Ubuntu
firefox package

Apparmor prevents the crash reporter from working

Bug #1322738 reported by Simon Déziel on 2014-05-23

This bug affects 2 people

Affects		Status	Importance	Assigned to	Milestone
	firefox (Ubuntu)	Expired	Undecided	Unassigned

Bug Description

Recently Firefox crashed on me twice. Looking at "about:crashes" showed nothing but very old crash reports.
Looking at the audit.log I found that Apparmor is not allowing the crash report to use ptrace:

type=AVC msg=audit(1400782417.435:3304): apparmor="DENIED" operation="ptrace" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=20821 comm="firefox" requested_mask="read" denied_mask="read" peer="/usr/lib/firefox/firefox{,*[^s][^h]}"
type=SYSCALL msg=audit(1400782417.435:3304): arch=c000003e syscall=0 success=no exit=-13 a0=60 a1=7f17b2501c48 a2=10 a3=22 items=0 ppid=5690 pid=20821 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=4294967295 tty=(none) comm="firefox" exe="/usr/lib/firefox/firefox" key=(null)
type=AVC msg=audit(1400874279.170:5966): apparmor="DENIED" operation="ptrace" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=29895 comm="firefox" requested_mask="read" denied_mask="read" peer="/usr/lib/firefox/firefox{,*[^s][^h]}"
type=SYSCALL msg=audit(1400874279.170:5966): arch=c000003e syscall=0 success=no exit=-13 a0=33 a1=7fdaad5b6c48 a2=10 a3=22 items=0 ppid=29515 pid=29895 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=4294967295 tty=(none) comm="firefox" exe="/usr/lib/firefox/firefox" key=(null)

Those messages are not in the usual format as I run auditd but the actual content should be the same.

More information:

$ lsb_release -rd
Description: Ubuntu 14.04 LTS
Release: 14.04

$ apt-cache policy firefox apparmor linux-image-$(uname -r)
firefox:
  Installed: 29.0+build1-0ubuntu0.14.04.2
  Candidate: 29.0+build1-0ubuntu0.14.04.2
  Version table:
*** 29.0+build1-0ubuntu0.14.04.2 0
        500 http://archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu/ trusty-security/main amd64 Packages
        100 /var/lib/dpkg/status
     28.0+build2-0ubuntu2 0
        500 http://archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages
apparmor:
  Installed: 2.8.95~2430-0ubuntu5
  Candidate: 2.8.95~2430-0ubuntu5
  Version table:
*** 2.8.95~2430-0ubuntu5 0
        500 http://archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages
        100 /var/lib/dpkg/status
linux-image-3.13.0-27-generic:
  Installed: 3.13.0-27.50
  Candidate: 3.13.0-27.50
  Version table:
*** 3.13.0-27.50 0
        500 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: firefox 29.0+build1-0ubuntu0.14.04.2
ProcVersionSignature: Ubuntu 3.13.0-27.50-generic 3.13.11
Uname: Linux 3.13.0-27-generic x86_64
AddonCompatCheckDisabled: False
ApportVersion: 2.14.1-0ubuntu3.2
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: simon 4895 F.... pulseaudio
/dev/snd/pcmC0D0p: simon 4895 F...m pulseaudio
BuildID: 20140428193813
Channel: Unavailable
CurrentDesktop: Unity
CurrentDmesg: dmesg: klogctl failed: Operation not permitted
Date: Fri May 23 15:50:44 2014
DefaultProfileIncompatibleExtensions:
Français Language Pack - <email address hidden>
Default - {972ce4c6-7e08-4474-a285-3208198ce6fd}
DefaultProfilePlugins:
Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin)
Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin)
TLSAValidatorPlugin_x86_64 - [Profile]/<email address hidden>/plugins/npTLSAValidatorPlugin_x64.so
DNSSECValidatorPlugin_x86_64 - [Profile]/<email address hidden>/plugins/npDNSSECValidatorPlugin_x64.so
Shockwave Flash - /usr/lib/adobe-flashplugin/libflashplayer.so (adobe-flashplugin)
DefaultProfilePrefSources:
prefs.js
[Profile]/<email address hidden>/defaults/preferences/preferences.js
[Profile]/<email address hidden>/defaults/preferences/dnssec.js
ForcedLayersAccel: False
InstallationDate: Installed on 2014-01-26 (116 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Alpha amd64 (20140124)
Profile1IncompatibleExtensions: Default - {972ce4c6-7e08-4474-a285-3208198ce6fd}
Profile1Plugins:
Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin)
Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin)
Shockwave Flash - /usr/lib/adobe-flashplugin/libflashplayer.so (adobe-flashplugin)
Profile1PrefSources:
prefs.js
[Profile]/<email address hidden>/defaults/preferences/preferences.js
Profile2IncompatibleExtensions: Default - {972ce4c6-7e08-4474-a285-3208198ce6fd}
Profile2Plugins:
TLSAValidatorPlugin_x86_64 - [Profile]/<email address hidden>/plugins/npTLSAValidatorPlugin_x64.so
DNSSECValidatorPlugin_x86_64 - [Profile]/<email address hidden>/plugins/npDNSSECValidatorPlugin_x64.so
Shockwave Flash - /usr/lib/flashplugin-installer/libflashplayer.so
Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin)
Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin)
Profile2PrefSources:
prefs.js
[Profile]/<email address hidden>/defaults/preferences/dnssec.js
Profiles:
Profile0 (Default) - LastVersion=29.0/20140428193813 (In use)
Profile1 - LastVersion=29.0/20140428193813
Profile2 - LastVersion=28.0/20140410211200 (Out of date)
RfKill:
0: phy0: Wireless LAN
Soft blocked: no
Hard blocked: no
RunningIncompatibleAddons: True
SourcePackage: firefox
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 02/14/2013
dmi.bios.vendor: LENOVO
dmi.bios.version: 6IET85WW (1.45 )
dmi.board.name: 2516CTO
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr6IET85WW(1.45):bd02/14/2013:svnLENOVO:pn2516CTO:pvrThinkPadT410:rvnLENOVO:rn2516CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 2516CTO
dmi.product.version: ThinkPad T410
dmi.sys.vendor: LENOVO

