1738579 - Cannot save to network (NFS) folder in 93.0 Linux

Status: UNCONFIRMED

(Core :: Widget: Gtk, defect)

Description

[Will]

Attachment: Screenshot from 2021-10-31 07-05-36.png

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:93.0) Gecko/20100101 Firefox/93.0

Steps to reproduce:

After upgrading Ubuntu to 21.10 (did Firefox go from package to snap installation here) I cannot save to a network (NFS) folder that is mounted as a subfolder of my home directory. The folder is on a Synology NAS. This worked previously (21.04) and I can still save to the folder using the file manager as well as Chrome. I have attached the snap permissions as a screenshot.

To mount the folder:
sudo mount -t nfs 192.168.2.12:/volume1/joe /home/joe/network_files

To create a file to save:

1. Go to any website.
2. Print (Ctrl+P)
3. Select Save as PDF
4. Browse to /home/joe/network_files (you can see the files so no issue reading)
5. Hit save

Actual results:

Could not read the contents of network_files

Error opening directory '/home/joe/network_files': Permission denied

Expected results:

File should have been saved

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Firefox::File Handling' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Will]

When I do click away the permission denied message and try to save then exactly 10,000 empty (0 bytes) files are created in the destination directory. Named as:

Example.pdf
...
Example-9999.pdf

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:Gijs, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Marco Bonardo [:mak]]

Could you please post additional version information about Snap (use snap version)

Comment 5

[Will]

snap 2.53+21.10ubuntu1
snapd 2.53+21.10ubuntu1
series 16
ubuntu 21.10
kernel 5.13.0-21-generic

I did end up uninstalling the Snap version of Firefox and installing it via apt. The problem went away so definitely seems to be an issue with Snap. Happy to reinstall the Snap version if you need any further info.

Comment 6

[Olivier Tilloy]

Will, if you don't mind, could you please re-install the snap, capture the output of journalctl -f while reproducing the problem, and share it here?

Comment 7

[Will]

Attachment: journalctl output

Comment 8

[Will]

Attachment: journalctl_firefox_save_network_folder

Attached. Let me know if that has what you need.

Comment 9

[:Gijs (he/him)]

(In reply to will.r.johnson from comment #8)

Attached. Let me know if that has what you need.

Bouncing needinfo so this doesn't get lost...

Comment 10

[Olivier Tilloy]

Thanks Will. The following denial looks relevant:

Nov 19 17:00:31 serenity audit[4133655]: AVC apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/will/galactica/OneDrive/business/Google.pdf" pid=4133655 comm="GeckoMain" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1024

Can you confirm your NFS is mounted under /home/will/galactica/ ?

Can you run snap run --shell firefox, and in the shell you'll get, run the following commands and share their output?

echo $HOME

ls /home/will

ls /home/will/galactica/OneDrive/business

Comment 11

[Will]

yes, the NFS is mounted at /home/will/galactica

echo $HOME

/home/will

ls /home/will

(list of files in my home folder including galactica)

ls /home/will/galactica/OneDrive/business

(list of folders and files in that folder)

Comment 12

[:gerard-majax]

Do you still experience this problem ?

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

Redirect a needinfo that is pending on an inactive user to the triage owner.
:stransky, since the bug has recent activity, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 14

[Will]

Sorry for the delayed response on this. It is still still an issue with 102.0.1 installed today via snap on Ubuntu 21.10.

Comment 15

[:gerard-majax]

A lot might have changed since your last comments, do you mind reproducing while running /usr/libexec/xdg-desktop-portal -rv and share its output?

Also snap connections firefox.

And I'm also curious of knowing exactly what error message you get now. Can you try mounting the NFS share via gvfs also? You might be hitting https://bugzilla.mozilla.org/show_bug.cgi?id=1773624 as well.

