Under Ubuntu 22.04, AppArmor is active by default and configured to check all file accesses of Firefox and LibreOffice. Firefox is packaged as a "snap". When I look which file accesses AppArmor rejected, I get this list:

# grep audit /var/log/kern.log | grep DENIED | fgrep snap.firefox.firefox \
  | grep 'operation="open"' | sed -e 's/.*name="\([^"]*\)".*/\1/' | sort -u

Why is Firefox trying to access my .viminfo, .bash_history, .python_history, and .lesshst files? These files contain most private information about my habits.

I can understand the attempts to access to .gtkrc-2.0 (Gtk configuration) and .xsession-errors (Xorg errors).

I have checked the Firefox plugins and addons: only trustable ones.

1 Answer 1


I'm not aware of any code inside Firefox that does this and this does not reproduce for me with Mozilla's own build. But Firefox itself relies on GTK, Glib, FreeType, Pango, DBus, X11/Wayland, etc... libraries, so the offending code could originate from a lot of places.

It may be worthwhile to compare Mozilla's build to the Ubuntu Snap package to identify whether this is specific to the Snap.

  • I am now using the non-snap package of Firefox. (The snap version's behaviour regarding download directories was unbearable.) It does not leave any traces in /var/kern/log. But this only means that there are no AppArmor rules for firefox. If this Firefox build accesses /home/bruno/.bash_history, I would not know it. Jan 18 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .