apparmor profile prevents firefox from using "open containing folder" with nautilus

Thanks for reporting this bug and any supporting documentation. Since this bug has enough information provided for a developer to begin work, I'm going to mark it as Triaged and let them handle it from here. Thanks for taking the time to make Ubuntu better! Please report any other issues you may find.

I can confirm this on Ubuntu 64-bit karmic beta. It also appears to affect opening files. If I try to open a downloaded file on the open/save as dialog, such as a torrent, it fails to execute with any handler I throw at it. Can anyone else confirm this behavior?

Does the following fix this issue for you:

1. add the following to /etc/apparmor.d/usr.bin.firefox-3.5:
  /usr/bin/nautilus Ux,
2. reload the profile with:
$ sudo apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.firefox-3.5

Yes, /usr/bin/nautilus Ux, solves the issue.

Hi,

In my case, yes it does fix the issue. I've not rebooted yet but just following the instructions you gave did the trick immediately.

Do I have to expect to redo this each time there is an update of apparmor or firefox-3.5 or it will most likely be added in a future update?

Thank you.

ehfortin

> Date: Mon, 26 Oct 2009 15:52:18 +0000
> From: <email address hidden>
> To: <email address hidden>
> Subject: [Bug 452591] Re: apparmor profile prevents firefox from using "open containing folder" with nautilus
>
> Does the following fix this issue for you:
>
> 1. add the following to /etc/apparmor.d/usr.bin.firefox-3.5:
> /usr/bin/nautilus Ux,
> 2. reload the profile with:
> $ sudo apparmor_parser -r -T -W /etc/apparmor.d/usr.bin.firefox-3.5
>
> ** Changed in: firefox-3.5 (Ubuntu)
> Status: Triaged => Incomplete
>
> ** Changed in: firefox-3.5 (Ubuntu)
> Importance: High => Low
>
> --
> apparmor profile prevents firefox from using "open containing folder" with nautilus
> https://bugs.launchpad.net/bugs/452591
> You received this bug notification because you are a direct subscriber
> of the bug.
>
> Status in “firefox-3.5” package in Ubuntu: Incomplete
>
> Bug description:
> Binary package hint: firefox-3.5
>
> "Open containing folder" in downloads window doesn't open nautilus.
>
> Reproduce:
> 1) Start downloading any file. Downloads window will open.
> 2) Press right mouse on downloading item and select "Open containing folder"
>
> What should happen: folder should be opened with nautilus.
>
> What happens: empty application selection window appears. Even if I manually add /usr/bin/nautilus folder doesn't show up.
>
> ProblemType: Bug
> Architecture: amd64
> Date: Fri Oct 16 02:09:10 2009
> DistroRelease: Ubuntu 9.10
> NonfreeKernelModules: nvidia
> Package: firefox-3.5 3.5.3+build1+nobinonly-0ubuntu4
> ProcEnviron:
> PATH=(custom, user)
> LANG=ru_RU.UTF-8
> SHELL=/bin/bash
> ProcVersionSignature: Ubuntu 2.6.31-14.46-generic
> SourcePackage: firefox-3.5
> Uname: Linux 2.6.31-14-generic x86_64

_________________________________________________________________
Get Windows 7 for only $39.99—CDN College & University students only. This offer ends Jan 3—upgrade now!
http://go.microsoft.com/?linkid=9691637

Etienne,

This will be included in a future release. You won't have to do this each time on reboot.

SRU REQUEST

1. Users of firefox are unable to use "Open containing folder" when the AppArmor profile is enabled. The fix is trivial

2. The fix is not in Lucid yet

3. The fix is to add the following in debian/usr.bin.firefox.apparmor.in:
    /usr/bin/nautilus Uxr,

4. TEST CASE:
- sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5
- start downloading a file. Downloads window will open.
- press right mouse on downloading item and select "Open containing folder"

5. The regression potential is very low. The profile is disabled in the default installation, and we only allow access to files that we didn't previously have access to.

This bug was fixed in the package firefox-3.5 - 3.5.6+nobinonly-0ubuntu1

---------------
firefox-3.5 (3.5.6+nobinonly-0ubuntu1) lucid; urgency=low

  * New upstream release v3.5.6 (FIREFOX_3_5_6_RELEASE)
    - see USN-874-1

  [ Micah Gersten <email address hidden> ]
  * Bump minimum system cairo to 1.8.8
    - update debian/rules
  * Fix .desktop Name field for Slovak translation (LP: 448683)
    - update debian/firefox-3.5-final.desktop
  * Fix .desktop Name field for Estonian and Arabic translations
    (LP: 419507, LP: 321239)
    - update debian/firefox-3.5-final.desktop

  [ Jamie Strandboge <email address hidden> ]
  * AppArmor fixes:
    - allow access to nautilus, to allow "Open containing folder" to work
      (LP: #452591)
    - allow access for deluge (LP: #455792)
    - work better with KDE by adding kde abstraction, allow access to soffice,
      allow access to okular and read access to /etc/fstab (for print dialog)
      (LP: #447006)
    - allow access to acroread (LP: #473268)
    - allow access to eog (LP: #464016)
    - allow access to transmission (LP: #476299)
    - deny noisy write attempts to deny /usr/lib/xulrunner-*/components/*.tmp
      as seen with 'firefox --help')
    - deny noisy read to /.suspended (when navigating directories)
    - allow access to /usr/bin/liferea-add-feed (LP: #488851)
    - allow access to azureus (LP: #482677)
    - don't require 'owner' for /media (LP: #479580)
    - adjust AppArmor profile binary globbing to match other branches
    - allow ixr access to sed (for first runs)

  [ Alexander Sack <email address hidden> ]
  * bump lower bound for system sqlite3 to >= 3.6.16.1
    - update debian/rules
 -- Alexander Sack <email address hidden> Wed, 16 Dec 2009 00:43:08 +0100

Unassigning myself for the 9.10 task. I don't have time to prepare/test/floow through on an SRU for this, especially since there is an easy workaround. If someone else is inclined to take the lead on an SRU for this, feel free to do so. This should get fixed in the firefox 3.6 update for 9.10 anyway.