[GH-ISSUE #1965] Apparmor causing Firefox Quantum: Gecko_IOThread segfault #1318

New issue

Closed

opened 2026-05-05 07:51:27 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 07:51:27 -06:00

Owner

Originally created by @fld on GitHub (May 29, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1965

On debian 9.4 / Linux 4.16.11 apparmor=1 / KDE Plasma 5.8 / firejail 0.9.54
Firefox Quantum 60.0.1 installed under /opt/firefox/

Trying to start firefox..

[Parent 9, Gecko_IOThread] WARNING: pipe error (60): Connection reset by peer: file /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 353
###!!! [Parent][MessageChannel] Error: (msgtype=0x2C0056,name=PContent::Msg_RefreshScreens) Channel error: cannot send/recv
...
...
[Parent 9, Main Thread] WARNING: FileDescriptorSet destroyed with unconsumed descriptors: file /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/file_descriptor_set_posix.cc, line 22
...

dmesg:
Gecko_IOThread[15099]: segfault at 0 ip 00007f95b1e2ad3a sp 00007f95b0aa9180 error 6 in libxul.so[7f95b1e1a000+4ca4000]

audit.log:

type=AVC msg=audit(1527615991.295:144539): apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/67/uid_map" pid=15025 comm="Gecko_IOThread" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
type=SYSCALL msg=audit(1527615991.295:144539): arch=c000003e syscall=2 success=no exit=-13 a0=7f95b4e36a7e a1=1 a2=b a3=31 items=0 ppid=14969 pid=15025 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000
tty=pts17 ses=5 comm="Gecko_IOThread" exe="/opt/firefox/firefox" key=(null)
type=ANOM_ABEND msg=audit(1527615991.295:144540): auid=1000 uid=1000 gid=1000 ses=5 pid=15025 comm="Gecko_IOThread" exe="/opt/firefox/firefox" sig=11 res=1

The culprit seems to be:
https://github.com/netblue30/firejail/blob/master/etc/firejail-default#L75

Taking out the "owner " fixed this issue for me.

Originally created by @fld on GitHub (May 29, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1965 On debian 9.4 / Linux 4.16.11 apparmor=1 / KDE Plasma 5.8 / firejail 0.9.54 Firefox Quantum 60.0.1 installed under /opt/firefox/ Trying to start firefox.. ``` [Parent 9, Gecko_IOThread] WARNING: pipe error (60): Connection reset by peer: file /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/ipc_channel_posix.cc, line 353 ###!!! [Parent][MessageChannel] Error: (msgtype=0x2C0056,name=PContent::Msg_RefreshScreens) Channel error: cannot send/recv ... ... [Parent 9, Main Thread] WARNING: FileDescriptorSet destroyed with unconsumed descriptors: file /builds/worker/workspace/build/src/ipc/chromium/src/chrome/common/file_descriptor_set_posix.cc, line 22 ... ``` dmesg: `Gecko_IOThread[15099]: segfault at 0 ip 00007f95b1e2ad3a sp 00007f95b0aa9180 error 6 in libxul.so[7f95b1e1a000+4ca4000]` audit.log: ``` type=AVC msg=audit(1527615991.295:144539): apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/67/uid_map" pid=15025 comm="Gecko_IOThread" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000 type=SYSCALL msg=audit(1527615991.295:144539): arch=c000003e syscall=2 success=no exit=-13 a0=7f95b4e36a7e a1=1 a2=b a3=31 items=0 ppid=14969 pid=15025 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts17 ses=5 comm="Gecko_IOThread" exe="/opt/firefox/firefox" key=(null) type=ANOM_ABEND msg=audit(1527615991.295:144540): auid=1000 uid=1000 gid=1000 ses=5 pid=15025 comm="Gecko_IOThread" exe="/opt/firefox/firefox" sig=11 res=1 ``` The culprit seems to be: https://github.com/netblue30/firejail/blob/master/etc/firejail-default#L75 Taking out the "owner " fixed this issue for me.

gitea-mirror closed this issue

2026-05-05 07:51:28 -06:00

gitea-mirror commented

2026-05-05 07:51:31 -06:00

Author

Owner

@Vincent43 commented on GitHub (May 29, 2018):

Fixed with 7442d06896 . Thank you for reporting.

BTW: @fld Do you have unprivileged user namespaces enabled (by sysctl)?

@Vincent43 commented on GitHub (May 29, 2018): Fixed with https://github.com/netblue30/firejail/commit/7442d068960d6c3c4dc85946dbbc647b13b143bc . Thank you for reporting. BTW: @fld Do you have unprivileged user namespaces enabled (by sysctl)?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1318

No description provided.

Rows
Columns