16

I'm trying to prevent Firefox from updating in the middle of the work day. If I try to open a new tab I get "Firefox Restart Required". One of my always open tab is a Citrix connection back to a work server, and a restart tears down all those types of secure MFA sessions.

One very insecure workaround is I went to Software & Updates and set the check update to "Never" and when there are security updates I only download and will update when i remember to do so.

This is what Windows used to do many years ago, when you had to restart the OS at inconvenient times. So they are forcing us to restart the browser to keep secure, but folks like me are forced to manually update.

Is there a way to disable the "Firefox Restart Required" without disabling all security updates?

5
  • Do you ever log out of your computer or turn it off?
    – user68186
    Mar 18, 2022 at 15:20
  • 1
    Sounds like a good question to ask the Firefox people.
    – David
    Mar 18, 2022 at 15:21
  • I turn it off when i'm gone for extended periods
    – Barry vT
    Mar 18, 2022 at 15:24
  • I checked Firefox blogs and this seems unique to Ubuntu. Windows has an about:config disable. one suggestion is using a FF PPA but I can't seem to find the setup page.
    – Barry vT
    Mar 18, 2022 at 15:25
  • Maybe "Extended Support Release (ESR)"?
    – Nat
    Mar 19, 2022 at 12:02

4 Answers 4

8

One Risky Solution

Firefox restart is only required when Firefox was updated to a newer version while Firefox was running. Since you run Firefox all the time, one solution is not to update Firefox.

You can set up Ubuntu to never update Firefox. Open a terminal by pressing Ctrl+Alt+T and enter:

sudo apt-mark hold firefox

This will let the update system know not to update Firefox. If Firefox is not updated it will not ask you to restart Firefox.

The Risk

One of my always open tab is a Citrix connection back to a work server, and a restart tears down all those types of secure MFA sessions.

This is my concern. When you run an older and unpatched version of Firefox you run the risk of throwing the security of your Citrix connection out of the window. For example, a targeted attack on your workplace may start from your computer. A hacker may be able to access your work server via your open Citrix connection.

Once you login to your workplace's Citrix web server using the multi-factor authentication, Firefox creates a "token", a random string of letters and numbers. As long as you are logged into the Citrix account the same token is used to verify your authenticity.

Since you don't usually log out, a hacker just needs to get hold of the token to get access to your workplace server.

Good Practice

  • Keep your Ubuntu desktop fully updated (including Firefox)
  • Do not keep the Citrix connection open when you are not actively working on it.
  • Close Firefox after using the Citrix connection.
  • Log out of your Ubuntu account at the end of the day.

Hope this helps

2
  • thank you it does help. I'll probably either use your suggestion as above, or maybe some FF person is reading this and address this mandatory restart. I do keep (or maybe now I won't) keep the system updated, as it doesn't matter because today I started my computer, and into work about 30 minutes is when i get a 'restart'. My current work around is to use Chrome until I'm done with my MFA (Citrix) sessions.
    – Barry vT
    Mar 18, 2022 at 16:12
  • @BarryvT No thanks necessary. Your up-vote and/or accepting the answer as correct by clicking on the gray check mark next to the answer and turning it green is sufficient.
    – user68186
    Mar 18, 2022 at 16:16
5

As the Restart Required text appears, the software is already installed, having replaced components; at times attempting to USE them too (=> crashing!).

Remedy for next time:

  • Hit the Super key (Windoz-key),
  • type Updates, click on Software & Updates
  • Select the Updates tab
  • Change ALL options that says "Install" to possibly DOWNLOAD the updates.

(I have these set to Display immediately and similar)

With this YOU decide when to actually install, be it five minutes later, or the day after.
(launch sudo apt upgrade from Bash/Terminal to actually install available updates)

Generally the risk doing it like this shouldn't be very high,
unless you have very high-risk behavior on the net.

4
  • This is a good solution as long as one remembers to install the updates manually. A good practice may be be make a habit of installing all updates at the end of the workday or workweek and log off/restart/shut-down. That way when you login to/start the computer next day or next week, you have a fully updated system including Firefox.
    – user68186
    Mar 18, 2022 at 20:08
  • Well, you "cannot" forget unless you turn off the reminders...
    – Hannu
    Mar 19, 2022 at 19:55
  • Reminders are like clock alarms. I turn them off and go right back to sleep! :)
    – user68186
    Mar 19, 2022 at 23:19
  • Well, ;.) silent reminders are acceptable IMHO.
    – Hannu
    Mar 20, 2022 at 19:04
3

Stop using Citrix in your browser ?

