A quick and dirty way to fix it is to just add someting along the lines of #New ptrace rules require something like this ptrace (read),
to our profile for firefox (/etc/apparmor.d/usr.bin.firefox) and then reload the profile (sudo apparmor_parser -r /etc/apparmor.d/usr.bin.firefox) Here's the full text of my firefox profile # vim:syntax=apparmor # Author: Jamie Strandboge <[email protected]> # Declare an apparmor variable to help with overrides @{MOZ_LIBDIR}=/usr/lib/firefox #include <tunables/global> # We want to confine the binaries that match: # /usr/lib/firefox/firefox # /usr/lib/firefox/firefox # but not: # /usr/lib/firefox/firefox.sh /usr/lib/firefox/firefox{,*[^s][^h]} { #include <abstractions/audio> #include <abstractions/cups-client> # TODO: finetune this for required accesses #include <abstractions/dbus> #include <abstractions/dbus-accessibility> #include <abstractions/dbus-session> #include <abstractions/gnome> #include <abstractions/ibus> #include <abstractions/nameservice> #include <abstractions/p11-kit> # Addons #include <abstractions/ubuntu-browsers.d/firefox> # for networking network inet stream, network inet6 stream, @{PROC}/[0-9]*/net/if_inet6 r, @{PROC}/[0-9]*/net/ipv6_route r, @{PROC}/[0-9]*/net/dev r, @{PROC}/[0-9]*/net/wireless r, # should maybe be in abstractions /etc/ r, /etc/mime.types r, /etc/mailcap r, /etc/xdg/*buntu/applications/defaults.list r, # for all derivatives /usr/share/xubuntu/applications/defaults.list r, owner @{HOME}/.local/share/applications/defaults.list r, owner @{HOME}/.local/share/applications/mimeapps.list r, owner @{HOME}/.local/share/applications/mimeinfo.cache r, owner /tmp/** m, owner /var/tmp/** m, /tmp/.X[0-9]*-lock r, /etc/udev/udev.conf r, # Doesn't seem to be required, but noisy. Maybe allow 'r' for 'b*' if needed. # Possibly move to an abstraction if anything else needs it. deny /run/udev/data/** r, /etc/timezone r, /etc/wildmidi/wildmidi.cfg r, # firefox specific /etc/firefox*/ r, /etc/firefox*/** r, /etc/xul-ext/** r, /etc/xulrunner-2.0*/ r, /etc/xulrunner-2.0*/** r, /etc/gre.d/ r, /etc/gre.d/* r, # noisy deny @{MOZ_LIBDIR}/** w, deny /usr/lib/firefox-addons/** w, deny /usr/lib/xulrunner-addons/** w, deny /usr/lib/xulrunner-*/components/*.tmp w, deny /.suspended r, deny /boot/initrd.img* r, deny /boot/vmlinuz* r, deny /var/cache/fontconfig/ w, deny @{HOME}/.local/share/recently-used.xbel r, # TODO: investigate deny /usr/bin/gconftool-2 x, #Ptrace seems to need something like this ptrace (read), # These are needed when a new user starts firefox and firefox.sh is used @{MOZ_LIBDIR}/** ixr, /usr/bin/basename ixr, /usr/bin/dirname ixr, /usr/bin/pwd ixr, /sbin/killall5 ixr, /bin/which ixr, /usr/bin/tr ixr, @{PROC}/ r, @{PROC}/[0-9]*/cmdline r, @{PROC}/[0-9]*/mountinfo r, @{PROC}/[0-9]*/stat r, owner @{PROC}/[0-9]*/task/[0-9]*/stat r, @{PROC}/[0-9]*/status r, @{PROC}/filesystems r, /sys/devices/pci[0-9]*/**/uevent r, owner @{HOME}/.thumbnails/*/*.png r, /etc/mtab r, /etc/fstab r, # Needed for the crash reporter owner @{PROC}/[0-9]*/environ r, owner @{PROC}/[0-9]*/auxv r, /etc/lsb-release r, /usr/bin/expr ix, /sys/devices/system/cpu/ r, /sys/devices/system/cpu/** r, # about:memory owner @{PROC}/[0-9]*/statm r, owner @{PROC}/[0-9]*/smaps r, # Needed for container to work in xul builds /usr/lib/xulrunner-*/plugin-container ixr, # allow access to documentation and other files the user may want to look # at in /usr and /opt /usr/ r, /usr/** r, /opt/ r, /opt/** r, # so browsing directories works / r, /**/ r, # Default profile allows downloads to ~/Downloads and uploads from ~/Public owner @{HOME}/ r, owner @{HOME}/Public/ r, owner @{HOME}/Public/* r, owner @{HOME}/Downloads/ r, owner @{HOME}/Downloads/* rw, # per-user firefox configuration owner @{HOME}/.{firefox,mozilla}/ rw, owner @{HOME}/.{firefox,mozilla}/** rw, owner @{HOME}/.{firefox,mozilla}/**/*.{db,parentlock,sqlite}* k, owner @{HOME}/.{firefox,mozilla}/plugins/** rm, owner @{HOME}/.{firefox,mozilla}/**/plugins/** rm, owner @{HOME}/.gnome2/firefox*-bin-* rw, owner @{HOME}/.cache/mozilla/{,firefox/} rw, owner @{HOME}/.cache/mozilla/firefox/** rw, owner @{HOME}/.cache/mozilla/firefox/**/*.sqlite k, # # Extensions # /usr/share/.../extensions/... is already covered by '/usr/** r', above. # Allow 'x' for downloaded extensions, but inherit policy for safety owner @{HOME}/.mozilla/**/extensions/** mixr, deny @{MOZ_LIBDIR}/update.test w, deny /usr/lib/mozilla/extensions/**/ w, deny /usr/lib/xulrunner-addons/extensions/**/ w, deny /usr/share/mozilla/extensions/**/ w, deny /usr/share/mozilla/ w, # Miscellaneous (to be abstracted) # Ideally these would use a child profile. They are all ELF executables # so running with 'Ux', while not ideal, is ok because we will at least # benefit from glibc's secure execute. /usr/bin/mkfifo Uxr, # investigate /bin/ps Uxr, /bin/uname Uxr, # Site-specific additions and overrides. See local/README for details. #include <local/usr.bin.firefox> } Testing this out, forcing a firefox crash without the amendment to the profile gives a warning that a crash dump couldn't be generated and a message in /syslog, with the amendment there is a crash report generated and no warning in /syslog. A firefox crash can be forced by entering the following in a scratchpad instance with the environment set to "browser" Cu.import("resource://gre/modules/ctypes.jsm"); let zero = new ctypes.intptr_t(8); let badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t)); badptr.contents; I'm going to mess around with this a bit further and see if there's a better more inclusive way to go about allowing ptrace, eventually will put a patch together. -- You received this bug notification because you are a member of Desktop Packages, which is subscribed to firefox in Ubuntu. https://bugs.launchpad.net/bugs/1322738 Title: Apparmor prevents the crash reporter from working Status in “firefox” package in Ubuntu: Confirmed Bug description: Recently Firefox crashed on me twice. Looking at "about:crashes" showed nothing but very old crash reports. Looking at the audit.log I found that Apparmor is not allowing the crash report to use ptrace: type=AVC msg=audit(1400782417.435:3304): apparmor="DENIED" operation="ptrace" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=20821 comm="firefox" requested_mask="read" denied_mask="read" peer="/usr/lib/firefox/firefox{,*[^s][^h]}" type=SYSCALL msg=audit(1400782417.435:3304): arch=c000003e syscall=0 success=no exit=-13 a0=60 a1=7f17b2501c48 a2=10 a3=22 items=0 ppid=5690 pid=20821 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=4294967295 tty=(none) comm="firefox" exe="/usr/lib/firefox/firefox" key=(null) type=AVC msg=audit(1400874279.170:5966): apparmor="DENIED" operation="ptrace" profile="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=29895 comm="firefox" requested_mask="read" denied_mask="read" peer="/usr/lib/firefox/firefox{,*[^s][^h]}" type=SYSCALL msg=audit(1400874279.170:5966): arch=c000003e syscall=0 success=no exit=-13 a0=33 a1=7fdaad5b6c48 a2=10 a3=22 items=0 ppid=29515 pid=29895 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=4294967295 tty=(none) comm="firefox" exe="/usr/lib/firefox/firefox" key=(null) Those messages are not in the usual format as I run auditd but the actual content should be the same. More information: $ lsb_release -rd Description: Ubuntu 14.04 LTS Release: 14.04 $ apt-cache policy firefox apparmor linux-image-$(uname -r) firefox: Installed: 29.0+build1-0ubuntu0.14.04.2 Candidate: 29.0+build1-0ubuntu0.14.04.2 Version table: *** 29.0+build1-0ubuntu0.14.04.2 0 500 http://archive.ubuntu.com/ubuntu/ trusty-updates/main amd64 Packages 500 http://security.ubuntu.com/ubuntu/ trusty-security/main amd64 Packages 100 /var/lib/dpkg/status 28.0+build2-0ubuntu2 0 500 http://archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages