User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0

Steps to reproduce:

Install firefox snap and launch it.

The versions used were.
Snap version: firefox 103.0-1 1589 latest/stable
xdg-desktop-portal version: 1.14.3-0ubuntu2

The example link I tried was
https://sourceforge.net/projects/openofficeorg.mirror/files/4.1.13/binaries/en-GB/Apache_OpenOffice_4.1.13_Linux_x86-64_install-rpm_en-GB.tar.gz/download

This link can found at https://www.openoffice.org/download/

Actual results:

The download does not start. No indications are given to the user.

The failure causes apparmor to record to following denials in /var/log/kern/log.

Aug 5 15:22:09 dragon kernel: [19364.169847] kauditd_printk_skb: 352 callbacks suppressed
Aug 5 15:22:09 dragon kernel: [19364.169848] audit: type=1400 audit(1659709329.851:581): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/run/mount/utab" pid=7462 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 5 15:22:09 dragon kernel: [19364.216808] audit: type=1107 audit(1659709329.899:582): pid=1359 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.490" pid=7462 label="snap.firefox.firefox" peer_pid=21181 peer_label="unconfined"
Aug 5 15:22:09 dragon kernel: [19364.216808] exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'
Aug 5 15:22:09 dragon kernel: [19364.216816] audit: type=1420 audit(1659709329.899:583): subj_apparmor=unconfined
Aug 5 15:22:09 dragon kernel: [19364.216839] audit: type=1107 audit(1659709329.899:584): pid=1359 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.490" pid=7462 label="snap.firefox.firefox" peer_pid=21181 peer_label="unconfined"
Aug 5 15:22:09 dragon kernel: [19364.216839] exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'
Aug 5 15:22:09 dragon kernel: [19364.216841] audit: type=1420 audit(1659709329.899:585): subj_apparmor=unconfined
Aug 5 15:22:09 dragon kernel: [19364.216866] audit: type=1107 audit(1659709329.899:586): pid=1359 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.490" pid=7462 label="snap.firefox.firefox" peer_pid=21181 peer_label="unconfined"
Aug 5 15:22:09 dragon kernel: [19364.216866] exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'
Aug 5 15:22:09 dragon kernel: [19364.216868] audit: type=1420 audit(1659709329.899:587): subj_apparmor=unconfined
Aug 5 15:22:09 dragon kernel: [19364.216896] audit: type=1107 audit(1659709329.899:588): pid=1359 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.490" pid=7462 label="snap.firefox.firefox" peer_pid=21181 peer_label="unconfined"
Aug 5 15:22:09 dragon kernel: [19364.216896] exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'
Aug 5 15:22:09 dragon kernel: [19364.216899] audit: type=1420 audit(1659709329.899:589): subj_apparmor=unconfined
Aug 5 15:22:09 dragon kernel: [19364.217115] audit: type=1107 audit(1659709329.899:590): pid=1359 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.490" pid=7462 label="snap.firefox.firefox" peer_pid=21181 peer_label="unconfined"
Aug 5 15:22:09 dragon kernel: [19364.217115] exe="/usr/bin/dbus-daemon" sauid=102 hostname=? addr=? terminal=?'

Expected results:

The target file should have downloaded.

Thanks to Olivier Tilloy https://discourse.ubuntu.com/t/known-issues-with-firefox-snap/24663/103?u=rogerjames99 I now have a workaround. The bug only occurs when Downloads are set to "Always ask" in the Firefox settings.

The workaround does not apply to all cases.

Same applies if you want to save to something like '/tmp' which the Snap won't let you do, but has to be a common use case ?!?

It wouldn't be so bad if there was any feedback at all the save failed, as opposed to the file just being invisible to any other app.

Can you share about:support ? Where are you trying to save files ?

Thanks, it does not have download dir, what do you have for browser.download.dir and/or browser.download.downloadDir in about:config ?

At the moment neither are set. So I presume it is a default. In the Settings dialog the download directory is shown as Downloads and the always is unset. Setting always ask to set does not add either of the settings to config data.

When always ask is set, on launching firefox it tries to perform a scan of all mounted filesystems. The causes Apparmor denials is listed in the original bug reports. After that further denials are logged every time a download is requested. None of these are shown to the user in normal circumstances. Firefox just waits a few seconds and silently ignores the request.

