1461855 - Snap sandbox seems to break nsNotifyAddrListener::calculateNetworkId

Status: NEW

(Core :: Networking, enhancement, P3)

Description

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

While I was investigating bug 1461848, I noticed this:

[  433.037670] audit: type=1400 audit(1526420842.267:181): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/proc/5205/net/arp" pid=5205 comm=4C696E6B204D6F6E69746F72 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 

The only place in our code that uses that is nsNotifyAddrListener::calculateNetworkId, and it looks like this restriction would cause it to never find a network ID.  This appears to be used only for telemetry, but I thought it was worth reporting.

I notice that the NETWORK_ID telemetry item isn't marked opt-out, so in practice this would apply only to beta, not release.  (There is currently no Snap nightly.)

Comment 1

[Johan Lorenzo [:jlorenzo]]

Thanks for the report and the explanation!

Ken, can `network-setup-observe`[1] be declared[2] to get access to these 2 /proc entries[3]? 

[1] https://docs.snapcraft.io/reference/interfaces
[2] https://searchfox.org/mozilla-central/rev/00dd116638001772fe354b081353b73f1cad405d/taskcluster/docker/firefox-snap/snapcraft.yaml.in#24
[3] https://searchfox.org/mozilla-central/rev/00dd116638001772fe354b081353b73f1cad405d/netwerk/system/linux/nsNotifyAddrListener_Linux.cpp#105-106

Comment 2

[Johan Lorenzo [:jlorenzo]]

I see this bug has been inactive for 2 years and a half. I'm going to close it because of inactivity. Feel free to reopen it!

Comment 3

[Valentin Gosu [:valentin] (he/him)]

This might be a problem for DoH.
I'm moving this to the Necko backlog to track it until it becomes necessary.