[Bug 1770600] Re: Firefox v60: does not work after updating, many "DENIED" log entries.

[daniel CURTIS]

Hello Simon.

Thank You very much for an informations. Yes, there was some changes to
the Sandbox (vide 'about:support'), because after update there was one
new option with 'false' value (I have had similar issue in the past but
it's not important now) and levels for the "Content Separation" and
"Effective Content Separation" has changed to "4" (while in Firefox 59.0
version it was "3") etc.

I will also add an "owner" prefix to the '@{PROC}' rules. Thanks for
clarifications; I waited for something like this, because I had no idea
if "owner" should be used in such situation.

Anyway, if it's about the last rule in my report and this one mentioned
in my comment #2: it seems, that when everything is commented, there is
a problem with opening new tab (e.g. by clicking "+") - after ~2 hours
of Firefox using there is an error message that "this tab has failed",
"We can help!" etc. Everything else is working okay.

For now I decided to comment this rule, because I think it's a wrong
rule (see my post #2 for more informations). As I already mentioned,
"abstractions/X" file contains rule related with "/tmp/.X11-unix/X0" and
"connect" operation. However, there is also "type" and "peer" options
(see report; last rule) - which is not in the log entry! So, here is
what I've done for now:

# Here are a rules from an "abstractions/X" file. However I used "rw" access. Reason:
# "r" access added because of log entries with 'requested{,denied}_mask=r' (see bug report) 
#
/tmp/.X11-unix/* rw,

#unix (connect, receive, send)
#    type=stream
#    peer=(addr="@/tmp/.X11-unix/X[0-9]*"), 

And everything seems to work okay: just as before update to 60.0
version. Okay, so for now I will:

✗ add an "owner" prefix for all '@{PROC}' rules (thanks Simon!);
✗ use only "/tmp/.X11-unix/* rw," rule (until more information will be gathered);
✗ monitor the log files, journalctl(1) command etc. 

Once again: thank You Simon for an informations! I hope also that
someone else will confirm the correctness of all these rules.
(Especially these mentioned in bug report).

By the way: Simon, what about two rules: mentioned above "unix" and
"dbus" rule (see bug report and 7. rule) Have you seen such an entries
in your log files etc.? Did you have had a similar issues with firefox,
just before adding rules (see bug report)?

Thanks, best regards.

** Summary changed:

- Firefox v60: does not work after updating, many "DENIED" log entries.
+ Firefox v60: does not work after update, many "DENIED" log entries etc.

-- 
You received this bug notification because you are a member of Mozilla
Bugs, which is subscribed to firefox in Ubuntu.
https://bugs.launchpad.net/bugs/1770600

Title:
  Firefox v60: does not work after update, many "DENIED" log entries
  etc.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1770600/+subscriptions