(In reply to Roger James from comment #8)

At the moment neither are set. So I presume it is a default. In the Settings dialog the download directory is shown as Downloads and the always is unset. Setting always ask to set does not add either of the settings to config data.

When always ask is set, on launching firefox it tries to perform a scan of all mounted filesystems. The causes Apparmor denials is listed in the original bug reports. After that further denials are logged every time a download is requested. None of these are shown to the user in normal circumstances. Firefox just waits a few seconds and silently ignores the request.

Should read.
Downloads and the "always ask" is unset

Sorry to ask for that, but there are already many bugs related to downloads, and it really sounds like your behavior is not without precedent, but I can't remember which one. Would you mind going through https://bugzilla.mozilla.org/showdependencytree.cgi?id=1776413&hide_resolved=1 and check if your issue is not already one of those ? Thanks!

https://bugzilla.mozilla.org/show_bug.cgi?id=1738579 Has some Apparmor denied messages buried in the log.

I suspect that Apparmor will be a suspect in a lot of the snap issues. I use the utility aa-notify to display Apparmor DENIALS in the system notification tray. This pops them up as they happen.

Forgot to clear the flag.

(In reply to Roger James from comment #8)

At the moment neither are set. So I presume it is a default. In the Settings dialog the download directory is shown as Downloads and the always is unset. Setting always ask to set does not add either of the settings to config data.

So you have the default setup of ~/Downloads as the target. I am sorry but I am certain this is something that was in another bug. Bug 1738579 is really about NFS.

It reminds me of bug 1772496 maybe

(In reply to Alexandre LISSY :gerard-majax from comment #14)

It reminds me of bug 1772496 maybe

Alexandre,

I had a good look at that bug in the list. That's what prompted me to make the remark in Comment #11. I checked the browser.download.improvements_to_download_panel and it is defaulted to true. I will do a test with it set to to false. Are their any specific debug settings you want, either in apparmor or the firefox snap?

"Are their" should be "are there". Sometimes I wish that bugzilla allowed you to edit your own comments.

Set browser.download.improvements_to_download_panel to false.

With "always ask" false. When the download finishes a dialog pops asking which application you want to use to open the file. In my test case the options are archive manager or file manager. There is no other notification in either the desktop or firefox that the download has completed.

With "always ask" true. The select directory dialog is not displayed. When the download finishes the behaviour is exactly the same as above.

Neither of these outcomes are what I would expect.

Can you run /usr/libexec/xdg-desktop-portal -rv ? I really dont see a good reason this would not work when you have the default folder set to ~/Downloads/

FTR I dont repro the issue here ... Do you see at least the Save File dialog?

snap connections firefox

(In reply to Alexandre LISSY :gerard-majax from comment #18)

Can you run /usr/libexec/xdg-desktop-portal -rv ? I really dont see a good reason this would not work when you have the default folder set to ~/Downloads/

Yes. I can run that.

