No audio from webbrowser-app in 16.10

[Will Cooke]

[Test case]
Load the browser on 16.10 in either a U8 or U7 session.
Browse to YouTube.
Play a video.
Notice there is no sound. Nor does the browser show in the sound menu/panel.

TLDR: this is an apparmor confinement issue: on yakkety pulse audio needs write access to /{run,dev}/shm/pulse-shm*, which is being denied by the audio and microphone policy groups. The fix consists in punching an additional hole in the generated apparmor profile for webbrowser-app.

[Regression potential]
Low. As the fix consists in weakening the apparmor profile for webbrowser-app, the only concerns should be security-related. The change was ack’d by Jamie Strandboge (see comment #11 in this bug report).
It is not anticipated that this change would make the browser’s functionality regress.

[Olivier Tilloy (osomon)]

(Probably) relevant logs (from the log file attached):

ALSA lib conf.c:3823:(snd_config_update_r) cannot access file /usr/share/alsa/alsa.conf
ALSA lib pcm.c:2450:(snd_pcm_open_noupdate) Unknown PCM default
[1012/100326:WARNING:alsa_util.cc(24)] PcmOpen: default,No such file or directory
ALSA lib pcm.c:2450:(snd_pcm_open_noupdate) Unknown PCM plug:default
[1012/100326:WARNING:alsa_util.cc(24)] PcmOpen: plug:default,No such file or directory

[Olivier Tilloy (osomon)]

@Will: could you please check if it’s just the browser, or anything using an Oxide webview, that experiences the lack of sound?

You can do so by saving the following content as test.qml and opening it in qmlscene:

import QtQuick 2.4
import com.canonical.Oxide 1.15
WebView {
  width: 800
  height: 600
  url: "https://www.youtube.com/watch?v=HED4h00xPPA"
}

[Will Cooke (willcooke)]

Oct 13 12:26:49 test-Inspiron-3137 kernel: [ 506.368904] audit_printk_skb: 63 callbacks suppressed
Oct 13 12:26:49 test-Inspiron-3137 kernel: [ 506.368906] audit: type=1400 audit(1476358009.176:78): apparmor="DENIED" operation="open" profile="webbrowser-app" name="/dev/shm/lttng-ust-wait-6-1000" pid=4144 comm="webbrowser-app" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Oct 13 12:26:49 test-Inspiron-3137 kernel: [ 506.368930] audit: type=1400 audit(1476358009.176:79): apparmor="DENIED" operation="open" profile="webbrowser-app" name="/dev/shm/lttng-ust-wait-6-1000" pid=4144 comm="webbrowser-app" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
Oct 13 12:26:49 test-Inspiron-3137 kernel: [ 506.368945] audit: type=1400 audit(1476358009.176:80): apparmor="DENIED" operation="open" profile="webbrowser-app" name="/dev/shm/lttng-ust-wait-6" pid=4143 comm="webbrowser-app" requested_mask="r" denied_mask="r" fsuid=1000 ouid=114
Oct 13 12:26:49 test-Inspiron-3137 kernel: [ 506.368966] audit: type=1400 audit(1476358009.176:81): apparmor="DENIED" operation="open" profile="webbrowser-app" name="/dev/shm/lttng-ust-wait-6" pid=4143 comm="webbrowser-app" requested_mask="r" denied_mask="r" fsuid=1000 ouid=114
Oct 13 12:26:50 test-Inspiron-3137 dbus[2550]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/ScreenSaver" interface="org.freedesktop.ScreenSaver" member="Inhibit" mask="send" name="org.freedesktop.ScreenSaver" pid=4131 label="webbrowser-app" peer_pid=3059 peer_label="unconfined"
Oct 13 12:26:50 test-Inspiron-3137 dbus[2550]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/ScreenSaver" interface="org.freedesktop.ScreenSaver" member="Inhibit" mask="send" name="org.freedesktop.ScreenSaver" pid=4131 label="webbrowser-app" peer_pid=3059 peer_label="unconfined"

[Olivier Tilloy (osomon)]

<willcooke> oSoMoN, works, and I have sound too
<oSoMoN> willcooke, good, so it’s just the browser

[Olivier Tilloy (osomon)]

I can reliably reproduce the issue in a yakkety VM.

[Olivier Tilloy (osomon)]

I’m seeing the following message in the console when starting webbrowser-app:

[1013/154851:WARNING:audio_manager.cc(314)] Multiple instances of AudioManager detected
[1013/154851:WARNING:audio_manager.cc(275)] Multiple instances of AudioManager detected

[Olivier Tilloy (osomon)]

<chrisccoulson> oSoMoN, ah, so AudioManagerPulse fails to initialize, and then it tries to create AudioManagerAlsa before the unique_ptr instance holding AudioManagerPulse goes out of scope
<chrisccoulson> that makes sense
<chrisccoulson> that means chromium's fallback is buggy though, as AudioManager::Get() will always return nullptr if the pulseaudio path fails
<chrisccoulson> But, the root cause is confinement related

[Olivier Tilloy (osomon)]

The following rule in the browser’s apparmor profile is what causes the audio manager to fail to initialize:

    deny /{run,dev}/shm/pulse-shm* w, # deny unless we have to have it

[Olivier Tilloy (osomon)]

The above rule comes from the audio and microphone policy groups:

  https://bazaar.launchpad.net/~ubuntu-security/apparmor-easyprof-ubuntu/trunk/view/head:/data/policygroups/ubuntu/1.0/audio#L10
  https://bazaar.launchpad.net/~ubuntu-security/apparmor-easyprof-ubuntu/trunk/view/head:/data/policygroups/ubuntu/1.0/microphone#L8

[Olivier Tilloy (osomon)]

<oSoMoN> jdstrand, is this something I can/should work around in the generated apparmor profile for webbrowser-app, or better to fix in apparmor-easyprof-ubuntu (I imagine other apps using the audio/microphone policy groups might be affected too)?
<jdstrand> oSoMoN: for now workaround it. this is fixed in snappy and there shouldn't be any clicks on yakkety

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Olivier Tilloy (osomon)]

Note for users affected by this bug: until the fix is SRU’d (work in progress), you can try out the webbrowser-app snap (from the edge channel of the store).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package webbrowser-app - 0.23+17.04.20161024.1-0ubuntu1

---------------
webbrowser-app (0.23+17.04.20161024.1-0ubuntu1) zesty; urgency=medium

  [ Andrew Hayzen ]
  * Fix for issue where many tabs causes close button to overlap other
    tabs (LP: #1473630)
  * When page has started, stopped, redirected or errored clear cache for
    history update - which prevents incorrect titles in being set
    (LP: #1603835)
  * Add autopilot tests javascript dialogs to webbrowser and
    webapp-container - alertDialog, beforeUnloadDialog, confirmDialog and
    promptDialog (LP: #1633040)
  * Add user-agent override to display the new twitter mobile interface
    (LP: #1577834)

  [ Florian Boucault ]
  * Improved startup time by 800ms by delaying QML compilation and making
    it asynchronous

  [ Olivier Tilloy ]
  * Replace chromium version in UA overrides at runtime, not at build
    time (LP: #1599695)
  * Initial support for generating a snap package for webbrowser-app
    (LP: #1629009)
  * Do not persist references to incognito downloads on disk
    (LP: #1625519)
  * Increase test coverage (to 97.5%) for DownloadsModel (LP: #1534102)
  * Various performance optimizations linked to load events
    (LP: #1611680)
  * Ensure a tab is loaded when re-opened (LP: #1632246)
  * Fix drag'n'drop of bookmarks within the new tab view (LP: #1584868)
  * Work around a limitation in the sound and microphone policy groups
    to "fix" sound in yakkety an zesty (LP: #1632620)

 -- Olivier Tilloy <email address hidden> Mon, 24 Oct 2016 13:51:59 +0000

[Brian Murray (brian-murray)]

Hello Will, or anyone else affected,

Accepted webbrowser-app into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/webbrowser-app/0.23+16.10.20161018-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Olivier Tilloy (osomon)]

Just tested webbrowser-app 0.23+16.10.20161018-0ubuntu1 from yakkety-proposed in a yakkety VM and I confirm that this fixes the sound.
This can be easily tested by just browsing to youtube.com and playing back any music video, or soundcloud.com and playing back any track.

[Launchpad Janitor (janitor)]

This bug was fixed in the package webbrowser-app - 0.23+16.10.20161018-0ubuntu1

---------------
webbrowser-app (0.23+16.10.20161018-0ubuntu1) yakkety; urgency=medium

  * Fix FTBFS on yakkety arm64 and work around a limitation in the sound
    and microphone policy groups. (LP: #1632620, #1633439)

 -- Olivier Tilloy <email address hidden> Tue, 18 Oct 2016 07:07:56 +0000

[Martin Pitt (pitti)]

The verification of the Stable Release Update for webbrowser-app has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.