Tags:

Related branches

lp:~qbalazs/firefox/lp1322738

Revision history for this message

Simon Déziel (sdeziel) wrote on 2014-05-23:

BootDmesg.txt Edit (67.8 KiB, text/plain; charset="utf-8")
CRDA.txt Edit (235 bytes, text/plain; charset="utf-8")
DefaultProfileExtensions.txt Edit (1.1 KiB, text/plain; charset="utf-8")
DefaultProfileLocales.txt Edit (253 bytes, text/plain; charset="utf-8")
DefaultProfilePrefs.txt Edit (4.3 KiB, text/plain; charset="utf-8")
DefaultProfileThemes.txt Edit (242 bytes, text/plain; charset="utf-8")
Dependencies.txt Edit (8.3 KiB, text/plain; charset="utf-8")
HookError_source_firefox.txt Edit (463 bytes, text/plain; charset="utf-8")
Lspci.txt Edit (14.1 KiB, text/plain; charset="utf-8")
PciNetwork.txt Edit (1.1 KiB, text/plain; charset="utf-8")
ProcEnviron.txt Edit (106 bytes, text/plain; charset="utf-8")
Profile1Extensions.txt Edit (1.1 KiB, text/plain; charset="utf-8")
Profile1Locales.txt Edit (280 bytes, text/plain; charset="utf-8")
Profile1Prefs.txt Edit (1.7 KiB, text/plain; charset="utf-8")
Profile1Themes.txt Edit (242 bytes, text/plain; charset="utf-8")
Profile2Extensions.txt Edit (747 bytes, text/plain; charset="utf-8")
Profile2Locales.txt Edit (276 bytes, text/plain; charset="utf-8")
Profile2Prefs.txt Edit (1.2 KiB, text/plain; charset="utf-8")
Profile2Themes.txt Edit (236 bytes, text/plain; charset="utf-8")
RelatedPackageVersions.txt Edit (206 bytes, text/plain; charset="utf-8")

Quinn Balazs (qbalazs) on 2014-05-24

Changed in firefox (Ubuntu):
status:	New → Confirmed

Revision history for this message

Quinn Balazs (qbalazs) wrote on 2014-05-24:

The ability to support ptrace rules was recently added to apparmor. It looks like we're trying to enforce ptrace rules that either aren't there, or that are improperly configured. The current behaviour of denying ptrace read masks leaves Firefox incapable of producing a crash dump, which leads to no crash reports being generated or submitted, which is a bit of a nuisance.