Comment 16

[Will]

Attachment: Requested output

Comment 17

[Will]

Firefox 103 (64-bit)
Mozilla Firefox Snap for Ubuntu
canonical-002 - 1.0

XDP: providing portal org.freedesktop.portal.Account
XDP: Using gtk.portal for org.freedesktop.impl.portal.Email in GNOME
XDP: providing portal org.freedesktop.portal.Email
XDP: Using gnome-keyring.portal for org.freedesktop.impl.portal.Secret in GNOME
XDP: providing portal org.freedesktop.portal.Secret
XDP: Using gtk.portal for org.freedesktop.impl.portal.ScreenCast in GNOME
XDP: providing portal org.freedesktop.portal.ScreenCast
XDP: Using gtk.portal for org.freedesktop.impl.portal.RemoteDesktop in GNOME
XDP: providing portal org.freedesktop.portal.RemoteDesktop
XDP: org.freedesktop.portal.Desktop acquired
XDP: Running: snap routine portal-info 7224
XDP: Handling SaveFile
XDP: convert uri file:///home/will/galactica/Google.pdf -> file:///home/will/galactica/Google.pdf

XDP: Checking background permissions
XDP: No background permissions found: No entry for background

Error message from Firefox:

"Could not read the contents of galactica"
Error opening directory '/home/will/galactica': Permission denied

It only created one file "Google.pdf" of zero bytes rather than 10,000 files like it had been.

snap connections firefox

Interface Plug Slot Notes
audio-playback firefox:audio-playback :audio-playback -
audio-record firefox:audio-record :audio-record -
avahi-observe firefox:avahi-observe :avahi-observe -
browser-support firefox:browser-sandbox :browser-support -
camera firefox:camera :camera -
content[gnome-3-38-2004] firefox:gnome-3-38-2004 gnome-3-38-2004:gnome-3-38-2004 -
content[gtk-3-themes] firefox:gtk-3-themes gtk-common-themes:gtk-3-themes -
content[icon-themes] firefox:icon-themes gtk-common-themes:icon-themes -
content[sound-themes] firefox:sound-themes gtk-common-themes:sound-themes -
cups-control firefox:cups-control :cups-control -
dbus - firefox:dbus-daemon -
desktop firefox:desktop :desktop -
desktop-legacy firefox:desktop-legacy :desktop-legacy -
gsettings firefox:gsettings :gsettings -
hardware-observe firefox:hardware-observe :hardware-observe -
home firefox:home :home -
joystick firefox:joystick :joystick -
mpris - firefox:mpris -
network firefox:network :network -
network-bind firefox:network-bind :network-bind -
network-observe firefox:network-observe - -
opengl firefox:opengl :opengl -
personal-files firefox:dot-mozilla-firefox :personal-files -
removable-media firefox:removable-media :removable-media -
screen-inhibit-control firefox:screen-inhibit-control :screen-inhibit-control -
system-files firefox:etc-firefox-policies :system-files -
system-packages-doc firefox:system-packages-doc :system-packages-doc -
u2f-devices firefox:u2f-devices :u2f-devices -
unity7 firefox:unity7 :unity7 -
upower-observe firefox:upower-observe :upower-observe -
wayland firefox:wayland :wayland -
x11 firefox:x11 :x11 -

Trying to mount drive by browsing via Gnome's file manager:

Unable to access location
Failed to retreive share list from server: Operation not permitted

XDP: Using gtk.portal for org.freedesktop.impl.portal.RemoteDesktop in GNOME
XDP: providing portal org.freedesktop.portal.RemoteDesktop
XDP: org.freedesktop.portal.Desktop acquired
XDP: Checking background permissions
XDP: No background permissions found: No entry for background

Comment 18

[:Gijs (he/him)]

Sticking needinfo back on given data supplied by the reporter (thank you!).

Comment 19

[:gerard-majax]

Sorry but it looks like the permissions error is not shown on that output. Can you re-do with G_DEBUG=1 /usr/libexec/xdg-desktop-portal -rv ? And maybe a look at journalctl -xe as well

Comment 20

[Will]

I upgraded to Ubuntu 22.04 yesterday but still having the issue.

