Home / ubuntu / Questions / 1175950
Accepted
Eric L
Asked: 2019-09-23 18:19:21 +0800 CST

Apparmor enforce mode prevents Firefox from reading U2F security key

  • 772

When the default apparmor profile for Firefox is set to enforce mode, it blocks access to security keys. Disabling the profile restores access.

Rules that I've tried and failed:

  • /sys/devices/** r,
  • #include <abstractions/dbus>
  • dbus send bus=system path=/org/freedesktop/RealtimeKit1 interface=org.freedesktop.DBus.Properties member=Get peer=(name=org.freedesktop.RealtimeKit1)

Can someone help me craft rules to allow Firefox access security keys?

kern.log:

Sep 17 19:07:01 user-pc kernel: [21606.295620] usb 7-2: new full-speed USB device number 4 using uhci_hcd
Sep 17 19:07:01 user-pc kernel: [21606.487632] usb 7-2: New USB device found, idVendor=1050, idProduct=0120, bcdDevice= 4.33
Sep 17 19:07:01 user-pc kernel: [21606.487636] usb 7-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
Sep 17 19:07:01 user-pc kernel: [21606.487638] usb 7-2: Product: Security Key by Yubico
Sep 17 19:07:01 user-pc kernel: [21606.487639] usb 7-2: Manufacturer: Yubico
Sep 17 19:07:01 user-pc kernel: [21606.495139] hid-generic 0003:1050:0120.0005: hiddev0,hidraw2: USB HID v1.10 Device [Yubico Security Key by Yubico] on usb-0000:00:1d.1-2/input0
Sep 17 19:07:34 user-pc kernel: [21639.275573] audit: type=1400 audit(1568714854.720:331): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/firefox/firefox{,*[^s][^h]}" pid=21659 comm="apparmor_parser"
Sep 17 19:07:34 user-pc kernel: [21639.275577] audit: type=1400 audit(1568714854.724:332): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/firefox/firefox{,*[^s][^h]}//lsb_release" pid=21659 comm="apparmor_parser"
Sep 17 19:07:34 user-pc kernel: [21639.275580] audit: type=1400 audit(1568714854.724:333): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/usr/lib/firefox/firefox{,*[^s][^h]}//sanitized_helper" pid=21659 comm="apparmor_parser"
Sep 17 19:07:41 user-pc kernel: [21645.812202] audit: type=1107 audit(1568714861.260:334): pid=1061 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/RealtimeKit1" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.freedesktop.RealtimeKit1" pid=21662 label="/usr/lib/firefox/firefox{,*[^s][^h]}" peer_pid=1858 peer_label="unconfined"
Sep 17 19:07:41 user-pc kernel: [21645.812202]  exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Sep 17 19:07:42 user-pc kernel: [21646.966062] audit: type=1107 audit(1568714862.416:335): pid=1061 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/RealtimeKit1" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.freedesktop.RealtimeKit1" pid=21703 label="/usr/lib/firefox/firefox{,*[^s][^h]}" peer_pid=1858 peer_label="unconfined"
Sep 17 19:07:42 user-pc kernel: [21646.966062]  exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
security firefox apparmor two-factor-authentication yubikey

1 Answers

  1. Best Answer

    I got it working with a lot of modficaitions..

    The key bit maybe to remove the deny from this line:

      deny /run/udev/data/** r,

    Also required are:

      /sys/devices/pci*/** rw,
  /dev/hidraw2 rw,

    I also made a lot of other modifications trying to figure this out including switching the profile from usr.bin.firefox to usr.lib.firefox.firefox. I haven't reverted them all yet, so if it turns out it's something else see -https://pastebin.ubuntu.com/p/Ypy2Q322cN/ . I plan to remove the pastebin from the answer when we have more of a confirmation.

    • 2