Revision history for this message

Quinn Balazs (qbalazs) wrote on 2014-05-25:

Download full text (5.8 KiB)

A quick and dirty way to fix it is to just add someting along the lines of

#New ptrace rules require something like this
ptrace (read),

to our profile for firefox (/etc/apparmor.d/usr.bin.firefox) and then reload the profile (sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox)

Here's the full text of my firefox profile

# vim:syntax=apparmor
# Author: Jamie Strandboge <email address hidden>

# Declare an apparmor variable to help with overrides
@{MOZ_LIBDIR}=/usr/lib/firefox

#include <tunables/global>

# We want to confine the binaries that match:
# /usr/lib/firefox/firefox
# /usr/lib/firefox/firefox
# but not:
# /usr/lib/firefox/firefox.sh
/usr/lib/firefox/firefox{,*[^s][^h]} {
  #include <abstractions/audio>
  #include <abstractions/cups-client>
  # TODO: finetune this for required accesses
  #include <abstractions/dbus>
  #include <abstractions/dbus-accessibility>
  #include <abstractions/dbus-session>
  #include <abstractions/gnome>
  #include <abstractions/ibus>
  #include <abstractions/nameservice>
  #include <abstractions/p11-kit>

# Addons
#include <abstractions/ubuntu-browsers.d/firefox>

  # for networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,
  @{PROC}/[0-9]*/net/dev r,
  @{PROC}/[0-9]*/net/wireless r,

  # should maybe be in abstractions
  /etc/ r,
  /etc/mime.types r,
  /etc/mailcap r,
  /etc/xdg/*buntu/applications/defaults.list r, # for all derivatives
  /usr/share/xubuntu/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/mimeapps.list r,
  owner @{HOME}/.local/share/applications/mimeinfo.cache r,
  owner /tmp/** m,
  owner /var/tmp/** m,
  /tmp/.X[0-9]*-lock r,
  /etc/udev/udev.conf r,
  # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
  # Possibly move to an abstraction if anything else needs it.
  deny /run/udev/data/** r,

/etc/timezone r,
/etc/wildmidi/wildmidi.cfg r,

  # firefox specific
  /etc/firefox*/ r,
  /etc/firefox*/** r,
  /etc/xul-ext/** r,
  /etc/xulrunner-2.0*/ r,
  /etc/xulrunner-2.0*/** r,
  /etc/gre.d/ r,
  /etc/gre.d/* r,

  # noisy
  deny @{MOZ_LIBDIR}/** w,
  deny /usr/lib/firefox-addons/** w,
  deny /usr/lib/xulrunner-addons/** w,
  deny /usr/lib/xulrunner-*/components/*.tmp w,
  deny /.suspended r,
  deny /boot/initrd.img* r,
  deny /boot/vmlinuz* r,
  deny /var/cache/fontconfig/ w,
  deny @{HOME}/.local/share/recently-used.xbel r,

# TODO: investigate
deny /usr/bin/gconftool-2 x,

#Ptrace seems to need something like this
ptrace (read),

  # These are needed when a new user starts firefox and firefox.sh is used
  @{MOZ_LIBDIR}/** ixr,
  /usr/bin/basename ixr,
  /usr/bin/dirname ixr,
  /usr/bin/pwd ixr,
  /sbin/killall5 ixr,
  /bin/which ixr,
  /usr/bin/tr ixr,
  @{PROC}/ r,
  @{PROC}/[0-9]*/cmdline r,
  @{PROC}/[0-9]*/mountinfo r,
  @{PROC}/[0-9]*/stat r,
  owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
  @{PROC}/[0-9]*/status r,
  @{PROC}/filesystems r,
  /sys/devices/pci[0-9]*/**/uevent r,
  owner @{HOME}/.thumbnails/*/*.png r,

