Is it OK if Firefox flooded /log/syslog with the dozens of apparmor="DENIED" messages every minute?

Community Portal mozilla helping club
#1

When I run journalctl, I see thousands messages from Snap about denied access like as:

Oct 28 15:41:22 ideapad audit[8145]: AVC apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0
Oct 28 15:41:22 ideapad kernel: audit: type=1400 audit(1698493282.535:26190): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0
Oct 28 15:41:22 ideapad audit[8145]: AVC apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0
Oct 28 15:41:22 ideapad kernel: audit: type=1400 audit(1698493282.551:26191): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=8145 comm=“firefox” requested_mask=“r” denied_mask=“r” fsuid=1000 ouid=0

That, the journalctl become completely unreadable.
Google tell that Firefix requiring access to /etc/fstab to perform the “Save as …” operation. Is it OK to requir access to fstab few thousand times during the day? May it be the symptom of malware addon in Firefox, or something like this?
firefox 118.0.2-2 3252 latest/stable/
OS: 6.2.0-34-generic #34-Ubuntu SMP PREEMPT_DYNAMIC

1 Like
#2

From the cached search result (original link is not available anymore) I get this

Firefox attempts to access / etc / fstab to determine the mounted filesystems and display them in the file chooser dialog.

Looks logical though.

#3

Hello. It’s not clear for me what original link are you talking about

But this one:

I definitely sure that I didn’t call the “Save as …” operation thousand of times per day.

I am reviewing the logs now, meanwhile, and noticed that thousands of logs from firefox happens not every day at the current time. Moreover, the log journal on Ubuntu not clogged with “firefox /etc/fstab” messages since 20-es of February.
And there is no “audit” unit in syslog caused by Firefox (like audit[12674]: AVC apparmor=“DENIED” operation=“open”) since 20-es of January, 2024. Only “kernel” messages (like kernel: audit: type=1400 audit(1706289451.244:22884): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.firefox.firefox” name="/etc/fstab" pid=12674 comm=“firefox” requested_mask=“r” denied_mask=“r”). Hope it is because mozilla’s developers read my report and fixed it.

#4

A little more of details: no, in common firefox is still clogging the logs, but specifically the fstab messages appear in syslog very less frequently. Actually, it appears one time in week or rarer, and there are, at most, few dozens of messages (just dozens, not dozens of thousands) in syslog with “fstab apparmor denied”.

#5

FWIW this still happens for me in December 2024. I think it doesn’t happen at first right after launching firefox, but eventually something will cause it to start doing the /etc/fstab accesses and then it doesn’t stop trying over and over until the browser is quit. As I look at journalctl right now it’s causing two apparmor audit messages every 5 seconds. and I don’t have any file choosers open that I’m aware of.

#6

I just did a quick experiment and restarted firefox, and as expected there were no fstab messages at first. Then I right-clicked on an image and selected “save image as” to bring up a file chooser, and sure enough it immediately started spamming the audit messages again. Even though I closed the file chooser, it’s still trying to read /etc/fstab twice every 5 seconds for some reason, and will presumably keep trying 24-7 until I restart the browser again.

#7

Looks like that, because in my logs there are weeks of silence, and then firefox starts to clog mt logs again

#8

I have got the same behavior. Once selected “save as”, get the continuous trying to read /etc/fstab four times every minute, until I restart the firefox