[snap] chromium snap does not allow to read symlinks to /usr/share/javascript

Hi Vladimir, thanks for the bug report.

In Ubuntu, Chromium is provided a snap. The snap confinement prevents the program from accessing system files under /usr/share, /usr/share/doc being an exception when the system-package-doc interface[1] is connected (which is the default).

Although the symlink is under /usr/share/doc, it points to a non-whitelisted location under /usr/share, and thus Chromium cannot load it.

I'm sorry for the inconvenience this generates in this case, but that limitation is inherent to the model.

[1] https://snapcraft.io/docs/the-system-package-doc-interface

I beg to reconsider this decision since due to the Debian policy[1] the documentation packages install related javascript libraries (namely JQuery) into /usr/share/javascript.

Limiting snap access to /usr/share/doc only results in broken documentation for our users.

[1] https://wiki.debian.org/Javascript/Policy

I see, openjdk-21-doc depends on libjs-jquery.

I think it is unlikely that they would allow this, but one could raise the issue in forum.snapcraft.io.

Opened a query with Snapd folks on https://forum.snapcraft.io/t/documentation-packages-attempt-to-access-usr-share-javascript-but-fail/36516. Feel free to chime in.

I proposed https://github.com/snapcore/snapd/pull/13130.

The fix is in Snapd beta and should be in stable in the next month or so.

Test feedback on snapd 2.62 beta would be appreciated.

I have tested the updated snapd in a Noble VM.

I have installed:

firefox latest/stable:
installed: 124.0.1-1 (4033) 281MB -
chromium latest/stable:
installed: 123.0.6312.86 (2805) 168MB -

openjdk-21-doc/noble,noble,now 21.0.3~7ea-1 all [installed]
snapd/noble-proposed,now 2.62+24.04build1 amd64 [installed]

I have opened openjdk documentation with
----
$firefox /usr/share/doc/openjdk-21-doc/index.html
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/local/share/doc /usr/local/share/doc none bind,ro 0 0): cannot open directory "/usr/local/share": permission denied
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/gimp/2.0/help /usr/share/gimp/2.0/help none bind,ro 0 0): cannot open directory "/var/lib": permission denied
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/javascript/sphinxdoc /usr/share/javascript/sphinxdoc none bind,ro 0 0): cannot open directory "/var/lib": permission denied
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/sphinx_rtd_theme /usr/share/sphinx_rtd_theme none bind,ro 0 0): cannot open directory "/var/lib": permission denied
update.go:85: cannot change mount namespace according to change mount (/var/lib/snapd/hostfs/usr/share/xubuntu-docs /usr/share/xubuntu-docs none bind,ro 0 0): cannot open directory "/var/lib": permission denied
----
The snap output some errors, but the documentation opened correctly and the search bar was active.

chromium:
--
$ chromium /usr/share/doc/openjdk-21-doc/index.html
Gtk-Message: 10:59:34.732: Not loading module "atk-bridge": The functionality is provided by GTK natively. Please try to not load it.

(chrome:5433): Gtk-WARNING **: 10:59:34.780: GTK+ module /snap/chromium/2805/gnome-platform/usr/lib/gtk-2.0/modules/libcanberra-gtk-module.so cannot be loaded.
GTK+ 2.x symbols detected. Using GTK+ 2.x and GTK+ 3 in the same process is not supported.
Gtk-Message: 10:59:34.780: Failed to load module "canberra-gtk-module"

(chrome:5433): Gtk-WARNING **: 10:59:34.782: GTK+ module /snap/chromium/2805/gnome-platform/usr/lib/gtk-2.0/modules/libcanberra-gtk-module.so cannot be loaded.
GTK+ 2.x symbols detected. Using GTK+ 2.x and GTK+ 3 in the same process is not supported.
Gtk-Message: 10:59:34.782: Failed to load module "canberra-gtk-module"
[5433:5433:0402/105934.824524:ERROR:policy_logger.cc(157)] :components/enterprise/browser/controller/chrome_browser_cloud_management_controller.cc(161) Cloud management controller initialization aborted as CBCM is not enabled. Please use the `--enable-chrome-browser-cloud-management` command line flag to enable it if you are not using the official Google Chrome build.
libva error: /snap/chromium/2805/gnome-platform/usr/lib/x86_64-linux-gnu/dri/virtio_gpu_drv_video.so init failed
[5630:5630:0402/105934.916687:ERROR:viz_main_impl.cc(196)] Exiting GPU process due to errors during initialization
[5433:5433:0402/105935.190773:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.ScreenSaver.Get...

It seems that the bug is not fixed in the release channel.
I am trying to fix lintian warning
W: openjdk-22-doc: embedded-javascript-library /usr [usr/share/doc/openjdk-22-jre-headless/api/resource-files/jquery-ui.min.css]

But the search bar becomes inactive when I start using symlinks:

$snap info firefox
name: firefox
summary: Mozilla Firefox web browser
publisher: Mozilla✓
store-url: https://snapcraft.io/firefox
contact: https://support.mozilla.org/kb/file-bug-report-or-feature-request-mozilla
license: unset
description: |
  Firefox is a powerful, extensible web browser with support for modern web application
  technologies.
commands:
  - firefox
  - firefox.geckodriver
snap-id: 3wdHCAVyZEmYsCMFDE9qt92UV8rC8Wdk
tracking: latest/stable/ubuntu-22.10
refresh-date: 3 days ago, at 06:25 NZST
channels:
  latest/stable: 128.0.3-1 2024-07-26 (4650) 281MB -
  latest/candidate: 129.0-1 2024-07-31 (4684) 282MB -
  latest/beta: 129.0b9-1 2024-07-26 (4659) 282MB -
  latest/edge: 130.0a1 2024-07-31 (4692) 302MB -
  esr/stable: 115.13.0esr-3 2024-07-09 (4532) 256MB -
  esr/candidate: 115.14.0esr-1 2024-07-30 (4679) 257MB -
  esr/beta: ↑
  esr/edge: ↑
installed: 128.0.3-1 (4650) 281MB -

$snap info chromium
name: chromium
summary: Chromium web browser, open-source version of Chrome
publisher: Canonical✓
store-url: https://snapcraft.io/chromium
contact: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bugs?field.tag=snap
license: unset
description: |
  An open-source browser project that aims to build a safer, faster, and more
  stable way for all Internet users to experience the web.
commands:
  - chromium.chromedriver
  - chromium
snap-id: XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R
tracking: latest/stable
refresh-date: 11 days ago, at 14:15 NZST
channels:
  latest/stable: 127.0.6533.72 2024-07-30 (2921) 173MB -
  latest/candidate: 127.0.6533.88 2024-07-31 (2923) 174MB -
  latest/beta: 127.0.6533.57 2024-07-23 (2914) 179MB -
  latest/edge: 129.0.6614.3 2024-07-29 (2920) 181MB -
installed: 126.0.6478.182 (2910) 171MB -

$ ls -alrt /usr/share/doc/openjdk-21-doc/api/script-dir/
total 12
lrwxrwxrwx 1 root root 43 Jul 23 13:34 jquery-3.6.1.min.js -> ../../../../javascript/jquery/jquery.min.js
drwxr-xr-x 64 root root 4096 Aug 1 06:52 ..
lrwxrwxrwx 1 root root 48 Aug 1 13:52 jquery-ui.min.js -> /usr/share/javascript/jquery-ui/jquery-ui.min.js
lrwxrwxrwx 1 root root 61 Aug 1 13:54 jquery-ui.min.css -> /usr/share/javascript/jquery-ui-themes/base/jquery-ui.min.css
drwxr-xr-x 2 root root 4096 Aug 1 13:54 .
$ cat /usr/share/doc/openjdk-21-doc/api/script-dir/jquery-3.6.1.min.js
/*! jQuery v3.6.1 | (c) OpenJS Foundation and other contributors | jquery.org/license */

...

Firefox error:
Loading failed for the <script> with source “file:///usr/share/doc/openjdk-21-jre-headless/api/script-dir/jquery-ui.min.js”.

Chrome snap error:
Failed to load resource: net::ERR_FILE_NOT_FOUND
dejavu.css:1

Failed to load ...

> It seems that the bug is not fixed in the release channel.

Do you mean the stable channel of Snapd? I'd be surprised if after 5 months it still didn't land. If yes can you also provide 'snap info snapd' so I can ask the Snapd folks?

Hi,

Here it is:

summary: Daemon and tooling that enable snap packages
publisher: Canonical✓
store-url: https://snapcraft.io/snapd
contact: https://github.com/snapcore/snapd/issues
license: GPL-3.0
description: |
  Install, configure, refresh and remove snap packages. Snaps are
  'universal' packages that work across many different Linux systems,
  enabling secure distribution of the latest apps and utilities for
  cloud, servers, desktops and the internet of things.

  Start with 'snap list' to see installed snaps.
type: snapd
snap-id: PMrrV4ml8uWuEUDBT8dSGnKUYbevVhc4
tracking: latest/stable
refresh-date: 2024-05-24
channels:
  latest/stable: 2.63 2024-05-23 (21759) 40MB -
  latest/candidate: 2.63 2024-05-16 (21759) 40MB -
  latest/beta: 2.64 2024-07-25 (22509) 39MB -
  latest/edge: 2.64+git75.g3fc1621 2024-08-01 (22553) 39MB -
installed: 2.63 (21759) 40MB snapd

Best Regards,
 Vladimir.

I read your #28 more carefully and actually the bug as reported is fixed and, I have all reasons to assume, working.

Your log is pointing out failure to read this link:

  /usr/share/doc/openjdk-21-jre-headless/api/script-dir/jquery-ui.min.js -> /usr/share/javascript/jquery-ui/jquery-ui.min.js

Now, that specific path, namely /usr/share/javascript/jquery-ui, was not mentioned in this report until #28; That was therefore never addressed in the fix[1]. But using [1] as a template, it is trivial to propose an exception for /usr/share/javascript/jquery-ui too.

Since this is unavoidably a cat-and-mouse game, I kindly request you to make sure there are no remaining paths that need access apart from the one you are reporting now. A good way of ascertaining this is by white listing /usr/share/javascript/jquery-ui with https://snapcraft.io/docs/debug-snaps#heading--apparmor and seeing if it is enough.

[1] https://github.com/snapcore/snapd/pull/13130

Though indeed the bug title is 'symlinks to /usr/share/javascript', I really think the snap reviewers would not allow.access to the whole directory.

Hi,

OpenJDK documentation only links to libjquery-ui in addition to jquery.

In a general sense this is a bit of cat and mouse. Lintian issues warnings for a number of embedded libraries[1] and the browser snap policy should closely follow the current state of lintian development to allow browsing HTML documentation that complies with Ubuntu/Debian policy.

The alternative is to whitelist javascript libraries installation location.

Best Regards,
 Vladimir.

[1] https://git.launchpad.net/ubuntu/+source/lintian/tree/lib/Lintian/Check/Languages/Javascript/Embedded.pm

Thanks for your responsiveness.

I opened https://github.com/canonical/snapd/pull/14292.