Dear Maintainer,

Apparmor profile for Tor Borwser as shipped in torbrowser-launcher is
too restrictive, which causes crach of Tor Browser when trying to
download any file.

How to reproduce:

Run torbrowser-launcher with apparmor enabled and
/etc/apparmor.d/torbrowser.Browser.firefox in enforce mode. Connect to
Tor network. Open any web page. Try to download any file or even to
save the page (Save As... in the menu).

Log:

$ LC_ALL=C.UTF-8 Browser/start-tor-browser --verbose

(Tor Browser:232643): GVFS-WARNING **: 16:47:35.936: can't init metadata tree /home/dogsleg/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser/.local/share/gvfs-metadata/root: open: Not a directory
**
Gtk:ERROR:../../../gtk/gtkiconhelper.c:495:ensure_surface_for_gicon: assertion failed (error == NULL): Failed to load /usr/share/icons/Adwaita/scalable/status/image-missing.svg: No image loaders are configured. You might need to install a package like glycin-loaders.
Used config: Config {
    image_loader: {},
    image_editor: {},
} (gdk-pixbuf-error-quark, 0)
Bail out! Gtk:ERROR:../../../gtk/gtkiconhelper.c:495:ensure_surface_for_gicon: assertion failed (error == NULL): Failed to load /usr/share/icons/Adwaita/scalable/status/image-missing.svg: No image loaders are configured. You might need to install a package like glycin-loaders. Used config: Config {     image_loader: {},     image_editor: {}, } (gdk-pixbuf-error-quark, 0)
Redirecting call to abort() to mozalloc_abort

Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Browser/start-tor-browser: line 392: 232643 Segmentation fault         TOR_CONTROL_PASSWD=${TOR_CONTROL_PASSWD} ./firefox "${@}" < /dev/null

Disabling /etc/apparmor.d/torbrowser.Browser.firefox or switching it
to complain mode is a workaround, which means that Apparmor profile is
too restrictive. The same error was reported against Firefox and
firejail upstream, please see:
https://github.com/netblue30/firejail/issues/6906.

I consider the reporting bug a security hole, because the mentioned
workaround requires unsafe usage of Tor Browser, that is with disabled
Apparmor protection.

With regards,
Lev

Dear Maintainer,

this bug report #1138831 describes the same problem as the older bug report
#1130690 :
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1130690

So please merge them.

Yours,

Ph. C.

Hi Philippe,

I'm sending my reply both to you and #1138831.

Ср 19 авг 2026 @ 22:08 Philippe Caillaud <bugs24@neto.info>:

Thank you for your message.

As I see, #1138831 was merged with #1130690 and downgraded (from grave
to important) today by Thomas Ward.

I don't think that merging the suggested workaround into the package is
a good idea, since it downgrades security. The proper fix would be to
compare Apparmor rules for Mozilla Firefox and adopting them for
Torbrowser. (Since _probably_ Firefox does the same thing when saving
files to disk.)

With regards,
Lev