There's a raft of Citrix/ICA client applications which should login in the same way, but will appear as a separate application.

Depending on the server, you may need the older Citrix Receiver or the newer Citrix Workspace app.

Newer (2022) - Workspace https://www.citrix.com/en-nz/downloads/workspace-app/linux/workspace-app-for-linux-latest.html

Older (2018) - Receiver https://www.citrix.com/en-nz/downloads/citrix-receiver/linux/receiver-for-linux-latest.html

1
  • I know this doesn't answer OP's question about firefox, but it does address OP's need to not restart the citrix session.
    – Criggie
    Mar 19, 2022 at 6:21
1

Sorry, bit late to the party :)

The underlying reason, why you see that message, was already explained above (Firefox had detected its binaries have changed). Let's deal with that reason then.

I guess you have Firefox installed as a snap package? You can figure it out by running snap list in the terminal to see if firefox appears in the list.

If that is the case, what you're dealing here with is an aggressive default behavior of Canonical's Ubuntu snap package manager: it is automatically updating all your installed snap packages behind your back without asking any additional confirmation from you or telling you anything about it, in explicit form. Some proofs:

https://snapcraft.io/docs/keeping-snaps-up-to-date

Snaps update automatically, and by default, the snapd daemon checks for updates 4 times a day. Each update check is called a refresh.

https://snapcraft.io/blog/how-to-manage-snap-updates

Snaps come with a built-in automatic update mechanism, whereby snaps are refreshed to a new version whenever there’s a new release in the Snap Store. Typically, the refresh occurs four times a day, and in the vast majority of cases, they will complete seamlessly, without any issues.

To be honest, this is the dumbest move of Cannonical, to have such defaults. People are running away from Microsoft Windows, because of such things, and what do they find in one of the most popular Linux distributions? The same thing.

Nevertheless, there're couple of things you can do:

  • (my own preference) is to remove Firefox as a snap package and install it as a normal deb package, by adding Mozilla apt repository to your apt configs. By doing that, it will be your own decision, when to apply updates, not the Canonical's one

  • you can consider to configure a snapd so it won't be acting that aggressively as it does by default. But there's a chance, that with the next OS upgrade Canonical will override your configs back to what they think is right.

  • I know it might sound like I joke, but still - consider to switch to some other Linux distro, as an option, which are not doing the same thing to its users and not pushing snaps that hard. Fedora, Mint, PopOS, Debian and many others - there're plenty of choices

4
  • 1
    This is, IMHO, a very uninformed answer. As said above "Firefox restart is only required when Firefox was updated to a newer version while Firefox was running". If the running version doesn't match the installed one, you'll get a crash sooner or later. The same happens with a DEB install of Firefox. As for other distros that don't push snaps that hard or at all, they push other things like debs and rpms, GNU libs, the linux kernel, without asking for your confirmation or approval. Mar 4, 2023 at 20:55
  • @mikewhatever yes, the behavior of Firefox will be the same everywhere, as soon as it detects its binaries had changed it will ask to restart itself to prevent potential crashes. But in this specific case, when we're speaking of Ubuntu, it's snap aggressive behavior which is making it a real disater. Especially knowing how Ubuntu forcely installs snap version of Firefox, even if you attempt to install it via apt. And no, I cannot remember any other combination of distro and package manager which is upgrading your packages behind your back 4 times per day without saying a word to you.
    – Alex
    Mar 4, 2023 at 21:55
  • Actually, there is a simple way to stop snap updates of Firefox, for example for 12 hours: snap refresh --hold=12h firefox. You probably know about it, but complayning in a dramatic way is a lot more fun. Anyway, good luck with your new distro. Mar 5, 2023 at 17:58
  • I have been subject to this a couple of times now, seemingly when gnome or some other non Firefox snap is updated. It seems Firefox snap detects the change and seeks the forced restart. This is appalling behaviour for software that may be being used for serious purposes during the day.
    – Joe
    Jun 13, 2023 at 18:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .