I am using a VirtualBox machine, both host and guest are Ubuntu 23.04.
I have mounted a shared folder in the host :
$ sudo df -aTh | egrep "shared|Filesystem"
Filesystem Type Size Used Avail Use% Mounted on
...
shared vboxsf 425G 400G 26G 95% /home/iutuser/vboxshared
All files in there belong to root/vboxsf and have 770 access rights:
$ ls -alh /home/iutuser/vboxshared | grep test.html
-rwxrwx--- 1 root vboxsf 22 juin 30 23:37 test.html
My user is iutuser, it belongs to the group vboxsf, listed as file owner:
$ sudo cat /etc/gshadow | grep vboxsf
vboxsf:!::iutuser
I run firefox as iutuser:
iutuser 3019 2759 1 23:36 pts/0 00:00:18 /snap/firefox/4483/usr/lib/firefox/firefox
iutuser 3192 3019 0 23:36 pts/0 00:00:00 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -parentBuildID 20240626001103 -prefsLen 34206 -prefMapSize 245537 -appDir /snap/firefox/4483/usr/lib/firefox/browser {e582a6f3-d0a2-4557-a2fc-4e8300da164a} 3019 true socket
iutuser 3211 3019 0 23:36 pts/0 00:00:01 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 35166 -prefMapSize 245537 -jsInitLen 234488 -parentBuildID 20240626001103 -greomni /snap/firefox/4483/usr/lib/firefox/omni.ja -appomni /snap/firefox/4483/usr/lib/firefox/browser/omni.ja -appDir /snap/firefox/4483/usr/lib/firefox/browser {0e7b0c83-22b7-404d-8adb-5ed327594fe3} 3019 true tab
iutuser 3330 3019 0 23:36 pts/0 00:00:09 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 39952 -prefMapSize 245537 -jsInitLen 234488 -parentBuildID 20240626001103 -greomni /snap/firefox/4483/usr/lib/firefox/omni.ja -appomni /snap/firefox/4483/usr/lib/firefox/browser/omni.ja -appDir /snap/firefox/4483/usr/lib/firefox/browser {fccfb776-21b6-4427-adbc-d0ab1bf42f83} 3019 true tab
iutuser 3493 3019 0 23:36 pts/0 00:00:00 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -parentBuildID 20240626001103 -sandboxingKind 0 -prefsLen 40059 -prefMapSize 245537 -appDir /snap/firefox/4483/usr/lib/firefox/browser {e4b798e4-f60b-4eca-a99b-90eb28bff62c} 3019 true utility
iutuser 3546 3019 0 23:36 pts/0 00:00:00 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 31797 -prefMapSize 245537 -jsInitLen 234488 -parentBuildID 20240626001103 -greomni /snap/firefox/4483/usr/lib/firefox/omni.ja -appomni /snap/firefox/4483/usr/lib/firefox/browser/omni.ja -appDir /snap/firefox/4483/usr/lib/firefox/browser {44f9bf12-12eb-4f10-94b3-569de4b95045} 3019 true tab
iutuser 3796 3019 0 23:37 pts/0 00:00:00 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -childID 7 -isForBrowser -prefsLen 32070 -prefMapSize 245537 -jsInitLen 234488 -parentBuildID 20240626001103 -greomni /snap/firefox/4483/usr/lib/firefox/omni.ja -appomni /snap/firefox/4483/usr/lib/firefox/browser/omni.ja -appDir /snap/firefox/4483/usr/lib/firefox/browser {3cf62206-87b0-4688-8da8-eda498606af9} 3019 true tab
iutuser 3826 3019 0 23:37 pts/0 00:00:00 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -childID 8 -isForBrowser -prefsLen 32070 -prefMapSize 245537 -jsInitLen 234488 -parentBuildID 20240626001103 -greomni /snap/firefox/4483/usr/lib/firefox/omni.ja -appomni /snap/firefox/4483/usr/lib/firefox/browser/omni.ja -appDir /snap/firefox/4483/usr/lib/firefox/browser {cb2a7f65-74d1-425f-be7d-f79eaa0e35ab} 3019 true tab
iutuser 3848 3019 0 23:37 pts/0 00:00:00 /snap/firefox/4483/usr/lib/firefox/firefox -contentproc -childID 9 -isForBrowser -prefsLen 40359 -prefMapSize 245537 -jsInitLen 234488 -parentBuildID 20240626001103 -greomni /snap/firefox/4483/usr/lib/firefox/omni.ja -appomni /snap/firefox/4483/usr/lib/firefox/browser/omni.ja -appDir /snap/firefox/4483/usr/lib/firefox/browser {351c6022-31d5-439a-ba25-2affa1dd8e67} 3019 true tab
But Firefox says that it cannot open the file file:///home/iutuser/vboxshared/test.html:
While cat can read the file as expected:
$ cat /home/iutuser/vboxshared/test.html
<html>
Hello
</html>
With help from @steeldriver and these SO posts:
- How do I access mounted hard drive with a Snap application?
- Ubuntu 20.04 snaps: Allow a snap app access to a VM shared folder
I understand that the issue lays with snap and AppArmor, see the kernel log:
[ 320.509463] audit: type=1400 audit(1719786105.705:114): apparmor="DENIED" operation="open" class="file" profile="snap.firefox.firefox" name="/home/iutuser/vboxshared/test.html" pid=3298 comm=53747265616D5472616E73202334 requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
I am not familiar with these applications. What and how should I configure so my snap Firefox is allowed to read my shared files?
I would like to fix it and not just reinstall Firefox from apt.
