fail to attach a file from /var/log/

Bug #706327 reported by dino99 on 2011-01-22
This bug affects 2 people
Affects Status Importance Assigned to Milestone
firefox (Ubuntu)

Bug Description

Binary package hint: firefox

natty i386 updated with firefox 4.0b9 from genuine natty repo

initial step: try to attach kernel.log requested on bug 705404 but fail without seeing error or warning
next step: testing to attach a lighter weighted file but fail too

finally i've discovered that if i copy this file to /home, then i'm able to attach it without issue. So the problem is about /var/log that dont let upload a file on launchpad.

oem@oem-desktop:~$ ls -l /var/log/kernel.log
-rw-r--r-- 1 root root 260K 2011-01-20 11:12 /var/log/kernel.log

oem@oem-desktop:~$ ls -l /home/oem/kernel.log
-rw-r--r-- 1 oem oem 260K 2011-01-20 11:12 /home/oem/kernel.log

original bug report 705404 closed by Robert Collins:
**** Ok, so this outside our control - its up to your browser (chrome/firefox etc) to make this work. I'm marking the task on Launchpad invalid as such - but feel free to open a bug on your browser.


ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: firefox 4.0~b9+build1+nobinonly-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.37-12.26-generic-pae 2.6.37
Uname: Linux 2.6.37-12-generic-pae i686
NonfreeKernelModules: nvidia
Architecture: i386
Date: Sat Jan 22 16:50:57 2011
SourcePackage: firefox

dino99 (9d9) wrote :
dino99 (9d9) wrote :

this issue is maybe not limited to /var/log/ but might affect other path(s)

summary: - fail to attach a file from /var/log
+ fail to attach a file from /var/log /
summary: - fail to attach a file from /var/log /
+ fail to attach a file from /var/log/
Chris Coulson (chrisccoulson) wrote :

Works fine here. Did you set the firefox apparmor profile to enforce?

Changed in firefox (Ubuntu):
importance: Undecided → Low
status: New → Incomplete
dino99 (9d9) wrote :

into kernel.log got lot of apparmor=denied, like:

kernel: [ 5063.087770] type=1400 audit(1295689225.260:45): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/firefox-4.0b9/firefox{,*[^s][^h]}" name="/" pid=20744 comm="firefox-bin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

kernel: [ 5068.601088] type=1400 audit(1295689230.777:50): apparmor="DENIED" operation="open" parent=1 profile="/usr/lib/firefox-4.0b9/firefox{,*[^s][^h]}" name="/var/log/dmesg" pid=20748 comm="firefox-bin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

have reconfigured apparmor and set /var/log/ into dialog box path. now i get apparmor=status, like:

kernel: [34137.280632] type=1400 audit(1295718299.456:445): apparmor="STATUS" operation="profile_replace" name="/sbin/syslogd" pid=23717 comm="apparmor_parser"

Apparmor-profiles have been installed and no change was made, only the default settings

Chris Coulson (chrisccoulson) wrote :

What is the output of sudo aa-status?

dino99 (9d9) wrote :

aa-status output

Chris Coulson (chrisccoulson) wrote :

Firefox is in enforce mode, which is not the default yet. In any case, I don't think it's a good idea opening up firefox to be able to read from /var/log anyway.

Jamie - thoughts?

Changed in firefox (Ubuntu):
status: Incomplete → New
dino99 (9d9) wrote :

hi Jamie,
what i might say:
- there was any problem with FF4.0b8, that happen with 4.0b9
- as i remember i've not made change on that side
- as a result, have the issues described in #4 above, and some log files are not populated: daemon, debug, messages & user.log

So its recent but cant say if its a Firefox problem or something else. I've found an other bug report related to kernel 2.6.35-6 changes, but i wonder if natty kernel (37-12-generic-pae on my system) need to be fixed too:

from bug report 598824:
***** I looked at the Debian changelog for the kernel and there was a change regarding apparmor and hardlinks. *****
Sorry, i dont know if that bug is close or not but it talk about apparmor changes.

dino99 (9d9) wrote :

i suppose its related to one of the latest development:

" - allows for using the browser to navigate through directories "
that work, but what about "allow for using the browser to upload through directories " ?

dino99 (9d9) wrote :

Made some tweaks:
- removed/purged all the related apparmor packages
- reinstalled apparmor

so the complain mode is over; will report issue about uploading from /var/log/ later when i'll need it.

Jamie Strandboge (jdstrand) wrote :


There is no reason to purge and reinstall apparmor. All you need to do is disable the profile by doing:
$ sudo ln -s /etc/apparmor.d/usr.bin.firefox /etc/apparmor.d/disable
$ sudo apparmor_parser -R /etc/apparmor.d/usr.bin.firefox # or simply reboot

The firefox profile is opt-in, and is designed to prevent arbitrary file access (ie, it would prevent a bad extension from accessing system files not needed by firefox). Since the profile is opt-in and is working as it is designed, I suggest this be marked "Won't fix". Users who turn on the profile can copy the files to the appropriate upload location. That said, it would be nice if firefox gave some sort of feedback on not being able to access the file.

dino99 (9d9) wrote :

its confirmed also with natty i386 beta

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in firefox (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers