Ubuntu guest running in virtual machine powered by Oracle VirtualBox 5.2.18. Virtualbox shared folders worked pretty well here until the upgrade from 16.04 to Bionic Beaver was conducted. After upgrade the guest's Web Browser can't open V.B. shared folder (e.g. on filling the form for file upload to web site). Error message popping up on attempt to navigate to shared folder from "open file" dialog reads: .... permission denied. However leaving browser then navigating to shared folder from Nautilus manually works fine.

All instances of web browser run as current user which has no problems to view and manipulate shared folder from Nautilus. Also file ownerships, group and access mode are same in 18.04 as in 16.04 backup. The browser is Chromium, however problems were reproducible also with Firefox.

/etc/fstab does not include any line for mount of vboxsf type, also in 16.04 backup which works fine.

User, the browser is running under and that one logged locally to Beaver and testing shared folder access manually using Nautilus, is in 'vboxsf' user group. That assignment was removed by Beaver installation-by-upgrade. Mount point is /media/sf_exchange :

$ ls -alh /media
total 44K
drwxr-xr-x  12 root root   4.0K Aug 18 19:25 .
drwxr-xr-x  24 root root   4.0K Aug 16 20:38 ..
drwxrwx---   1 root vboxsf  680 Aug 18 22:10 sf_exchange

Version of installed guest additions is in sync with used Virtual Box version.

What might be possible reason and possible solution?


UPDATE upon interesting hint from Mr. T

$ sudo cat /sys/kernel/security/apparmor/profiles | grep .*chrom.*
snap.chromium.chromium (enforce)
snap-update-ns.chromium (enforce)
/usr/lib/lightdm/lightdm-guest-session//chromium (enforce)

Following found also in system log at time stamp corresponding to navigating to shared folder from Chromium's Open File dialog:

AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" \
name="/media/sf_exchange/" pid=4288 comm="pool" requested_mask="r" \
denied_mask="r" fsuid=1000 ouid=0

$ sudo cat /var/lib/snapd/apparmor/profiles/snap.chromium.chromium  | grep exchange
$ sudo cat /var/lib/snapd/apparmor/profiles/snap.chromium.chromium  | grep -e '/media'
$ sudo find  / -path *apparmor* -name *snap.chromium.chromium*
find: ‘/run/user/1000/gvfs’: Permission denied

so no explicit rule to forbid mount point. How to find then the blocking rule?

Same problems with Firefox as reported previously are no more reproducible.


My guess would be this is a problem with apparmor. The following command will disable AppArmor until reboot:

sudo systemctl stop apparmor

If it works with AppArmor disabled, you can either edit or disable the AppArmor profile for Firefox.

  • $ ls -ath /etc/apparmor.d/*chromium* ls: cannot access '/etc/apparmor.d/*chromium*': No such file or directory. However following also applies $ ls -ath /etc/apparmor.d/*firefox* /etc/apparmor.d/usr.bin.firefox - no idea what these two altogether mean. – Fifi Cek Aug 19 '18 at 16:13
  • I wonder also if Bionic B. installs apparmor by default as this machine lives since 2014 and nobody made efforts so far to have it installed and in operation. There must been a change in apparmor's chromium, firefox or a some level higher handling between Ubuntu 16.04 and 18.04 as our previous setup 16.04 did not show these problems. – Fifi Cek Aug 19 '18 at 17:02
  • It does not seem to be problem with apparmor as disabling the latter one does not help. Which is the apparmor profile used for Chromium browser? – Fifi Cek Nov 11 '18 at 16:29
  • Can this be the reason: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/secrets" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.secrets" pid=2542 label="snap.chromium.chromium" peer_pid=1502 peer_label="unconfined". It popsup on opening the web page where upload file element is placed. – Fifi Cek Nov 11 '18 at 16:32
  • Have there been any apparmor profiles updates for Chromium browser since Ubuntu 16.04 LTS? – Fifi Cek Nov 11 '18 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.