$ /usr/libexec/xdg-desktop-portal -rv
XDP: load portals from /usr/share/xdg-desktop-portal/portals
XDP: loading /usr/share/xdg-desktop-portal/portals/gnome-shell.portal
XDP: portal implementation for gnome
XDP: portal implementation supports org.freedesktop.impl.portal.Access
XDP: loading /usr/share/xdg-desktop-portal/portals/gnome-keyring.portal
XDP: portal implementation for gnome
XDP: portal implementation supports org.freedesktop.impl.portal.Secret
XDP: loading /usr/share/xdg-desktop-portal/portals/gtk.portal
XDP: portal implementation for gnome
XDP: portal implementation supports org.freedesktop.impl.portal.FileChooser
XDP: portal implementation supports org.freedesktop.impl.portal.AppChooser
XDP: portal implementation supports org.freedesktop.impl.portal.Print
XDP: portal implementation supports org.freedesktop.impl.portal.Notification
XDP: portal implementation supports org.freedesktop.impl.portal.Inhibit
XDP: portal implementation supports org.freedesktop.impl.portal.Access
XDP: portal implementation supports org.freedesktop.impl.portal.Account
XDP: portal implementation supports org.freedesktop.impl.portal.Email
XDP: portal implementation supports org.freedesktop.impl.portal.DynamicLauncher
XDP: portal implementation supports org.freedesktop.impl.portal.Lockdown
XDP: portal implementation supports org.freedesktop.impl.portal.Settings
XDP: loading /usr/share/xdg-desktop-portal/portals/gnome.portal
XDP: portal implementation for gnome
XDP: portal implementation supports org.freedesktop.impl.portal.Account
XDP: portal implementation supports org.freedesktop.impl.portal.AppChooser
XDP: portal implementation supports org.freedesktop.impl.portal.Screenshot
XDP: portal implementation supports org.freedesktop.impl.portal.ScreenCast
XDP: portal implementation supports org.freedesktop.impl.portal.RemoteDesktop
XDP: portal implementation supports org.freedesktop.impl.portal.Lockdown
XDP: portal implementation supports org.freedesktop.impl.portal.Background
XDP: portal implementation supports org.freedesktop.impl.portal.Settings
XDP: portal implementation supports org.freedesktop.impl.portal.Wallpaper
XDP: portal implementation supports org.freedesktop.impl.portal.FileChooser
XDP: portal implementation supports org.freedesktop.impl.portal.Print
XDP: Using gnome.portal for org.freedesktop.impl.portal.Lockdown in GNOME
XDP: providing portal org.freedesktop.portal.MemoryMonitor
XDP: providing portal org.freedesktop.portal.PowerProfileMonitor
XDP: providing portal org.freedesktop.portal.NetworkMonitor
XDP: providing portal org.freedesktop.portal.ProxyResolver
XDP: providing portal org.freedesktop.portal.Trash
XDP: providing portal org.freedesktop.portal.GameMode
XDP: providing portal org.freedesktop.portal.Realtime
XDP: Using gnome.portal for org.freedesktop.impl.portal.Settings
XDP: Using gtk.portal for org.freedesktop.impl.portal.Settings
XDP: providing portal org.freedesktop.portal.Settings
XDP: Using gnome.portal for org.freedesktop.impl.portal.FileChooser in GNOME
XDP: providing portal org.freedesktop.portal.FileChooser
XDP: Using gnome.portal for org.freedesktop.impl.portal.AppChooser in GNOME
XDP: providing portal org.freedesktop.portal.OpenURI
XDP: Using gnome.portal for org.freedesktop.impl.portal.Print in GNOME
XDP: providing portal org.freedesktop.portal.Print
XDP: Using gnome.portal for org.freedesktop.impl.portal.Screenshot in GNOME
XDP: providing portal org.freedesktop.portal.Screenshot
XDP: Using gtk.portal for org.freedesktop.impl.portal.Notification in GNOME
XDP: providing portal org.freedesktop.portal.Notification
XDP: Using gtk.portal for org.freedesktop.impl.portal.Inhibit in GNOME
XDP: providing portal org.freedesktop.portal.Inhibit
XDP: Using gnome-shell.portal for org.freedesktop.impl.portal.Access in GNOME
XDP: Using gnome.portal for org.freedesktop.impl.portal.Background in GNOME
XDP: providing portal org.freedesktop.portal.Device
XDP: providing portal org.freedesktop.portal.WebExtensions
XDP: providing portal org.freedesktop.portal.Location
XDP: providing portal org.freedesktop.portal.Camera
XDP: Starting background app monitor
XDP: providing portal org.freedesktop.portal.Background
XDP: Using gnome.portal for org.freedesktop.impl.portal.Wallpaper in GNOME
XDP: providing portal org.freedesktop.portal.Wallpaper
XDP: Using gnome.portal for org.freedesktop.impl.portal.Account in GNOME
XDP: using org.freedesktop.impl.portal.Account at org.freedesktop.impl.portal.desktop.gnome

XDP: providing portal org.freedesktop.portal.Account
XDP: Using gtk.portal for org.freedesktop.impl.portal.Email in GNOME
XDP: providing portal org.freedesktop.portal.Email
XDP: Using gnome-keyring.portal for org.freedesktop.impl.portal.Secret in GNOME
XDP: providing portal org.freedesktop.portal.Secret
XDP: Using gtk.portal for org.freedesktop.impl.portal.DynamicLauncher in GNOME
XDP: providing portal org.freedesktop.portal.DynamicLauncher
XDP: Using gnome.portal for org.freedesktop.impl.portal.ScreenCast in GNOME
XDP: providing portal org.freedesktop.portal.ScreenCast
XDP: Using gnome.portal for org.freedesktop.impl.portal.RemoteDesktop in GNOME
XDP: providing portal org.freedesktop.portal.RemoteDesktop
XDP: org.freedesktop.portal.Desktop acquired
XDP: Checking background permissions
XDP: Checking background permissions

(In reply to Alexandre LISSY :gerard-majax from comment #19)

FTR I dont repro the issue here ... Do you see at least the Save File dialog?

