Apparmor问题: Icedtea插件冻结firefox (35.0.1)

Question

EDIT5:最后，这可能是一个Apparmor问题。

/usr/lib/firefox/firefox{,*[^s][^h]}

确实是在抱怨，但是

/usr/lib/firefox/firefox{,*[^s][^h]}//browser_java
/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk
/usr/lib/firefox/firefox{,*[^s][^h]}//sanitized_helper

都处于强制模式。我不知道怎样才能让他们抱怨。我在/etc/parmor.d/中拥有的唯一配置文件是usr.bin.firefox (其中/usr/bin/火狐显然是指向/usr/lib/firefox/Firefox.sh的链接)，并且我做了sudo aa--抱怨/etc/parmor.d/usr.bin.FireFox有一个错误报告https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1293439标记为‘修复释放’，但我似乎不喜欢修复:-)

解决方法之一是遵循这里所述的方法( 如何在Ubuntu14.04上使用和装甲插件冰茶？ )，即完全禁用firefox配置文件：

sudo ln -s /etc/apparmor.d/usr.bin.firefox /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.bin.firefox
sudo service apparmor reload

但正如“任择议定书”所述，这不是一个令人满意的解决办法.到目前为止，还没有人提出更好的解决方案。

以下是来自Apparmor的拒绝消息：

type=AVC msg=audit(1424428803.909:134): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-franck-OzMRPQ/4468-icedteanp-plugin-debug-to-appletviewer" pid=4513 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428803.909:135): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/icedteaplugin-franck-OzMRPQ/4468-icedteanp-plugin-to-appletviewer" pid=4480 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.046:136): apparmor="DENIED" operation="exec" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/usr/bin/logger" pid=4514 comm="java" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

type=AVC msg=audit(1424428804.395:137): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/proc/4477/cmdline" pid=4480 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.406:138): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/dconf/user" pid=4480 comm="java" requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.407:139): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/dconf/user" pid=4480 comm="java" requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.407:140): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/dconf/user" pid=4480 comm="java" requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.407:141): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/dconf/user" pid=4480 comm="java" requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.408:142): apparmor="DENIED" operation="connect" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" pid=4517 comm=64636F6E6620776F726B6572 family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/dbus-VT8SEPjAqx" peer="unconfined"

type=AVC msg=audit(1424428804.408:143): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/dconf/user" pid=4517 comm=64636F6E6620776F726B6572 requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.408:144): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/run/user/1000/dconf/user" pid=4517 comm=64636F6E6620776F726B6572 requested_mask="wrc" denied_mask="wrc" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428804.880:145): apparmor="DENIED" operation="connect" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" pid=4480 comm="java" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/dbus-VT8SEPjAqx" peer="unconfined"

type=AVC msg=audit(1424428804.881:146): apparmor="DENIED" operation="connect" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" pid=4480 comm="java" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/dbus-VT8SEPjAqx" peer="unconfined"

type=AVC msg=audit(1424428804.929:147): apparmor="DENIED" operation="connect" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" pid=4480 comm="java" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/dbus-VT8SEPjAqx" peer="unconfined"

type=AVC msg=audit(1424428804.931:148): apparmor="DENIED" operation="connect" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" pid=4480 comm="java" family="unix" sock_type="stream" protocol=0 requested_mask="send receive connect" denied_mask="send connect" addr=none peer_addr="@/tmp/dbus-VT8SEPjAqx" peer="unconfined"

type=AVC msg=audit(1424428805.106:149): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/proc/sys/net/ipv4/ip_local_port_range" pid=4480 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

type=AVC msg=audit(1424428805.106:150): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/proc/sys/net/ipv4/ip_local_port_range" pid=4480 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

type=AVC msg=audit(1424428805.929:151): apparmor="DENIED" operation="open" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/home/franck/.mozilla/firefox/profiles.ini" pid=4480 comm="java" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

type=AVC msg=audit(1424428805.930:152): apparmor="DENIED" operation="exec" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/usr/bin/logger" pid=4519 comm="java" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

type=AVC msg=audit(1424428805.981:153): apparmor="DENIED" operation="exec" profile="/usr/lib/firefox/firefox{,*[^s][^h]}//browser_openjdk" name="/usr/bin/logger" pid=4520 comm="java" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0

=============================================================================

我需要使用java小程序来访问一些客户端VPN门户，我正在尝试使用Ubuntu14.10/ Firefox 35.0.1上的Icedtea插件。

每当我尝试运行applet时，Firefox都会冻结一段时间。这可能需要很长时间，我可能不得不杀死Firefox。

这种情况似乎发生在我尝试的每一个小程序中，例如，在这里找到的每个applet都是http://icedtea.classpath.org/wiki/IcedTea-Web-Tests。

