Score:9

Ubuntu

Why is firefox trying to access fstab and how can I stop it?

jj5

3/27/24, 11:26 AM

Today I ran journalctl -k and found hundreds of entries like this one:

Mar 27 22:15:11 charm kernel: audit: type=1400 audit(1679915711.422:1671372): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/etc/fstab" pid=14539 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Why is firefox trying to access fstab and how can I stop it from trying?

4671

2 + 0

firefox

fstab

apparmor

snap

Score:28

Ubuntu

popey

3/27/24, 11:39 AM

I managed to easily reproduce this:

[Mon Mar 27 12:31:56 2023] audit: type=1400 audit(1679916718.256:598): apparmor="DENIED" operation="open" class="file" profile="snap.firefox.firefox" name="/etc/fstab" pid=3791195 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0

I just installed Firefox, ran through the startup wizard, browsed to a page and then used the menu "File -> Save Page As" to trigger the event.

Two things to note, Firefox didn't read /etc/fstab because the AppArmor rules stopped it (hence "DENIED" in the error). Secondly, this isn't unique to Firefox. I installed the "Musicpod" application and it does the same thing when selecting a folder for music.

[Mon Mar 27 12:37:25 2023] audit: type=1400 audit(1679917047.146:637): apparmor="DENIED" operation="open" class="file" profile="snap.musicpod.musicpod" name="/etc/fstab" pid=3793570 comm="musicpod" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0

Looks to me like the application (or the GTK File Chooser) is merely trying to figure out all the mounted filesystems so it can present them in the file chooser dialog. Nothing sinister, or anything to worry about.

That said, it's possible to disable logging, not just for that action, but all actions, should you wish.

sudo apt install auditd
sudo auditctl -a exit,never -F exe=/snap/firefox/current/usr/lib/firefox/firefox

Tested here, and it completely suppresses the output from apparmor in the syslog.

+ 6

jj5

3/27/24, 12:08 PM

Thanks! Good to know there's nothing to worry about. But how can I stop it? It's filling up my logs with junk...

popey

3/27/24, 1:37 PM

Ok, I've added a couple of lines which should help.

Peter Cordes

3/28/24, 2:37 AM

*figure out all the mounted filesystems* - I'd have thought that looking at `/proc/mounts` would be better for current info, but yeah probably something like that.

Ulrich Schwarz

3/28/24, 6:59 AM

It's doing something along those lines, but in my experience it also triggers automounts. (I can hear external drives spin up when I open save dialogs.)

popey

3/28/24, 8:31 AM

@PeterCordes some applications do that too. Often they will try multiple different methods to derive mounted filesystems. I only pasted the first line of the MusicPod output, but the subsequent lines tried other methods too.

Peter Cordes

3/28/24, 2:51 PM

@popey: Hmm, maybe it's not "other methods", but maybe looking in `fstab` for names of mounts? I'd guess you're right that it's a library thing like GTK, maybe not firefox itself.

Score:3

Ubuntu

Dmitry Grigoryev

3/29/24, 1:48 PM

It's probably happening when a program displays a filesystem access dialog (open/save as) with GVFS support. GVFS supports special flags in /etc/fstab (such as x-gvfs-show, x-gvfs-icon, etc.) which are used to decide which filesystems are displayed in such dialogs, and how they look.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why is firefox trying to access fstab and how can I stop it?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.