(In reply to Alexandre LISSY :gerard-majax from comment #19)

FTR I dont repro the issue here ... Do you see at least the Save File dialog?

(In reply to Alexandre LISSY :gerard-majax from comment #19)

FTR I dont repro the issue here ... Do you see at least the Save File dialog?

(In reply to Alexandre LISSY :gerard-majax from comment #19)

FTR I dont repro the issue here ... Do you see at least the Save File dialog?

No.

(In reply to Alexandre LISSY :gerard-majax from comment #20)

snap connections firefox

$ snap connections firefox
Interface Plug Slot Notes
audio-playback firefox:audio-playback :audio-playback -
audio-record firefox:audio-record :audio-record -
avahi-observe firefox:avahi-observe :avahi-observe -
browser-support firefox:browser-sandbox :browser-support -
camera firefox:camera :camera -
content[gnome-3-38-2004] firefox:gnome-3-38-2004 gnome-3-38-2004:gnome-3-38-2004 -
content[gtk-3-themes] firefox:gtk-3-themes gtk-common-themes:gtk-3-themes -
content[icon-themes] firefox:icon-themes gtk-common-themes:icon-themes -
content[sound-themes] firefox:sound-themes gtk-common-themes:sound-themes -
cups-control firefox:cups-control - -
dbus - firefox:dbus-daemon -
desktop firefox:desktop :desktop -
desktop-legacy firefox:desktop-legacy :desktop-legacy -
gsettings firefox:gsettings :gsettings -
hardware-observe firefox:hardware-observe :hardware-observe -
home firefox:home :home -
joystick firefox:joystick :joystick -
mpris - firefox:mpris -
network firefox:network :network -
network-bind firefox:network-bind :network-bind -
network-observe firefox:network-observe - -
opengl firefox:opengl :opengl -
personal-files firefox:dot-mozilla-firefox :personal-files -
removable-media firefox:removable-media :removable-media -
screen-inhibit-control firefox:screen-inhibit-control :screen-inhibit-control -
system-files firefox:etc-firefox-policies :system-files -
system-packages-doc firefox:system-packages-doc :system-packages-doc -
u2f-devices firefox:u2f-devices :u2f-devices -
unity7 firefox:unity7 :unity7 -
upower-observe firefox:upower-observe :upower-observe -
wayland firefox:wayland :wayland -
x11 firefox:x11 :x11

There's nothing indicating a bug there, I still have 0 idea what is happening ... Was your firefox profile imported? If so, do you reproduce on a new profile?

Also, this is a long shot, but I have seen weird behavior due to XWayland. Can you give a try to MOZ_ENABLE_WAYLAND=1 snap run firefox ?

Could you also be a victim of some variant of bug 1780526 ? Does /usr/libexec/xdg-desktop-portal-gtk -rv works and/or /usr/libexec/xdg-desktop-portal-gnome -rv

(In reply to Alexandre LISSY :gerard-majax from comment #24)

There's nothing indicating a bug there, I still have 0 idea what is happening ... Was your firefox profile imported? If so, do you reproduce on a new profile?

Prior to reporting this I removed and reinstalled the snap. Then ran the profile rebuild. I think I then tried deleting and creating the profile from scratch, but I am not 100% sure. I will try and completly reinstall from scratch. Do you have any suggestions on where I should check the make sure I have completly removed all residual config?

(In reply to Alexandre LISSY :gerard-majax from comment #25)

Also, this is a long shot, but I have seen weird behavior due to XWayland. Can you give a try to MOZ_ENABLE_WAYLAND=1 snap run firefox ?

I wil try this before doing a reinstall.

(In reply to Roger James from comment #27)

(In reply to Alexandre LISSY :gerard-majax from comment #24)

There's nothing indicating a bug there, I still have 0 idea what is happening ... Was your firefox profile imported? If so, do you reproduce on a new profile?

Prior to reporting this I removed and reinstalled the snap. Then ran the profile rebuild. I think I then tried deleting and creating the profile from scratch, but I am not 100% sure. I will try and completly reinstall from scratch. Do you have any suggestions on where I should check the make sure I have completly removed all residual config?

I wil try this before doing a reinstall.

(In reply to Alexandre LISSY :gerard-majax from comment #25)

Also, this is a long shot, but I have seen weird behavior due to XWayland. Can you give a try to MOZ_ENABLE_WAYLAND=1 snap run firefox ?

This is what appears in the terminal window.

MOZ_ENABLE_WAYLAND=1 snap run firefox
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/libreoffice/help /usr/share/libreoffice/help none bind,ro 0 0): cannot create directory "/usr/share/libreoffice/help": permission denied
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/xubuntu-docs /usr/share/xubuntu-docs none bind,ro 0 0): cannot open directory "/var/lib": permission denied
[GFX1-]: glxtest: VA-API test failed: no supported VAAPI profile found.
Missing chrome or resource URL: resource://gre/modules/UpdateListener.sys.mjs

This is what appears in the system log

Aug 26 08:55:24 dragon kernel: [   39.682721] audit: type=1400 audit(1661500524.713:93): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=1541 comm="cupsd" capability=12  capname="net_admin"
Aug 26 08:55:32 dragon kernel: [   47.732543] audit: type=1400 audit(1661500532.761:94): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=1727 comm="cups-browsed" capability=23  capname="sys_nice"
Aug 26 08:55:43 dragon kernel: [   58.124120] audit: type=1400 audit(1661500543.153:95): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=1951 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:43 dragon kernel: [   58.124123] audit: type=1400 audit(1661500543.153:96): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=1951 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:45 dragon kernel: [   60.393199] audit: type=1400 audit(1661500545.474:97): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=1951 comm="snap-confine" capability=4  capname="fsetid"
Aug 26 08:55:48 dragon kernel: [   62.844754] audit: type=1400 audit(1661500547.994:98): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2079 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   62.844758] audit: type=1400 audit(1661500547.994:99): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2079 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:48 dragon kernel: [   63.132641] audit: type=1400 audit(1661500548.288:100): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2103 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   63.132645] audit: type=1400 audit(1661500548.288:101): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2103 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:48 dragon kernel: [   63.332326] audit: type=1400 audit(1661500548.488:102): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2128 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   63.332331] audit: type=1400 audit(1661500548.488:103): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2128 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:48 dragon kernel: [   63.579724] audit: type=1400 audit(1661500548.742:104): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2151 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   63.579728] audit: type=1400 audit(1661500548.742:105): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2151 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:56:24 dragon kernel: [   98.926162] audit: type=1400 audit(1661500584.245:106): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2773 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:56:24 dragon kernel: [   98.926165] audit: type=1400 audit(1661500584.245:107): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2773 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:59:40 dragon kernel: [  295.604762] audit: type=1400 audit(1661500780.939:109): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=4190 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:59:40 dragon kernel: [  295.604765] audit: type=1400 audit(1661500780.939:110): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=4190 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:59:40 dragon kernel: [  295.606795] audit: type=1400 audit(1661500780.939:111): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=4190 comm="snap-confine" capability=4  capname="fsetid"
Aug 26 08:59:41 dragon kernel: [  295.673335] audit: type=1400 audit(1661500781.007:112): apparmor="DENIED" operation="mkdir" profile="snap-update-ns.firefox" name="/usr/share/libreoffice/help/" pid=4209 comm="5" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Aug 26 08:59:41 dragon kernel: [  295.673393] audit: type=1400 audit(1661500781.007:113): apparmor="DENIED" operation="open" profile="snap-update-ns.firefox" name="/var/lib/" pid=4209 comm="5" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

The behaviour is the same as reported in Comment #17.

On exit the following appears in the terminal window.

2022-08-26T08:20:37Z ERROR viaduct::backend::ffi] Missing HTTP status
2022-08-26T08:20:37Z ERROR viaduct::backend::ffi] Missing HTTP status

(In reply to Roger James from comment #30)

(In reply to Alexandre LISSY :gerard-majax from comment #25)

Also, this is a long shot, but I have seen weird behavior due to XWayland. Can you give a try to MOZ_ENABLE_WAYLAND=1 snap run firefox ?

This is what appears in the terminal window.

MOZ_ENABLE_WAYLAND=1 snap run firefox
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/libreoffice/help /usr/share/libreoffice/help none bind,ro 0 0): cannot create directory "/usr/share/libreoffice/help": permission denied
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/xubuntu-docs /usr/share/xubuntu-docs none bind,ro 0 0): cannot open directory "/var/lib": permission denied
[GFX1-]: glxtest: VA-API test failed: no supported VAAPI profile found.
Missing chrome or resource URL: resource://gre/modules/UpdateListener.sys.mjs

This is what appears in the system log

Aug 26 08:55:24 dragon kernel: [   39.682721] audit: type=1400 audit(1661500524.713:93): apparmor="DENIED" operation="capable" profile="/usr/sbin/cupsd" pid=1541 comm="cupsd" capability=12  capname="net_admin"
Aug 26 08:55:32 dragon kernel: [   47.732543] audit: type=1400 audit(1661500532.761:94): apparmor="DENIED" operation="capable" profile="/usr/sbin/cups-browsed" pid=1727 comm="cups-browsed" capability=23  capname="sys_nice"
Aug 26 08:55:43 dragon kernel: [   58.124120] audit: type=1400 audit(1661500543.153:95): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=1951 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:43 dragon kernel: [   58.124123] audit: type=1400 audit(1661500543.153:96): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=1951 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:45 dragon kernel: [   60.393199] audit: type=1400 audit(1661500545.474:97): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=1951 comm="snap-confine" capability=4  capname="fsetid"
Aug 26 08:55:48 dragon kernel: [   62.844754] audit: type=1400 audit(1661500547.994:98): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2079 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   62.844758] audit: type=1400 audit(1661500547.994:99): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2079 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:48 dragon kernel: [   63.132641] audit: type=1400 audit(1661500548.288:100): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2103 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   63.132645] audit: type=1400 audit(1661500548.288:101): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2103 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:48 dragon kernel: [   63.332326] audit: type=1400 audit(1661500548.488:102): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2128 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   63.332331] audit: type=1400 audit(1661500548.488:103): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2128 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:55:48 dragon kernel: [   63.579724] audit: type=1400 audit(1661500548.742:104): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2151 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:55:48 dragon kernel: [   63.579728] audit: type=1400 audit(1661500548.742:105): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2151 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:56:24 dragon kernel: [   98.926162] audit: type=1400 audit(1661500584.245:106): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2773 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:56:24 dragon kernel: [   98.926165] audit: type=1400 audit(1661500584.245:107): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=2773 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:59:40 dragon kernel: [  295.604762] audit: type=1400 audit(1661500780.939:109): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=4190 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 08:59:40 dragon kernel: [  295.604765] audit: type=1400 audit(1661500780.939:110): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=4190 comm="snap-confine" capability=38  capname="perfmon"
Aug 26 08:59:40 dragon kernel: [  295.606795] audit: type=1400 audit(1661500780.939:111): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=4190 comm="snap-confine" capability=4  capname="fsetid"
Aug 26 08:59:41 dragon kernel: [  295.673335] audit: type=1400 audit(1661500781.007:112): apparmor="DENIED" operation="mkdir" profile="snap-update-ns.firefox" name="/usr/share/libreoffice/help/" pid=4209 comm="5" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Aug 26 08:59:41 dragon kernel: [  295.673393] audit: type=1400 audit(1661500781.007:113): apparmor="DENIED" operation="open" profile="snap-update-ns.firefox" name="/var/lib/" pid=4209 comm="5" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

The behaviour is the same as reported in Comment #17.

On exit the following appears in the terminal window.

2022-08-26T08:20:37Z ERROR viaduct::backend::ffi] Missing HTTP status
2022-08-26T08:20:37Z ERROR viaduct::backend::ffi] Missing HTTP status

(In reply to Roger James from comment #27)

(In reply to Alexandre LISSY :gerard-majax from comment #24)

There's nothing indicating a bug there, I still have 0 idea what is happening ... Was your firefox profile imported? If so, do you reproduce on a new profile?

Prior to reporting this I removed and reinstalled the snap. Then ran the profile rebuild. I think I then tried deleting and creating the profile from scratch, but I am not 100% sure. I will try and completly reinstall from scratch. Do you have any suggestions on where I should check the make sure I have completly removed all residual config?

I created a new profile and did not change anything in it. So it should be completely default. I then launched a new copy of the browser and pasted in the original test url. The following appeared in syslog.