That setting doesn't seem to be showing anything more:

XDP: No background permissions found: No entry for background
XDP: Running: snap routine portal-info 98317
XDP: Handling SaveFile
XDP: convert uri file:///home/will/galactica/Google.pdf -> file:///home/will/galactica/Google.pdf

XDP: Checking background permissions
XDP: No background permissions found: No entry for background

Here is journalctl -xe:

Jul 29 21:27:20 serenity audit[1326]: USER_AVC pid=1326 uid=103 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedeskto>
exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Jul 29 21:27:20 serenity audit: MAC_TASK_CONTEXTS subj_apparmor=unconfined
Jul 29 21:27:20 serenity kernel: audit: type=1107 audit(1659148040.731:1212): pid=1326 uid=103 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus>
exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Jul 29 21:27:20 serenity kernel: audit: type=1420 audit(1659148040.731:1213): subj_apparmor=unconfined
Jul 29 21:27:20 serenity kernel: audit: type=1107 audit(1659148040.731:1214): pid=1326 uid=103 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus>
exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Jul 29 21:27:20 serenity kernel: audit: type=1420 audit(1659148040.731:1215): subj_apparmor=unconfined
Jul 29 21:27:20 serenity kernel: audit: type=1107 audit(1659148040.731:1216): pid=1326 uid=103 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus>
exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Jul 29 21:27:20 serenity kernel: audit: type=1420 audit(1659148040.731:1217): subj_apparmor=unconfined
Jul 29 21:27:20 serenity kernel: audit: type=1107 audit(1659148040.731:1218): pid=1326 uid=103 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus>
exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Jul 29 21:27:22 serenity gnome-shell[3184]: Window manager warning: Buggy client sent a _NET_ACTIVE_WINDOW message with a timestamp of 0 for 0xa020d7
Jul 29 21:27:24 serenity audit[98317]: AVC apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/will/galactica/Google.pdf" pid=98317 comm="firefox" requested_mask=">
Jul 29 21:27:25 serenity audit[98317]: AVC apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/run/mount/utab" pid=98317 comm="firefox" requested_mask="r" denied_mask=">
Jul 29 21:27:25 serenity audit[98317]: AVC apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/will/galactica/" pid=98317 comm="pool-firefox" requested_mask="r" de>
Jul 29 21:27:25 serenity audit[98317]: AVC apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/will/galactica/" pid=98317 comm="pool-firefox" requested_mask="r" de>
Jul 29 21:27:25 serenity audit[1326]: USER_AVC pid=1326 uid=103 auid=4294967295 ses=4294967295 subj=? msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedeskto>
exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Jul 29 21:27:25 serenity audit: MAC_TASK_CONTEXTS subj_apparmor=unconfined
Jul 29 21:27:27 serenity gnome-shell[3184]: Window manager warning: Buggy client sent a _NET_ACTIVE_WINDOW message with a timestamp of 0 for 0xa0247f
Jul 29 21:27:28 serenity audit[98317]: AVC apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/will/galactica/Google.pdf" pid=98317 comm="firefox" requested_mask=">
Jul 29 21:27:28 serenity kernel: kauditd_printk_skb: 13 callbacks suppressed
Jul 29 21:27:28 serenity kernel: audit: type=1400 audit(1659148048.043:1232): apparmor="DENIED" operation="open" profile="snap.firefox.firefox" name="/home/will/galactica/Google.pdf" pid=98>

Comment 21

[:gerard-majax]

Maybe we need G_DEBUG=1 /usr/libexec/xdg-document-portal -rv then ?

Comment 22

[Will]

XDP: Providing portal org.freedesktop.portal.Documents
XDP: Providing portal org.freedesktop.portal.FileTransfer
XDP: org.freedesktop.portal.Documents acquired
XDP: INIT
XDP: GETATTR 1
XDP: ACCESS 1
XDP: LOOKUP 1:.Trash
XDP: LOOKUP -> error ENOENT
XDP: LOOKUP 1:.Trash-1000
XDP: LOOKUP -> error ENOENT
XDP: portal_add_named_full /home/will/galactica/Google.pdf
XDP: Running: snap routine file-access firefox /home/will/galactica/Google.pdf
XDP: portal_add_named_full /home/will/galactica/Google.pdf
XDP: Running: snap routine file-access firefox /home/will/galactica/Google.pdf

Comment 23

[:gerard-majax]

Thanks, and so no EPERM or EACCES there, is that the full log ? I guess I'll have to setup some NFS share to be able to repro, because we still dont know where it fails.

Comment 24

[Will]

That was the full log. Thanks.