← Back to issue list

Firefox Snap cannot load PKCS#11 modules (OpenSC / DNIe) due to AppArmor file_mmap denial

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#2156447
Type
issue
State
open
Author
~astrojuanlu
Labels
—
Created
Updated
Closed
—

Current evaluation

Firefox snap's AppArmor profile denies file_mmap on host PKCS#11 modules (OpenSC/DNIe), breaking smartcard module loading. Reporter confirmed pcscd is connected and flagged it a duplicate of firefox LP#1967632. Untriaged in snapcraft.

Suggested action: needs triage

Reason: The issue has no labels, no assignee, and no maintainer response — both comments are from the reporter — so it is uncategorised, which meets the needs_triage criteria. The reporter explicitly states "Duplicate of https://bugs.launchpad.net/firefox/+bug/1967632", and the denial is on profile="snap.firefox.firefox", i.e. the Firefox snap's own shipped AppArmor profile rather than anything snapcraft builds or generates, so a maintainer must decide to redirect/hand off rather than develop a fix here. Confidence is held down because repo inspection failed ("No pinned SHA available for project 'snapcraft'"), so I could not confirm in-tree that no snapcraft-side component (e.g. an interface or extension) contributes to the profile, and the body is terse with no discussion of desired scope.

Evaluated by: mr-cal-bot

Impact: 32 Quick Win: 5 Complexity: 68 Confidence: 62 Actionability: 45

Issue body

As per title. When trying to add a new Security Device, I am instructed to load a new PKCS#11 Device Driver. But when I enter the full path /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so, an alert says "Unable to add module" and I see this on dmesg: ``` 2026-06-11T15:08:23,969247+02:00 audit: type=1400 audit(1781173922.862:777): apparmor="DENIED" operation="file_mmap" class="file" profile="snap.firefox.firefox" name="/run/user/1000/doc/a26b111/opensc-pkcs11.so" pid=39017 comm=4261636B67726F7E506F6F6C202331 requested_mask="m" denied_mask="m" fsuid=1000 ouid=0 ``` I am on latest/candidate: 151.0.4-1, Ubuntu 26.04 LTS.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 32
Quick Win: 5
Complexity: 68
Confidence: 62
Actionability: 45
needs triage Firefox snap's AppArmor profile denies file_mmap on host PKCS#11 modules (OpenSC/DNIe), breaking smartcard module loading. Reporter confirmed pcscd is connected and flagged it a duplicate of firefox LP#1967632. Untriaged in snapcraft.
stealth/space-bunny-alpha
Impact: 42
Quick Win: 10
Complexity: 68
Confidence: 78
Actionability: 72
needs triage Firefox snap cannot mmap host PKCS#11 modules (OpenSC/DNIe): AppArmor file_mmap DENIED on snap.firefox.firefox. pcscd interface already connected; reporter self-declares it a duplicate of firefox LP#1967632; no maintainer triage yet.
stealth/space-bunny-alpha
Impact: 45
Quick Win: 7
Complexity: 55
Confidence: 70
Actionability: 35
close not a bug Firefox snap cannot mmap host PKCS#11 modules (OpenSC/DNIe) due to snap.firefox.firefox AppArmor file_mmap denial; reporter confirmed pcscd interface connected and flagged it a duplicate of LP#1967632
stealth/space-bunny-alpha
Impact: 53
Quick Win: 10
Complexity: 67
Confidence: 79
Actionability: 58
needs triage Firefox on Ubuntu 26.04 rejects OpenSC/DNIe PKCS#11 modules because the Firefox Snap’s AppArmor profile denies mmap of a host module under /run/user. Needs triage.
qwen3.6-35b-a3b-mtp-q6
Impact: 65
Quick Win: 29
Staleness: 45
Complexity: 55
Confidence: 40
Support Request: 25
needs triage Firefox Snap blocked from loading PKCS#11 modules due to AppArmor file_mmap denial; unlabelled, no maintainer response after 83 days
qwen/qwen3.6-35b-a3b
Staleness: 70
Complexity: 40
Confidence: 85
Support Request: 10
needs triage Firefox Snap fails to load PKCS#11 modules due to AppArmor file_mmap denial. Unlabeled, no maintainer response, reported 42 days ago.
qwen/qwen3.6-35b-a3b
Staleness: 65
Complexity: 45
Confidence: 90
Support Request: 10
needs triage Firefox Snap fails to load PKCS#11 modules due to AppArmor file_mmap denial. Unlabelled and inactive for 39 days with no maintainer response.
qwen3.6-35b-a3b-mtp-q6
Staleness: 40
Complexity: 45
Confidence: 90
Support Request: 10
needs triage Firefox Snap fails to load PKCS#11 modules due to AppArmor file_mmap denial. Unlabelled, no maintainer response, awaiting triage.

Update history

Date Change
created

Related work

  • Duplicate Of: firefox#1967632 (confidence 90%)

    Reporter's own 2026-06-12 comment: "Duplicate of https://bugs.launchpad.net/firefox/+bug/1967632" — the canonical report lives in the firefox tracker, not snapcraft.

Related issues

No related issues found above the similarity threshold.