/etc/mtab r,
/etc/fstab r,

# Needed for the crash report...

A quick and dirty way to fix it is to just add someting along the lines of

#New ptrace rules require something like this
ptrace (read),

to our profile for firefox (/etc/apparmor.d/usr.bin.firefox) and then reload the profile (sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox)

Here's the full text of my firefox profile

# vim:syntax=apparmor
# Author: Jamie Strandboge <jamie@canonical.com>

# Declare an apparmor variable to help with overrides
@{MOZ_LIBDIR}=/usr/lib/firefox

#include <tunables/global>

# We want to confine the binaries that match:
#  /usr/lib/firefox/firefox
#  /usr/lib/firefox/firefox
# but not:
#  /usr/lib/firefox/firefox.sh
/usr/lib/firefox/firefox{,*[^s][^h]} {
  #include <abstractions/audio>
  #include <abstractions/cups-client>
  # TODO: finetune this for required accesses
  #include <abstractions/dbus>
  #include <abstractions/dbus-accessibility>
  #include <abstractions/dbus-session>
  #include <abstractions/gnome>
  #include <abstractions/ibus>
  #include <abstractions/nameservice>
  #include <abstractions/p11-kit>

# Addons
  #include <abstractions/ubuntu-browsers.d/firefox>

# for networking
  network inet stream,
  network inet6 stream,
  @{PROC}/[0-9]*/net/if_inet6 r,
  @{PROC}/[0-9]*/net/ipv6_route r,
  @{PROC}/[0-9]*/net/dev r,
  @{PROC}/[0-9]*/net/wireless r,

# should maybe be in abstractions
  /etc/ r,
  /etc/mime.types r,
  /etc/mailcap r,
  /etc/xdg/*buntu/applications/defaults.list    r, # for all derivatives
  /usr/share/xubuntu/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/defaults.list r,
  owner @{HOME}/.local/share/applications/mimeapps.list r,
  owner @{HOME}/.local/share/applications/mimeinfo.cache r,
  owner /tmp/** m,
  owner /var/tmp/** m,
  /tmp/.X[0-9]*-lock r,
  /etc/udev/udev.conf r,
  # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed.
  # Possibly move to an abstraction if anything else needs it.
  deny /run/udev/data/** r,

/etc/timezone r,
  /etc/wildmidi/wildmidi.cfg r,

# firefox specific
  /etc/firefox*/ r,
  /etc/firefox*/** r,
  /etc/xul-ext/** r,
  /etc/xulrunner-2.0*/ r,
  /etc/xulrunner-2.0*/** r,
  /etc/gre.d/ r,
  /etc/gre.d/* r,

# TODO: investigate
  deny /usr/bin/gconftool-2 x,

#Ptrace seems to need something like this
  ptrace (read),

/etc/mtab r,
  /etc/fstab r,

# Needed for the crash reporter
  owner @{PROC}/[0-9]*/environ r,
  owner @{PROC}/[0-9]*/auxv r,
  /etc/lsb-release r,
  /usr/bin/expr ix,
  /sys/devices/system/cpu/ r,
  /sys/devices/system/cpu/** r,

# about:memory
  owner @{PROC}/[0-9]*/statm r,
  owner @{PROC}/[0-9]*/smaps r,

# Needed for container to work in xul builds
  /usr/lib/xulrunner-*/plugin-container ixr,

# allow access to documentation and other files the user may want to look
  # at in /usr and /opt
  /usr/ r,
  /usr/** r,
  /opt/ r,
  /opt/** r,

# so browsing directories works
  / r,
  /**/ r,

# Default profile allows downloads to ~/Downloads and uploads from ~/Public
  owner @{HOME}/ r,
  owner @{HOME}/Public/ r,
  owner @{HOME}/Public/* r,
  owner @{HOME}/Downloads/ r,
  owner @{HOME}/Downloads/* rw,

# per-user firefox configuration
  owner @{HOME}/.{firefox,mozilla}/ rw,
  owner @{HOME}/.{firefox,mozilla}/** rw,
  owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k,
  owner @{HOME}/.{firefox,mozilla}/plugins/** rm,
  owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm,
  owner @{HOME}/.gnome2/firefox*-bin-* rw,
  owner @{HOME}/.cache/mozilla/{,firefox/} rw,
  owner @{HOME}/.cache/mozilla/firefox/** rw,
  owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite k,

#
  # Extensions
  # /usr/share/.../extensions/... is already covered by '/usr/** r', above.
  # Allow 'x' for downloaded extensions, but inherit policy for safety
  owner @{HOME}/.mozilla/**/extensions/** mixr,

deny @{MOZ_LIBDIR}/update.test w,
  deny /usr/lib/mozilla/extensions/**/ w,
  deny /usr/lib/xulrunner-addons/extensions/**/ w,
  deny /usr/share/mozilla/extensions/**/ w,
  deny /usr/share/mozilla/ w,

# Miscellaneous (to be abstracted)
  # Ideally these would use a child profile. They are all ELF executables
  # so running with 'Ux', while not ideal, is ok because we will at least
  # benefit from glibc's secure execute.
  /usr/bin/mkfifo Uxr,  # investigate
  /bin/ps Uxr,
  /bin/uname Uxr,

# Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.firefox>
}

Testing this out, forcing a firefox crash without the amendment to the profile gives a warning that a crash dump couldn't be generated and a message in /syslog, with the amendment there is a crash report generated and no warning in /syslog.

A firefox crash can be forced by entering the following in a scratchpad instance with the environment set to "browser"

Cu.import("resource://gre/modules/ctypes.jsm");
let zero = new ctypes.intptr_t(8);
let badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));
badptr.contents;

I'm going to mess around with this a bit further and see if there's a better more inclusive way to go about allowing ptrace, eventually will put a patch together.

Revision history for this message

Quinn Balazs (qbalazs) wrote on 2014-05-25:

Copy of the new profile for convenience Edit (1.8 KiB, application/x-tar)

Revision history for this message

Quinn Balazs (qbalazs) wrote on 2014-05-25:

I guess technically we wouldn't want to make a new section for the ptrace requirements, they would belong under the "Needed for the crash reporter" subheading.

Quinn Balazs (qbalazs) on 2014-05-25

Changed in firefox (Ubuntu):
assignee:	nobody → Quinn Balazs (qbalazs)
status:	Confirmed → In Progress

Revision history for this message

Quinn Balazs (qbalazs) wrote on 2014-05-25:

usr.bin.firefox.apparmor.12.04.patch Edit (379 bytes, text/plain)

Revision history for this message

Quinn Balazs (qbalazs) wrote on 2014-05-25:

usr.bin.firefox.apparmor.13.10.patch Edit (378 bytes, text/plain)

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2014-05-25:

The attachment "usr.bin.firefox.apparmor.12.04.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags:

added: patch

Revision history for this message

Simon Déziel (sdeziel) wrote on 2014-05-26:

Quinn, I appreciate the time you spent to create patches for Precise and Saucy but unfortunately, those release ship an Apparmor version that do not support ptrace rules. Support for those only made it into Trusty.

Revision history for this message

Paul White (paulw2u) wrote on 2018-12-27:

#10

We are sorry that we do not always have the capacity to review all reported bugs in a timely manner.

Do you still see a problem related to the one that you reported in a currently supported version of Ubuntu? Please let us know if you do and in which version of Ubuntu otherwise this report can be left to expire in approximately 60 days time.

Thank you for helping make Ubuntu better.

Paul White
[Ubuntu Bug Squad]

Changed in firefox (Ubuntu):
assignee:	Quinn Balazs (qbalazs) → nobody
status:	In Progress → Incomplete

Revision history for this message

Launchpad Janitor (janitor) wrote on 2019-02-26:

#11

[Expired for firefox (Ubuntu) because there has been no activity for 60 days.]

Changed in firefox (Ubuntu):
status:	Incomplete → Expired

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

Add patch

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntufirefox package

Apparmor prevents the crash reporter from working

Bug Description

Related branches

Other bug subscribers

Patches

Bug attachments

Remote bug watches

Ubuntu
firefox package