我找不到任何有日志的.icedtea目录。

从终端运行Firefox会给我一些信息：

java version "1.7.0_75"
OpenJDK Runtime Environment (IcedTea 2.5.4) (7u75-2.5.4-1~utopic1)
OpenJDK 64-Bit Server VM (build 24.75-b04, mixed mode)
java.io.FileNotFoundException: /run/user/1000/icedteaplugin-franck-2KgVYB/2434-icedteanp-plugin-to-appletviewer (Permission non accordée)
    at java.io.FileInputStream.open(Native Method)
    at java.io.FileInputStream.<init>(FileInputStream.java:146)
    at java.io.FileInputStream.<init>(FileInputStream.java:101)
    at sun.applet.PluginMain.connect(PluginMain.java:186)
    at sun.applet.PluginMain.main(PluginMain.java:148)
<snip>
Something very bad happened. I don't know what to do, so I am going to exit :(

###!!! [Parent][MessageChannel::Call] Error: Channel timeout: cannot send/recv

知道怎么解决这个问题吗？

编辑:对于Firefox，我确保apparmor处于抱怨模式，而不是强制执行模式。

EDIT2:用'firefox‘重新运行，但是没有得到更多的信息。以下是运行applet时的输出：

[New Thread 0x7ffd5a3fe700 (LWP 5254)]
java version "1.7.0_75"
OpenJDK Runtime Environment (IcedTea 2.5.4) (7u75-2.5.4-1~utopic1)
OpenJDK 64-Bit Server VM (build 24.75-b04, mixed mode)
java.io.FileNotFoundException: /run/user/1000/icedteaplugin-franck-s7zldV/5255-icedteanp-plugin-to-appletviewer (Permission non accordée)
    at java.io.FileInputStream.open(Native Method)
    at java.io.FileInputStream.<init>(FileInputStream.java:146)
    at java.io.FileInputStream.<init>(FileInputStream.java:101)
    at sun.applet.PluginMain.connect(PluginMain.java:186)
    at sun.applet.PluginMain.main(PluginMain.java:148)


(<unknown>:5264): dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission non accordée.  dconf will not work properly.
(<unknown>:5264): dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission non accordée.  dconf will not work properly.
(<unknown>:5264): dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission non accordée.  dconf will not work properly.
(<unknown>:5264): dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission non accordée.  dconf will not work properly.
(<unknown>:5264): dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission non accordée.  dconf will not work properly.
(<unknown>:5264): dconf-CRITICAL **: unable to create file '/run/user/1000/dconf/user': Permission non accordée.  dconf will not work properly.
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_register_object: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
(<unknown>:5264): GLib-GIO-CRITICAL **: g_dbus_connection_get_unique_name: assertion 'G_IS_DBUS_CONNECTION (connection)' failed
Unable to use Firefox's proxy settings. Using "DIRECT" as proxy type.
Something very bad happened. I don't know what to do, so I am going to exit :(

###!!! [Parent][MessageChannel::Call] Error: Channel timeout: cannot send/recv

下面是ls的输出：

~$ ls -l /run/user/1000/icedteaplugin-franck-s7zldV/5255-icedteanp-plugin-to-appletviewer
prw------- 1 franck franck 0 févr. 18 09:41 /run/user/1000/icedteaplugin-franck-s7zldV/5255-icedteanp-plugin-to-appletviewer

EDIT4:可能与此https://bugzilla.redhat.com/show_bug.cgi?id=976833相关

Answer 1

首先，将子配置文件转换为抱怨模式。您可以通过将flags=(抱怨)添加到配置文件来手动完成此操作。

eg.
/usr/lib/firefox/firefox{,*[^s][^h]}//browser_java flags=(complain) {
   ...
}

完成后，重新加载配置文件。

现在，您首先需要添加到/usr/lib/firefox/firefox{，*S}//browser_openjdk中，以修复列出的拒绝。请注意，在添加这些消息后，可能会有更多的消息被拒绝。另外，您应该检查/var/log/syslog中是否有被拒绝的消息，因为Ubuntu打开了扩展的dbus中介，并且它的拒绝不会转到内核环缓冲区。此外，应该重新加载此配置文件，以确保添加了新规则。

/usr/bin/logger Pix, # choose transition that makes sense for your profiles

/proc/sys/net/ipv4/ip_local_port_range r,
/proc/@{pid}/cmdline r,

owner @{HOME}/.mozilla/firefox/profiles.ini r,
owner /run/user/1000/dconf/user rw,
owner /run/user/1000/icedteaplugin-franck-OzMRPQ/4468-icedteanp-plugin-to-appletviewer r,

unix peer=(addr=@/tmp/dbus-* label=unconfined),

Answer 2

您可以尝试将以下规则添加到..../browser_openjdk子配置文件中：

owner /run/user/*/icedteaplugin-*/* r,
/usr/bin/logger Pix,
@{PROC}/@{pid}/cmdline r,
owner /run/user/*/dconf/user rw,
@{PROC}/sys/net/ipv4/ip_local_port_range r,
owner @{HOME}/.mozilla/firefox/profiles.ini r,
unix (send, receive, connect),

我会有点担心这些特权，我不知道dconf中存储的全部内容，但是我不愿意把它给网络上的每个Java小程序。允许Java通过Unix域套接字连接到非受限进程也可能是逃避的途径。

谢谢