Struggling with Apparmor and Firefox

[samiux]

Well, the manual says that aa-logprof is an interactive command. But when I start it, aa-logprof gives a couple of messages, thinks for a few seconds, and ends. So, I really don't know what to do with the application.


Thanks. It makes interesting reading, but still does not solve my problem.

I feel like such a dummy with Apparmor — I really am not understanding it!


Yes, I simply installed apparmor-profiles and enabled usr.bin.firefox in enforce mode (confirmed with sudo apparmor_status). I made no changes to the profile (I have undone the changes that I originally made with /tmp).

What I really need to do is fix the Firefox profile such that:

1. I can open a file instead of just downloading it. If this step cannot be easily done, OK, I could live without it, because I can still download.
2. Allow me to upload files, which I cannot do with the profile.

In your quote, vasa1, it says, "It is a distribution choice to not break [the browser] with too-aggressive security protections." Unfortunately, especially regarding uploads, it has broken it!

EDIT: For whatever reason, uploads have started to work again today.

I think I can answer you that why you can download the pdf but not opening it. Please see this link.

Samiux

[Paddy Landau]

Sigh. I just do not understand Apparmor.

I thought that perhaps the Apparmor profile for Firefox was not permitting Firefox to open Adobe Reader. So, as an experiment, I added the following rule to usr.bin.firefox.

/usr/bin/acroread Pix,

No doubt the Apparmor experts are laughing at me, because naturally it didn't work. I am utterly stumped and don't know how to proceed.

I have reverted the profile to its default. For now, I'll have to live without the ability to open a downloaded file from Firefox.

[Paddy Landau]

I think I can answer you that why you can download the pdf but not opening it. Please see this link.

Thanks, but I don't think that's the reason.

I can open the PDF with Adobe when the Apparmor profile is disabled.

When the profile is enabled, I am prevented from opening not only a PDF file with Adobe, but also an Open Office file with Libre Office.

However, I have just discovered that I can open a PDF with Evince. Hmm…

[samiux]

Thanks, but I don't think that's the reason.

I can open the PDF with Adobe when the Apparmor profile is disabled.

When the profile is enabled, I am prevented from opening not only a PDF file with Adobe, but also an Open Office file with Libre Office.

However, I have just discovered that I can open a PDF with Evince. Hmm…

If my memory is correct, OpenOffice and LibreOffice require Java to run.

Samiux

[Paddy Landau]

If my memory is correct, OpenOffice and LibreOffice require Java to run.

Does Apparmor prevent Java?

I disabled Java in Libre Office, but still I cannot open a downloaded file in Libre Office.

But here's a commonality: Both Adobe and Libre Office are installed within /opt. Evince, on the other hand, is not.

Perhaps /opt is somehow disabled?

[samiux]

Does Apparmor prevent Java?

I disabled Java in Libre Office, but still I cannot open a downloaded file in Libre Office.

But here's a commonality: Both Adobe and Libre Office are installed within /opt. Evince, on the other hand, is not.

Perhaps /opt is somehow disabled?

To make it easy for troubleshooting, I suggest you to disable the Apparmor and unload the profile. If the problem is still there, the problem is not on the Apparmor.

Samiux

[Paddy Landau]

To make it easy for troubleshooting, I suggest you to disable the Apparmor and unload the profile. If the problem is still there, the problem is not on the Apparmor.

I have already done that, several times.

With the profile disabled, everything works perfectly.

It is only when the profile is activated that I get the problem.

[samiux]

I have already done that, several times.

With the profile disabled, everything works perfectly.

It is only when the profile is activated that I get the problem.

Would you please give me the link where you download the LibreOffice file and I will test it at my side?

Samiux

[Paddy Landau]

Would you please give me the link where you download the LibreOffice file and I will test it at my side?

From the official Libre Office download page.

I do appreciate the time that you are spending.

[samiux]

From the official Libre Office download page.

I do appreciate the time that you are spending.

The page allows me to download tarred files or iso only. It cannot be opened by LibreOffice, I think.

Edit :

Okay, I find this page can download LibreOffice format files. I can download it from Firefox and it automatically opened by LibreOffice at my side with Apparmor for Firefox enabled.

Samiux