apparmor: Installed: 2.8.95~2430-0ubuntu5 Candidate: 2.8.95~2430-0ubuntu5 Version table: *** 2.8.95~2430-0ubuntu5 0 500 http://archive.ubuntu.com/ubuntu/ trusty/main amd64 Packages 100 /var/lib/dpkg/status linux-image-3.13.0-27-generic: Installed: 3.13.0-27.50 Candidate: 3.13.0-27.50 Version table: *** 3.13.0-27.50 0 500 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main amd64 Packages 100 /var/lib/dpkg/status ProblemType: Bug DistroRelease: Ubuntu 14.04 Package: firefox 29.0+build1-0ubuntu0.14.04.2 ProcVersionSignature: Ubuntu 3.13.0-27.50-generic 3.13.11 Uname: Linux 3.13.0-27-generic x86_64 AddonCompatCheckDisabled: False ApportVersion: 2.14.1-0ubuntu3.2 Architecture: amd64 AudioDevicesInUse: USER PID ACCESS COMMAND /dev/snd/controlC0: simon 4895 F.... pulseaudio /dev/snd/pcmC0D0p: simon 4895 F...m pulseaudio BuildID: 20140428193813 Channel: Unavailable CurrentDesktop: Unity CurrentDmesg: dmesg: klogctl failed: Operation not permitted Date: Fri May 23 15:50:44 2014 DefaultProfileIncompatibleExtensions: Français Language Pack - [email protected] Default - {972ce4c6-7e08-4474-a285-3208198ce6fd} DefaultProfilePlugins: Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin) Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin) TLSAValidatorPlugin_x86_64 - [Profile]/extensions/[email protected]/plugins/npTLSAValidatorPlugin_x64.so DNSSECValidatorPlugin_x86_64 - [Profile]/extensions/[email protected]/plugins/npDNSSECValidatorPlugin_x64.so Shockwave Flash - /usr/lib/adobe-flashplugin/libflashplayer.so (adobe-flashplugin) DefaultProfilePrefSources: prefs.js [Profile]/extensions/[email protected]/defaults/preferences/preferences.js [Profile]/extensions/[email protected]/defaults/preferences/dnssec.js ForcedLayersAccel: False InstallationDate: Installed on 2014-01-26 (116 days ago) InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Alpha amd64 (20140124) Profile1IncompatibleExtensions: Default - {972ce4c6-7e08-4474-a285-3208198ce6fd} Profile1Plugins: Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin) Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin) Shockwave Flash - /usr/lib/adobe-flashplugin/libflashplayer.so (adobe-flashplugin) Profile1PrefSources: prefs.js [Profile]/extensions/[email protected]/defaults/preferences/preferences.js Profile2IncompatibleExtensions: Default - {972ce4c6-7e08-4474-a285-3208198ce6fd} Profile2Plugins: TLSAValidatorPlugin_x86_64 - [Profile]/extensions/[email protected]/plugins/npTLSAValidatorPlugin_x64.so DNSSECValidatorPlugin_x86_64 - [Profile]/extensions/[email protected]/plugins/npDNSSECValidatorPlugin_x64.so Shockwave Flash - /usr/lib/flashplugin-installer/libflashplayer.so Google Talk Plugin - /opt/google/talkplugin/libnpgoogletalk.so (google-talkplugin) Google Talk Plugin Video Renderer - /opt/google/talkplugin/libnpo1d.so (google-talkplugin) Profile2PrefSources: prefs.js [Profile]/extensions/[email protected]/defaults/preferences/dnssec.js Profiles: Profile0 (Default) - LastVersion=29.0/20140428193813 (In use) Profile1 - LastVersion=29.0/20140428193813 Profile2 - LastVersion=28.0/20140410211200 (Out of date) RfKill: 0: phy0: Wireless LAN Soft blocked: no Hard blocked: no RunningIncompatibleAddons: True SourcePackage: firefox UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 02/14/2013 dmi.bios.vendor: LENOVO dmi.bios.version: 6IET85WW (1.45 ) dmi.board.name: 2516CTO dmi.board.vendor: LENOVO dmi.board.version: Not Available dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Not Available dmi.modalias: dmi:bvnLENOVO:bvr6IET85WW(1.45):bd02/14/2013:svnLENOVO:pn2516CTO:pvrThinkPadT410:rvnLENOVO:rn2516CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable: dmi.product.name: 2516CTO dmi.product.version: ThinkPad T410 dmi.sys.vendor: LENOVO To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1322738/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
