Cannot Upload Files with Tor Browser - AppArmor Issue

Support
1

Hello,

I have just installed Qubes 4.2 on two different computers (NUC 5 and NUC 10, both with I5 CPU) and it basically works.

Nevertheless, I have encountered a major problem:

If I want to attach files (no matter if jpg, doc, pdf etc.) to a mail in Qubes-Whonix in a corresponding APP-VM and a normal e-mail program (upload from the Thunar file manager), an error message appears after some time that the file cannot be attached to the mail. With another mail program, attaching the file deletes the entire text including metadata.

I have tested it on several freshly created Whonix instances or clones and it is always the same error.

It is not due to different formats or settings in the mail programs such as PlainText or html. I can send a simple mail without an attachment.

I donā€™t know whether the problem is with Qubes 4.2, Whonix-17, Tor or Debian-12. Thatā€™s why Iā€™m posting in both forums.

Has anyone had similar experiences or an idea where the error could lie?

Many thanks for your opinions!

2

AppArmor issue?

Try move the file to the Download folder in the home folder before attempting to attach.

3

IĀ“ve done but itĀ“s the same result; i cannot attach the files.

4

Exact error message?

5

Yes: ā€œAn unknown error has occurred. File cannot be attached.ā€.

6

I have done some tests and think I have found the solution. If anyone would like to forward this to the developers of apparmor - please do.

I initially switched off all profiles in apparmor in Whonix-workstation-17. The error was fixed and file attachments were possible.

Then I set everything to enforce mode and only in the VM based on the whonix-workstation-17 with the mail program did I switch the profiles to ā€œcomplainā€, where I suspected the highest probability of the error:

ā€œhome.tor-browser.firefoxā€ and ā€œsystem_torā€

This produced no result, the error was still there.

Then I did the same in whonix-workstation-17 and the error was fixed by running the following command in /etc/apparmor.d:

sudo aa-complain home.tor-browser.firefox

Then file attachments work.

1 Like
7

Your mail program, presumably Thunderbird was unbroken by command sudo aa-complain home.tor-browser.firefox?

8

I have not yet tested it in Thunderbird, but via a mail program that I used in the Tor browser. There were no problems. But I can test it with Thunderbird and then report back.

9

That was confusing. There is no mail program inside Tor Browser. Thatā€™s just a website.

Use folder /home/user/Downloads to store files before upload.

Try apparmor-info to check for AppArmor issues.

10

I am experiencing this same problem in Tor Browser (13.0.9). Updated by the internal updater and not tb-updater.

Snippets from apparmor-info:

AVC apparmor=ā€œDENIEDā€ operation=ā€œopenā€ profile=ā€œ/**/*-browser/Browser/firefoxā€ name=ā€œ/home/user/Downloads/avatar.jpgā€ comm=ā€œfirefox.realā€ requested_mask=ā€œrā€ denied_mask=ā€œrā€

This problem occurs in Tor Browser (shown) when attempting to upload (or as @Ionixx reports attempting to attach in webmail) any images.

11

Is this file owned by any user other than user user? Check:

stat -c '%U' /home/user/Downloads/avatar.jpg

If it shows anything other than user this could be the cause. Or use ls.

ls -la ~/Downloads

In that case (useful anyhow), try Permissions Fix.

This might happen because of the owner keyword in the AppArmor profile.

related source code file:
/etc/apparmor.d/home.tor-browser.firefox

[1] The same user under which the browser is running.

1 Like
12

$ stat -c ā€˜%Uā€™ /home/user/Downloads/avatar.jpg
user

The directory & all of its files are owned by user.

1 Like
13

home.tor-browser.firefox#L124 (cannot post links)

audit deny owner @{HOME}/*/* r,

Deny rules have precedence over allow rules and so this rule will override the rules above. The order of rules do not matter.

To reproduce, simply create a file ~/Downloads/test and ~/test2. Open Tor Browser and drag both files to it. With the current rule set, both files will be denied. If you remove the marked deny rule, the test file will be allowed and test2 still denied as expected (the default is to deny). I think both of the deny rules at the end can be deleted.

3 Likes
14

Thank you. This seems perfectly correct. However, Iā€™d like to wait for @Patrick to confirm before I proceed with modifying this apparmor profile.

15

Try. As per: The User Co-developer Concept

16

Extraextra: Perhaps I have expressed myself in a misleading way. I meant: I ran a mail provider in the browser window.

17

Put the files that you want to upload in a subdirectory of /home/user/.tb/tor-browser/ (but not in that subroot itself). In my case, I created /home/user/.tb/tor-browser/Browser/Downloads/Pictures The rule that governs is:

  owner /**/*-browser/** mrwlkix,

I think the idea is the browser should only have access to a sub-root of its installation, and nothing else. So I would be leery of modifying the apparmor profile to allow extra permissions.

1 Like
18

Uploads will hopefully be fixed by this.

Inspired by apparmor.d project.

2 Likes
19

That sounds good. Thank you for information!

1 Like
20

Tested, now its fixed.

1 Like