Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I happened to be browsing through /var/log/messages for another reason, and I stumbled across some messages apparently related to Firefox like this:

Apr  5 15:36:59 myserver kernel: [18091.188462] type=1503 audit(1333658219.144:19):  operation="open" pid=6396 parent=1 profile="/usr/lib/firefox-11.0/firefox{,*[^s][^h]}" requested_mask="::r" denied_mask="::r" fsuid=1000 ouid=0 name="/shr/RiverTrip.gpx"

which are really puzzling me because I really don't see why Firefox would know about these files let alone output messages about them.

The /shr directory is an NTFS partition I set up on my laptop so I can access it with either Ubuntu or Windows XP. The messages are consistently showing up for a few of the files in that directory, but not all. I haven't even looked at those files or done anything else with them in a long time! I have no idea what's special with those files; they appear to be picked at random as far as I can tell.

I am using Ubuntu 10.04 (lucid), Kernel Linux 2.6.32-38, GNOME 2.30.2 and Firefox 11.0. I hope someone can explain these spooky messages!

share|improve this question
Hmm, apparently I can't officially answer my own question for 8 hours. Short answer: It was AppArmor (and Shooter). Long(er) answer: I'll post it when they let me. Thanks for looking! – Roy Apr 7 '12 at 1:33

O.K., after googling around, I think I can sorta answer my own question.

The messages come from AppArmor, a "security module for the Linux kernel" which I never knew about before. I'm still not quite sure why it gives me those messages, but it happens whenever I try to save a screenprint (I use the Shooter Firefox add-on) to the /shr directory. Firefox doesn't let me, and pops up a Download Error window ("because you cannot change the contents of that folder") which I never really paid attention to. I figured it was a permissions thing which I never bothered to look at or change since I was always satisfied with saving my screen print to another directory.

Anyways, I was able to test this and duplicate the messages. By the way, I was wrong when I wrote that there were only a few files that were being reported on; actually I missed the fact that there were all these lines like "__ratelimit: 96 callbacks suppressed" which means that there were more messages that the system withheld from the messages file.

I still don't know the why AppArmor felt the need to report on every file in that directory...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.