Closed Bug 1911785 Opened 2 years ago Closed 2 years ago

Unable to access sites with snap-packaged Firefox and GlobalProtect VPN

Categories

(Firefox Build System :: Third Party Packaging, defect)

Product:
Firefox Build System
Component:
Third Party Packaging
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: jgraham, Unassigned)

References

(Blocks 1 open bug)

Details

Reporting this on behalf of a third party, so I can't easily provide extra information or test fixes :)

Using snap-packed Firefox on Ubuntu with a GlobalProtect corp VPN Firefox was unable to load any sites (including those not behind the VPN), but Chrome was still able to access sites as normal. Following the suggestion in https://live.paloaltonetworks.com/t5/globalprotect-discussions/ubuntu-firefox-gp-web-issue/td-p/560821 resolved the issue.

This suggests that with this setup the snap-packaged Firefox is seeing a different resolved.conf compared to the host system, so it was unable to resolve DNS and as a result loading pages wasn't possible.

Flags: needinfo?(bandali)

Asking about this from one my colleagues in the snapd team, their guess was that the VPN client makes /etc/resolv.conf a symlink pointing to a location that the Firefox snap cannot read from. In the AppArmor nameservice abstraction (/etc/apparmor.d/abstractions/nameservice), these locations are allowed:

  @{etc_ro}/resolv.conf r,
  # On systems where /etc/resolv.conf is managed programmatically, it is
  # a symlink to @{run}/(whatever program is managing it)/resolv.conf.
  @{run}/{resolvconf,NetworkManager,systemd/resolve,connman,netconfig}/resolv.conf r,
  @{etc_ro}/resolvconf/run/resolv.conf  r,
  @{run}/systemd/resolve/stub-resolv.conf r,
  /mnt/wsl/resolv.conf r,

Would you please check and provide the output of running readlink -f /etc/resolv.conf in a terminal on the system with the VPN client connected and running?

Flags: needinfo?(bandali)
 $ readlink -f /etc/resolv.conf
/opt/paloaltonetworks/globalprotect/network/config/resolv.conf
Blocks: snap-sandbox

Thanks, that confirms the hypothesis: snap packages (including the Firefox snap) are prohibited by the snap sandbox from reading arbitrary locations on the host system, such as the one used by this VPN client, by design.

Possible suggestions for the developers of this VPN client:

  • have /etc/resolv.conf be a regular file rather than a symlink to some other path; or

  • integrate with systemd-resolved on systems that use it (such as Ubuntu) and update its configuration either by editing /etc/systemd/resolved.conf or a /etc/systemd/resolved.conf.d/*.conf drop-in file (see resolve.conf(5)) or using the resolvectl tool (see resolvectl(1)) upon connecting or disconnecting the VPN.

Presumably every Snap packaged application that needs to use the network is going to be broken, so I think this is WONTFIX from our side.

The recommended workaround until Palo Alto Networks / GlobalProtect fixes their stuff would be to use the Debian packages for Firefox: https://support.mozilla.org/en-US/kb/install-firefox-linux#w_install-firefox-deb-package-for-debian-based-distributions

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
You need to log in before you can comment on or make changes to this bug.