9

Today I ran journalctl -k and found hundreds of entries like this one:

Mar 27 22:15:11 charm kernel: audit: type=1400 audit(1679915711.422:1671372): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/etc/fstab" pid=14539 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Why is firefox trying to access fstab and how can I stop it from trying?

2 Answers 2

29

I managed to easily reproduce this:

[Mon Mar 27 12:31:56 2023] audit: type=1400 audit(1679916718.256:598): apparmor="DENIED" operation="open" class="file" profile="snap.firefox.firefox" name="/etc/fstab" pid=3791195 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0

I just installed Firefox, ran through the startup wizard, browsed to a page and then used the menu "File -> Save Page As" to trigger the event.

Two things to note, Firefox didn't read /etc/fstab because the AppArmor rules stopped it (hence "DENIED" in the error). Secondly, this isn't unique to Firefox. I installed the "Musicpod" application and it does the same thing when selecting a folder for music.

[Mon Mar 27 12:37:25 2023] audit: type=1400 audit(1679917047.146:637): apparmor="DENIED" operation="open" class="file" profile="snap.musicpod.musicpod" name="/etc/fstab" pid=3793570 comm="musicpod" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0

Looks to me like the application (or the GTK File Chooser) is merely trying to figure out all the mounted filesystems so it can present them in the file chooser dialog. Nothing sinister, or anything to worry about.

That said, it's possible to disable logging, not just for that action, but all actions, should you wish.

sudo apt install auditd
sudo auditctl -a exit,never -F exe=/snap/firefox/current/usr/lib/firefox/firefox

Tested here, and it completely suppresses the output from apparmor in the syslog.

6
  • 1
    Thanks! Good to know there's nothing to worry about. But how can I stop it? It's filling up my logs with junk...
    – jj5
    Mar 27, 2023 at 12:08
  • Ok, I've added a couple of lines which should help.
    – popey
    Mar 27, 2023 at 13:37
  • 2
    figure out all the mounted filesystems - I'd have thought that looking at /proc/mounts would be better for current info, but yeah probably something like that. Mar 28, 2023 at 2:37
  • 1
    It's doing something along those lines, but in my experience it also triggers automounts. (I can hear external drives spin up when I open save dialogs.) Mar 28, 2023 at 6:59
  • 1
    @PeterCordes some applications do that too. Often they will try multiple different methods to derive mounted filesystems. I only pasted the first line of the MusicPod output, but the subsequent lines tried other methods too.
    – popey
    Mar 28, 2023 at 8:31
3

It's probably happening when a program displays a filesystem access dialog (open/save as) with GVFS support. GVFS supports special flags in /etc/fstab (such as x-gvfs-show, x-gvfs-icon, etc.) which are used to decide which filesystems are displayed in such dialogs, and how they look.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .