Public bug reported:
On Ubuntu 26.04 (resolute), the `firefox` profile shipped in
/etc/apparmor.d/firefox is loaded but never attaches to Firefox
installed from Mozilla's official APT repo (packages.mozilla.org) at
/usr/lib/firefox. Firefox processes run with label `unconfined`, so with
kernel.apparmor_restrict_unprivileged_userns=1 they are transitioned to
`unprivileged_userns` and denied, and Firefox's content sandbox runs
without user namespaces (about:support -> Sandbox -> User Namespaces =
false).
The profile's attachment pattern should match:
profile firefox
/{usr/lib/firefox{,-esr,-beta,-devedition,-nightly},opt/firefox}/firefox{,-esr,-bin}
flags=(unconfined) {
Environment
- Ubuntu 26.04.1 LTS, kernel 7.0.0-38-generic
- apparmor 5.0.2-0ubuntu1~26.04.1
- firefox 158.0.1~build1 from https://packages.mozilla.org/apt (replaced the
snap; Ubuntu's 1:1snap1 transitional package pinned below Mozilla's)
- kernel.apparmor_restrict_unprivileged_userns = 1
- No /etc/apparmor.d/disable entries, no local/firefox override, no other
profile referencing /usr/lib/firefox
Steps to reproduce
1. Install Firefox from packages.mozilla.org per Mozilla's instructions (pin
origin packages.mozilla.org at 1000).
2. Launch Firefox (from GNOME or a shell: /usr/lib/firefox/firefox).
3. `ps -eo label,comm | grep -i firefox`
Expected: processes labelled `firefox (unconfined)`; about:support shows User
Namespaces = true.
Actual: processes labelled `unconfined`; User Namespaces = false; kernel log:
apparmor="AUDIT" operation="userns_create" class="namespace" info="Userns
create - transitioning profile" profile="unconfined" comm="firefox-bin"
requested="userns_create" target="unprivileged_userns"
execpath="/usr/lib/firefox/firefox-bin"
apparmor="DENIED" operation="capable" class="cap"
profile="unprivileged_userns" comm="firefox-bin" capability=21
capname="sys_admin"
Checks done
- `aa-status` lists `firefox` as loaded; `apparmor_parser -r
/etc/apparmor.d/firefox` reports "same as current profile, skipping"; no change
after reload/restart.
- Reproduces with a fresh empty profile (`firefox --headless --profile <new
dir>`), so not profile-data related.
- Control: /etc/apparmor.d/chrome (exact path /opt/google/chrome/chrome, same
flags/rules) attaches correctly: processes show `chrome (unconfined)`.
Workaround
An extra profile file with exact-path attachments attaches and restores user
namespaces (processes show `firefox-mozilla-deb-bin (unconfined)`,
about:support User Namespaces = true):
abi <abi/5.0>,
include <tunables/global>
profile firefox-mozilla-deb /usr/lib/firefox/firefox flags=(unconfined) {
userns, @{exec_path} mr, }
profile firefox-mozilla-deb-bin /usr/lib/firefox/firefox-bin
flags=(unconfined) { userns, @{exec_path} mr, }
This suggests the alternation/pattern attachment in
/etc/apparmor.d/firefox is not matching (parser/compile issue with the
`{,...}` empty alternatives?) rather than a policy-loading problem.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: apparmor 5.0.2-0ubuntu1~26.04.1
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Sat Oct 24 14:01:18 2026
InstallationDate: Installed on 2026-10-23 (2 days ago)
InstallationMedia: Ubuntu 26.04.1 LTS "Resolute Raccoon" - Release amd64
(20260826)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/usr/bin/zsh
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcKernelCmdline: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: apparmor
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172128
Title:
/etc/apparmor.d/firefox does not attach to /usr/lib/firefox/firefox
(Mozilla .deb); Firefox sandbox loses user namespaces
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2172128/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
