656220436F6E74656E74 requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
Update: if I switch AppArmor to complain mode, the refresh problems disappear. Here is a syslog excerpt with the AppArmor audit lines (notice the third one about /dev/nvidia- modeset) :
Jan 28 18:06:48 fsol kernel: [24416.113173] audit: type=1400 audit(148562320 8.731:2574) : apparmor="ALLOWED" operation="open" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" name="/ etc/ld. so.preload" pid=6919 comm="plugin- containe" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 8.847:2575) : apparmor="ALLOWED" operation="open" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" name="/ sys/devices/ system/ node/node0/ meminfo" pid=6779 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 8.907:2576) : apparmor="ALLOWED" operation="open" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" name="/ dev/nvidia- modeset" pid=6779 comm="firefox" requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=0 8.911:2577) : apparmor="ALLOWED" operation="sendmsg" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_ mask="send" denied_mask="send" addr=none peer_addr= "@6E76696469616 664633937613431 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 00000000" peer="unconfined" 8.911:2578) : apparmor="ALLOWED" operation="sendmsg" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_ mask="send" denied_mask="send" addr=none peer_addr= "@6E76696469616 664633937613431 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 00000000" peer="unconfined" 8.911:2579) : apparmor="ALLOWED" operation="sendmsg" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_ mask="send" denied_mask="send" addr=none peer_addr= "@6E76696469616 664633937613431 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 00000000" peer="unconfined" 8.919:2580) : apparmor="ALLOWED" operation="sendmsg" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" pid=6779 comm="firefox" family="unix" sock_type="dgram" protocol=0 requested_ mask="send" denied_mask="send" addr=none peer_addr= "@6E76696469616 664633937613431 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 000000000000000 00000000" peer="unconfined" "dbus_method_ call" bus="session" path="/ org/gtk/ vfs/mounttracke r" interface= "org.gtk. vfs.MountTracke r" member= "ListMountableI nfo" mask="send" name=":1.25" pid=6919 label=" /usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" peer_pid=4448 peer_label= "unconfined" 6.443:2581) : apparmor="ALLOWED" operation="mknod" profile= "/usr/lib/ firefox/ firefox{ ,*[^s][ ^h]}" name="/ dev/shm/ org.chromium. T6Ehgv" pid=6919 comm=5765622043 6F6E74656E74 requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
Jan 28 18:06:48 fsol kernel: [24416.229774] audit: type=1400 audit(148562320
Jan 28 18:06:48 fsol kernel: [24416.289012] audit: type=1400 audit(148562320
Jan 28 18:06:48 fsol kernel: [24416.293270] audit: type=1400 audit(148562320
Jan 28 18:06:48 fsol kernel: [24416.293291] audit: type=1400 audit(148562320
Jan 28 18:06:48 fsol kernel: [24416.293373] audit: type=1400 audit(148562320
Jan 28 18:06:48 fsol kernel: [24416.300618] audit: type=1400 audit(148562320
Jan 28 18:06:49 fsol dbus[4270]: apparmor="ALLOWED" operation=
Jan 28 18:06:56 fsol kernel: [24423.824158] audit: type=1400 audit(148562321