[apparmor] [profile] Firefox: "DENIED", requested/denied_mask="r" for /proc/*/net/arp.

[Seth Arnold]

Hello Daniel,

On Mon, Nov 07, 2016 at 09:59:19PM +0100, daniel curtis wrote:
> Today, I've noticed some "strange" entries in some log files, such as:
> /var/log/kern.log and /var/log/kern.log. Both files contains AppArmor
> entries related to the Firefox. One of them is known and refers to
> "/dev/nvidiactl" (requested and denied_mask = "rw"). Some time ago I wanted
> to add the corresponding rule, but... Firefox runs normally etc.

This is probably forcing something (webgl?) to fall back to slower
software rendering.

> Second one entry I saw for the first time; log entry concerns, for example,
> "/proc/3304/net/arp" and so on. Here is an example:

This is from a new feature in Firefox: netid.

https://bug1240932.bmoattachments.org/attachment.cgi?id=8709691

I have trouble understanding the document, but I think it's so that they
can perform better caching and cookie handling when firefox migrates
between networks. It looks like this would let them know that
www.google.com when resolved in a captive wifi network may give different
results than www.google.com when on different networks, and not allow
caching and security information from one network taint the results from
other networks.

Thanks
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/apparmor/attachments/20161107/751e1380/attachment-0001.pgp>