Aug 26 08:59:41 dragon kernel: [  295.673393] audit: type=1400 audit(1661500781.007:113): apparmor="DENIED" operation="open" profile="snap-update-ns.firefox" name="/var/lib/" pid=4209 comm="5" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Aug 26 10:03:20 dragon kernel: [ 4114.836487] audit: type=1400 audit(1661504600.250:115): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=9979 comm="snap-confine" capability=12  capname="net_admin"
Aug 26 10:03:20 dragon kernel: [ 4114.836493] audit: type=1400 audit(1661504600.250:116): apparmor="DENIED" operation="capable" profile="/usr/lib/snapd/snap-confine" pid=9979 comm="snap-confine" capability=38  capname="perfmon"

The browser went to the download site and after a few seconds the site refreshed itself as though the download has finished. No more more confinement errors were reported in syslog. Nothing was reported in the browser UI. I then re ran the test with a browser console window open and the download worked! I then ran the test again this time "with always" ask set.

I got this in syslog.

Aug 26 10:33:58 dragon kernel: [ 5953.347121] audit: type=1400 audit(1661506438.767:121): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/run/mount/utab" pid=16651 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 26 10:33:58 dragon kernel: [ 5953.410773] audit: type=1400 audit(1661506438.831:122): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/run/mount/utab" pid=16651 comm="firefox" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Aug 26 10:33:58 dragon kernel: [ 5953.460457] audit: type=1107 audit(1661506438.879:123): pid=1428 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.281" pid=16651 label="snap.firefox.firefox" peer_pid=18946 peer_label="unconfined"
Aug 26 10:33:58 dragon kernel: [ 5953.460627] audit: type=1107 audit(1661506438.879:125): pid=1428 uid=102 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/hostname1" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.281" pid=16651 label="snap.firefox.firefox" peer_pid=18946 peer_label="unconfined"

The ask dialog came up and I accepted the default (Downloads). No further indications appeared in browser ui. However when I checked the downloads directory I found that the file had been downloaded!

-r-------- 1 roger roger 161290460 Aug 26 09:18  Apache_OpenOffice_4.1.13_Linux_x86-64_install-rpm_en-GB.tar-4.gz
-r-------- 1 roger roger 161290460 Aug 26 09:20  Apache_OpenOffice_4.1.13_Linux_x86-64_install-rpm_en-GB.tar-5.gz
-rw-rw-r-- 1 roger roger 161290460 Aug 26 10:30 'Apache_OpenOffice_4.1.13_Linux_x86-64_install-rpm_en-GB(2).tar.gz'
-rw-rw-r-- 1 roger roger 161290460 Aug 26 10:38  Apache_OpenOffice_4.1.13_Linux_x86-64_install-rpm_en-GB.tar.gz

It is the last one in this list. I am now confused.

I launched a new instance of the browser with the original profile and got both a progress wheel and an ask UI. I am now very confused.

I went back to the original (new profile) instance and got the same. I now had a progress wheel in the new profile. I am now extremely confused.

I give up!

I realise now that my snap version has been updated to 104.0. This explains some of the confusion. At lot of the confinement errors have gone but not all. The behaviour of my test download now aa s foolows.

The file starts to download and the progress wheel appears. When the download completes a file open dialog open asking me which application I want to use. The options given are file manager or archive manager.

This behaviour is the identical irrespective of whether the "Always Ask" option is set or unset.

So to get the file into a specific directory you have to select the File Manager option and then move the file from the Downloads folder to your target folder.

This not the behaviour I would expect.

(In reply to Roger James from comment #33)

I realise now that my snap version has been updated to 104.0. This explains some of the confusion. At lot of the confinement errors have gone but not all. The behaviour of my test download now aa s foolows.

The file starts to download and the progress wheel appears. When the download completes a file open dialog open asking me which application I want to use. The options given are file manager or archive manager.

This behaviour is the identical irrespective of whether the "Always Ask" option is set or unset.

So to get the file into a specific directory you have to select the File Manager option and then move the file from the Downloads folder to your target folder.

This not the behaviour I would expect.

Can you verify about:support again? Any pref you flipped? Do you repro on a clean profile?

It sounds like a very different issue now, it might be better to mark this bug as RESOLVED:WORKSFORME and file a new one ?

The latest about:support

(In reply to Roger James from comment #35)

Created attachment 9292967 [details]
about-support.txt

The latest about:support

Thanks, seems like there is still nothing changed on the side of preferences.

