Firefox Snap cannot load PKCS#11 modules (OpenSC / DNIe) due to AppArmor file_mmap denial

Support and Help
1

Ubuntu Version: 26.04

Desktop Environment (if applicable): GNOME

Problem Description:
When trying to add a new Security Device, I am instructed to load a new PKCS#11 Device Driver. But when I enter the full path /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so, an alert says “Unable to add module” and I see this on dmesg:

```
2026-06-11T15:08:23,969247+02:00 audit: type=1400 audit(1781173922.862:777): apparmor=“DENIED” operation=“file_mmap” class=“file” profile=“snap.firefox.firefox” name=“/run/user/1000/doc/a26b111/opensc-pkcs11.so” pid=39017 comm=4261636B67726F7E506F6F6C202331 requested_mask=“m” denied_mask=“m” fsuid=1000 ouid=0
```

I am on latest/candidate: 151.0.4-1, Ubuntu 26.04 LTS.

For the record, this was even after doing

```
$ sudo snap connect firefox:pcscd :pcscd
…
$ snap connections firefox | grep pc
pcscd firefox:pcscd :pcscd manual
```

Relevant System Information:

My card reader is working perfectly from the CLI.

I reported this on Bug #2156447 “Firefox Snap cannot load PKCS#11 modules (OpenSC /...” : Bugs : Snapcraft but wanted to repost here for visibility and also in case I opened the bug in the wrong place.

1 Like
2

The snap uses the lib from its base snap. Not from the host… see this discussion:

(Not sure why it doesn’t work for you though, perhaps a regression?)

2 Likes
3

After digging through Launchpad #1967632 and the older Mozilla/OpenSC discussions, this looks much closer to a Firefox Snap confinement issue than an OpenSC problem.

The AppArmor denial is occurring during the file_mmap stage while Firefox is trying to load the PKCS#11 module, and the fact that the path gets rewritten under /run/user/1000/doc/... is particularly interesting because that is exactly the behavior that has caused trouble in previous reports.

One thing I would verify is whether the module was added through the file picker or entered manually.

The Firefox maintainers explicitly noted that the file picker can interfere with PKCS#11 module loading and recommended typing the path directly instead. Given that your reader works from the CLI, pcscd is connected, and OpenSC itself appears functional, I would lean toward either a regression in the Snap/AppArmor policy or another edge case involving the document portal path translation rather than a problem with the smart card stack itself. The symptoms line up very closely with the long-running PKCS#11 loading issues that have been tracked in Launchpad for several releases now

3 Likes
4

The pcscd interface does not grant you any access to /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so it only gives access to the pcscd daemon socket and the opensc config file in /etc

If you look inside the snapcraft.yaml (in /snap/firefox/current/snap/) you will find a layout entry (as discussed in the conversation I linked above) that maps /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so to $SNAP/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so:

layout:
  /usr/lib/$CRAFT_ARCH_TRIPLET_BUILD_FOR/opensc-pkcs11.so:
    bind-file: $SNAP/usr/lib/$CRAFT_ARCH_TRIPLET_BUILD_FOR/opensc-pkcs11.so

so this points to /snap/firefox/current/usr/lib/x86_64-linux-gnu/pkcs11/opensc-pkcs11.so

With that setup there is no way to make firefox use an outside lib here unless you would do some bad (and insecure) hack like bind mounting your opensc-pkcs11.so on top of the one that is shipped in the snap which indeed introduces a security hole into the snap confinement …

EDIT: IF Firefox allows you to actually freely specify a path here, you should copy the lib into ~/snap/firefox/common/and use this as a path to point to …

2 Likes
5

I used the file picker indeed.

I see the full context in Bug #1967632 “[snap] apparmor denied when trying to load pkcs11 ...” : Bugs : Mozilla Firefox indeed, thanks. I’ll try typing the path directly and report back.

2 Likes
6

I would add one small test to the bug report: try the same module path from a non-snap Firefox build, just to separate the smart-card/OpenSC side from the snap confinement side. If that works, the important detail is probably the /run/user/1000/doc/… rewrite and file_mmap denial, not pcscd. Also worth noting whether the path was typed manually or selected through the file picker, because that changes how the document portal gets involved.

1 Like
7

Pretty much this, yes.

https://ubuntu.com/tutorials/enable-smart-cards-in-snapped-browsers

3 Likes
8

Typing the path directly worked and I didn’t have to copy anything anywhere :+1:

$ snap run --shell firefox
juanlu@bardor:/home/juanlu$ ls -la /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
-rw-r--r-- 1 root root 255880 Feb 16 17:57 /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so

Thanks all!

2 Likes
9

This topic was automatically closed 18 hours after the last reply. New replies are no longer allowed.