AppArmor config denies 'k' access to suggest.sqlite-shm

[Chris Markiewicz]

This occurs in the ESR builds from ppa:mozillateam/ppa.

My dmesg log is filled with lines such as:

[ 3015.575852] audit: type=1400 audit(1702042069.563:12459): apparmor="DENIED" operation="file_lock" class="file" profile="firefox" name="/home/chris/.cache/mozilla/firefox/pws2qa7b.default/suggest.sqlite-shm" pid=25154 comm=4267494F5468727E506F6F6C202332 requested_mask="k" denied_mask="k" fsuid=1000 ouid=1000

Possibly relatedly, a number of sites would start to load and then freeze. At times they would allow scrolling but not clicking or typing, or the tab throbber would keep going. Closing firefox required a SIGTERM to fully shut down, while these requests continued to be made.

Looking through the AppArmor profile, there was a line:

  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,

I added the following to /etc/apparmor.d/local/usr.bin.firefox:

  owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite* k,

This definitely resolves the dmesg issue, and it seems to be resolving the intermittent hanging issue. Reloading the apparmor profile without restarting firefox seems to have been successful.