Please dont forget to file a new bug with as much as details as you can and clear STRs so maybe I can reproduce it, and mark it blocking snap and snap-download meta bugs

I will try and do a full test on a clean profile early next week. Just a little busy this weekend.

I not am going to raise a new bug.

I have tried to two approaches to isolate the cause of the behaviour I am seeing.

1. Start from my original profile and remove things.
2. Start from a new profile and add things.

I could not make approach one work. The size of the original profile directory was huge. Something in the bit that that I could not sensibly edit was still causing the problem.

I could not get approach two to fail by adding the settings that I had removed in approach one.

I think this problem is too difficult to isolate.

(In reply to Roger James from comment #39)

I not am going to raise a new bug.

I have tried to two approaches to isolate the cause of the behaviour I am seeing.

1. Start from my original profile and remove things.
2. Start from a new profile and add things.

I could not make approach one work. The size of the original profile directory was huge. Something in the bit that that I could not sensibly edit was still causing the problem.

Does it means the problem still reproduces on your original profile ?

I could not get approach two to fail by adding the settings that I had removed in approach one.

Does it means that on a fresh profile, you cannot repro the bug anymore ?

I think this problem is too difficult to isolate.

If you have the issue, others might, so it would really be nice if we could isolate what is going on here.

Could it be due to AdBlock Plus ?

By chance, if it does not repro on a new profile, can you share its about:support as well? I'm curious about TCP rollout, Phase III (TCP on by default for 95% EXISTING Release profiles): control

Looks like I missed those two earlier, it might relate:

browser.download.improvements_to_download_panel: false
browser.download.useDownloadDir: false

(In reply to Alexandre LISSY :gerard-majax from comment #40)

(In reply to Roger James from comment #39)

I not am going to raise a new bug.

I have tried to two approaches to isolate the cause of the behaviour I am seeing.

1. Start from my original profile and remove things.
2. Start from a new profile and add things.

I could not make approach one work. The size of the original profile directory was huge. Something in the bit that that I could not sensibly edit was still causing the problem.

Does it means the problem still reproduces on your original profile ?

Yes

I could not get approach two to fail by adding the settings that I had removed in approach one.

Does it means that on a fresh profile, you cannot repro the bug anymore ?

Yes

I think this problem is too difficult to isolate.

If you have the issue, others might, so it would really be nice if we could isolate what is going on here.

(In reply to Alexandre LISSY :gerard-majax from comment #41)

Could it be due to AdBlock Plus ?

No. Addblock plus is enabled in the new profile.

New profile with selected additions from old profile.

(In reply to Alexandre LISSY :gerard-majax from comment #42)

By chance, if it does not repro on a new profile, can you share its about:support as well? I'm curious about TCP rollout, Phase III (TCP on by default for 95% EXISTING Release profiles): control

I have attached a file of about:support based on the new profile with the selected additions from my old profile.

(In reply to Alexandre LISSY :gerard-majax from comment #43)

Looks like I missed those two earlier, it might relate:

browser.download.improvements_to_download_panel: false
browser.download.useDownloadDir: false

"Always ask" is set in the basic settings, browser.download.useDownloadDir does not seem to be affected by this setting.

(In reply to Roger James from comment #45)

(In reply to Alexandre LISSY :gerard-majax from comment #41)

Could it be due to AdBlock Plus ?

No. Addblock plus is enabled in the new profile.

Yes, but maybe it has a small configuration change ?

Wait, your about:support has several references to Thunderbird, and it does not have browser.download.improvements_to_download_panel: false. The ordering of locales is also different, en-US as first in the bogus one, en-GB in the correct one.

Also, MOZ_ENABLE_WAYLAND: 0 is set in the profile where it works.

Do you mind verifying those points ? meld can help visualize the differences

This is the original about:support in text format.

Feel free to meld these.

Thanks, MOZ_ENABLE_WAYLAND=0 on both now. You still have browser.download.improvements_to_download_panel: false set on the bogus profile, so I'm wondering if it is the cause, and if it does it's something that was mentionned in another of the bugs reports. Do you mind giving a try to this pref ? You might need to restart the browser.

Setting browser.downloads.improvements_to_download_panel true fixes the problem.

So it looks like a combination of MOZ_ENABLE_WAYLAND=0 and browser.download.improvements_to_download_panel: true fixes the problem.