Bug 475786

Summary:	backport required: plasma-browser-integration does not work in firefox due to apparmor
Product:	[KDE Neon] neon	Reporter:	Malte S. Stretz <mss>
Component:	Packages User Edition	Assignee:	Neon Bugs <neon-bugs-null>
Status:	RESOLVED WAITINGFORINFO
Severity:	normal	CC:	jr, neon-bugs-null, sitter
Priority:	NOR
Version First Reported In:	unspecified
Target Milestone:	---
Platform:	Other
OS:	Linux
See Also:	https://bugs.kde.org/show_bug.cgi?id=397399 https://bugs.kde.org/show_bug.cgi?id=481568
Latest Commit:		Version Fixed/Implemented In:
Sentry Crash Report:

Description Malte S. Stretz 2023-10-18 08:28:12 UTC

SUMMARY
The root issue was already filed as bug 397399 where the result was "This is an issue with the upstream apparmor profile and currently we can't fix it without changes in there." While the application itself can't fix it Neon is in a different position and it should be able to drop in an override which allows the execution of /usr/bin/plasma-browser-integration-host

I think (but haven tested it yet) that this should be possible by dropping a file into /etc/apparmor.d/abstractions/kde.d/

STEPS TO REPRODUCE
1. Start firefox
2. Install /usr/bin/plasma-browser-integration-host
3. Go the the addons' preferences and notice the "Failed to connect to native host" error message
4. Verify that the package plasma-browser-integration is installed
5. Go to about:debugging#/runtime/this-firefox
6. Click on "Inspect" for the Plasma Integration plugin
7. Look at console tab, notice the error message "Not auto-restarting host as we haven't received any message from it before. Check that it's working/installed correctly"
8. Google wildly and find pointers to apparmor
9. Finally look at something like `journalctl --since '1 hour ago' | grep plasma-browser-integration-host` and notice lines like "Okt 18 09:58:52 localhost audit[20833]: AVC apparmor="DENIED" operation="exec" class="file" profile="firefox" name="/usr/bin/plasma-browser-integration-host" pid=20833 comm=444F4D20576F726B6572 requested_mask="x" denied_mask="x" fsuid=1000 ouid=0"

OBSERVED RESULT
Plasma Browser Integrations do not work out of the box

EXPECTED RESULT
They should work

SOFTWARE/OS VERSIONS
Linux/KDE Plasma: Neon User Edition 5.27
(available in About System)
KDE Plasma Version: 5.27.8
KDE Frameworks Version: 5.110.0
Qt Version: 5.15.11

ADDITIONAL INFORMATION

Comment 1 Malte S. Stretz 2023-10-18 08:41:34 UTC

I made this work by appending the following line (including the trailing comma) to /etc/apparmor.d/abstractions/ubuntu-browsers.d/kde where I think it belongs:

/usr/bin/plasma-browser-integration-host Cx -> sanitized_helper,

For the record: The relevant inclusion tree looks like this:

/etc/apparmor.d/usr.bin.firefox
  -> /etc/apparmor.d/abstractions/ubuntu-browsers.d/firefox
    -> /etc/apparmor.d/abstractions/ubuntu-browsers.d/kde
      -> /etc/apparmor.d/abstractions/kde
        -> /etc/apparmor.d/abstractions/kde.d/*
-> /etc/apparmor.d/local/usr.bin.firefox

Comment 2 Malte S. Stretz 2024-02-20 10:03:58 UTC

This change should be backported from upstream to the KDE Neon AppArmor packages: https://gitlab.com/apparmor/apparmor/-/merge_requests/1115

Comment 3 Carlos De Maine 2025-09-20 09:36:08 UTC

Thank you for your bug report! 
However this bug report was created/provided previous to 01/01/2023 and also has not received any updates since  before 01/01/2025. 
Unfortunately KDE neon no longer provides updates for anything older than noble 24.04 based edition's.
Please upgrade to KDE neon noble and if you can reproduce the issue after upgrading to an active version, feel free to re-open this bug report.
Thanks for understanding!