Is it OK if Firefox flooded /log/syslog with the dozens of apparmor="DENIED" messages every minute?

Community Portal mozilla helping club
#1

When I run journalctl, I see thousands messages from Snap about denied access like as:

Oct 28 15:41:22 ideapad audit[8145]: AVC apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0
Oct 28 15:41:22 ideapad kernel: audit: type=1400 audit(1698493282.535:26190): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0
Oct 28 15:41:22 ideapad audit[8145]: AVC apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0
Oct 28 15:41:22 ideapad kernel: audit: type=1400 audit(1698493282.551:26191): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0

That, the journalctl become completely unreadable.
Google tell that Firefix requiring access to /etc/fstab to perform the “Save as …” operation. Is it OK to requir access to fstab few thousand times during the day? May it be the symptom of malware addon in Firefox, or something like this?
firefox 118.0.2-2 3252 latest/stable/
OS: 6.2.0-34-generic #34-Ubuntu SMP PREEMPT_DYNAMIC

1 Like
#2

From the cached search result (original link is not available anymore) I get this

Firefox attempts to access / etc / fstab to determine the mounted filesystems and display them in the file chooser dialog.

Looks logical though.

#3

Hello. It’s not clear for me what original link are you talking about

But this one:

I definitely sure that I didn’t call the “Save as …” operation thousand of times per day.

I am reviewing the logs now, meanwhile, and noticed that thousands of logs from firefox happens not every day at the current time. Moreover, the log journal on Ubuntu not clogged with “firefox /etc/fstab” messages since 20-es of February.
And there is no “audit” unit in syslog caused by Firefox (like audit[12674]: AVC apparmor=“DENIED” operation=“open”) since 20-es of January, 2024. Only “kernel” messages (like kernel: audit: type=1400 audit(1706289451.244:22884): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=12674 comm=“firefox” requested_mask=“r” denied_mask=“r”). Hope it is because mozilla’s developers read my report and fixed it.

#4

A little more of details: no, in common firefox is still clogging the logs, but specifically the fstab messages appear in syslog very less frequently. Actually, it appears one time in week or rarer, and there are, at most, few dozens of messages (just dozens, not dozens of thousands) in syslog with “fstab apparmor denied”.