Clicking download links causes Firefox Snap to freeze up

[Jonas Gamao]

Whenever I click a download link, instead of the file picker opening up, Firefox freezes up. Instead, it'd just try to download

To reproduce:

1. Download a Kubuntu ISO

ProblemType: Bug
DistroRelease: Ubuntu 25.04
Package: xdg-desktop-portal-lxqt 1.0.2-0ubuntu1
ProcVersionSignature: Ubuntu 6.11.0-8.8-generic 6.11.0
Uname: Linux 6.11.0-8-generic x86_64
ApportVersion: 2.30.0-0ubuntu4
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: LXQt
Date: Mon Oct 28 08:25:28 2024
InstallationDate: Installed on 2022-01-23 (1009 days ago)
InstallationMedia: Lubuntu 22.04 LTS "Jammy Jellyfish" - Alpha amd64 (20220119)
SourcePackage: xdg-desktop-portal-lxqt
UpgradeStatus: No upgrade log present (probably fresh install)
---
ProblemType: Bug
ApportVersion: 2.30.0-0ubuntu5
Architecture: amd64
CasperMD5CheckResult: unknown
DistroRelease: Ubuntu 25.04
InstallationDate: Installed on 2022-01-23 (1034 days ago)
InstallationMedia: Lubuntu 22.04 LTS "Jammy Jellyfish" - Alpha amd64 (20220119)
Package: xdg-desktop-portal-lxqt
ProcVersionSignature: Ubuntu 6.11.0-8.8-generic 6.11.0
Snap: firefox 133.0b9-1 (latest/beta)
SnapChanges: no changes found
Tags: plucky
Uname: Linux 6.11.0-8-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: N/A
_MarkForUpload: True

[Jonas Gamao (yamiyukisenpai)]

Tested with Brave snap. While it worked, it was really slow.
LibreWolf on Flatpak isn't affected

$ snap --version
snap 2.65.3+24.10
snapd 2.65.3+24.10
series 16
ubuntu 25.04
kernel 6.11.0-8-generic

[Jonas Gamao (yamiyukisenpai)]

Changing snapd to candidate resolved the issue

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

apport information

[Jonas Gamao (yamiyukisenpai)]

Issue is back, despite Snapd being on Candidate

Also tested with Edge

$ snap --version
snap 2.66.1+git151.g55306fc
snapd 2.66.1+git151.g55306fc
series 16
ubuntu 25.04
kernel 6.11.0-8-generic

[Oliver Calder (ocalder)]

Hi Jonas, thank you for the information. It would be very helpful if you could try two more things:

Do you have Permissions Prompting enabled? You can check this with `sudo snap get system experimental.apparmor-prompting`. If you do have prompting enabled, could you please try disabling prompting and seeing if the issue persists? You can do this in the Security Center, or by running `sudo snap set system experimental.apparmor-prompting=false`.

It would be great if we could see journalctl logs as well, to confirm whether it's a (known) issue with downloading .part files, an issue which was fixed in oracular but the fix has not yet landed in noble. Also, I noticed that the kernel version on plucky is still behind that of oracular, which supports my theory that this may be a known AppArmor/kernel bug which has been fixed but the fix has not yet fully released.

Plucky kernel: 6.11.0-8-generic #8-Ubuntu

Oracular kernel: 6.11.0-9-generic #9-Ubuntu

Noble kernel: 6.8.0-49-generic #49-Ubuntu (for good measure)

[Oliver Calder (ocalder)]

You can collect denial logs using `journalctl -xe | grep DENIED`

[Oliver Calder (ocalder)]

Thinking about it some more though, Firefox freezing up sounds more like it's waiting on Prompting, but no client is presenting the prompt.

Please do check if prompting is enabled (sudo snap get system experimental.apparmor-prompting). If it is, is this intentional, and is the prompting-client snap installed? It may be that you've ended up in a situation where prompting is enabled but there's no client present. Disabling prompting will fix the issue, and you won't be able to enable it again until a client is present, but I think there's a path to ending up with prompting enabled but no client. I'll look into addressing this.

[Oliver Calder (ocalder)]

I've booted the Ubuntu 25.04 daily desktop image in a VM, and was able to download another .iso file inside the VM without hitting the .part bug in the kernel, both with and without prompting enabled, so I don't think the kernel bug is the problem.

I think the most likely explanation is that prompting is enabled but the prompting-client snap is not present or not active.

[Oliver Calder (ocalder)]

Something else which would be very useful: if you can set SNAPD_DEBUG=1 in /etc/environment and then `sudo systemctl restart snapd`, you'll have all of snapd's DEBUG logs in the journalctl. That will let us confirm whether prompts are being recorded and whether the prompting-client is trying to interact with snapd.

[Ernest Lotter (ernestl)]

AppArmor team informed us:
- Prompting issues with .part files is expected with all current kernels supporting prompting, which means lunar, mantic, noble, oracular, and plucky.
- Partial fix on oracular and plucky, that might solve the issue depending on exactly how part files are done (unreliable).

Tracked with:
- https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2089645
- https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2089651

The remaining thing to confirm is that prompting was indeed enabled for the scenario described in this bug report, otherwise that is something to investigate further.

Jonas, it would be helpful if you provide the requested information.