Ubuntu 22.04 Firefox Snap breaks KeePassXC integration and other NativeMessaging protocol 25 apps

Question

How can I get this back to work ? My whole password manager integration is now broken thanks to snap. People with 1password will have the same problem.

Regarding "duplicate for ppa install over snap" I'll copy my comment: technically yes, but it's a nice hack and ultimately a workaround (and if you're just trying to get some native transport working after upgrading, it is not the thing you'll search for).

Answer 1

Update: Native messaging support in the Firefox snap is now available as beta. Beware that this is pretty fresh - the code hasn't been merged upstream, yet, so don't expect this to be production-ready. There is also a German article by Heise Online with a step-by-step guide on how to get this going - in case you want to give it a try.

---

Unfortunately this issue can't be fixed on KeePassXC's end and so far neither Flatpak nor Snap support NativeMessaging, yet (their sandboxing techniques prevent the browser extension from talking to the KeePassXC process). While work on a solution is in progress, all we can do is work around this issue (or switch to a distro which still provides browsers as regular packages like Debian). The KeePassXC Troubleshooting guide recommends installing the browser from the official PPA. This isn't pretty but the following approach worked for me:

1. Uninstall the Firefox snap

   sudo snap remove firefox
   

2. Ubuntu provides a transitional firefox Debian package which installs the Snap. We need to ensure that packages from Mozilla's PPA have higher priority (otherwise apt might "upgrade" to the Snap again).

   echo '
   Package: firefox
   Pin: release o=LP-PPA-mozillateam
   Pin-Priority: 1001
   ' | sudo tee /etc/apt/preferences.d/mozilla-firefox
   

   If you are using unattended-upgrades you also need to run the following to ensure unattended-upgrades takes the Mozilla PPA into account:

   echo 'Unattended-Upgrade::Allowed-Origins:: "LP-PPA-mozillateam:${distro_codename}";' | sudo tee /etc/apt/apt.conf.d/51unattended-upgrades-firefox
   

3. Install Firefox from Mozilla's PPA:

   sudo add-apt-repository ppa:mozillateam/ppa
   sudo apt update
   sudo apt install firefox
   

4. Disable AppArmor for Firefox to ensure the Firefox extension can connect to KeepassXC:

   sudo ln -s /etc/apparmor.d/usr.bin.firefox /etc/apparmor.d/disable/
   sudo apparmor_parser -R /etc/apparmor.d/usr.bin.firefox
   

5. Run KeePassXC and enable browser integration (menu Tools -> Settings -> Browser Integration, tick "Enable browser integration" and "Firefox").
6. Run Firefox, open settings of the KeePassXC extension -> Connected Databases -> Connect.

Disclaimer

This approach has the drawback that AppArmor is disabled completely - beware that this weakens security. Maybe someone with more AppArmor experience can contribute a safer way to get NativeMessaging working again?

Troubleshooting

A few tips in case you run into issues:

• You can check whether you are running the Snap version or the regular version of Firefox by opening Help -> About Firefox. If the version number doesn't mention "Snap" you are running the regular version:
• You can check the apt priorities by running apt-cache policy firefox. Verify that the Mozilla PPA has higher priority than the official Ubuntu repository. The output might look like this:

  $ apt-cache policy firefox
  firefox:
    Installed: 101.0.1+build1-0ubuntu0.22.04.1~mt1
    Candidate: 101.0.1+build1-0ubuntu0.22.04.1~mt1
    Version table:
       1:1snap1-0ubuntu2 500
          500 http://de.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
  *** 101.0.1+build1-0ubuntu0.22.04.1~mt1 1001
          500 https://ppa.launchpadcontent.net/mozillateam/ppa/ubuntu jammy/main amd64 Packages
          100 /var/lib/dpkg/status
  

Answer 2

I prefer to use the Firefox Snap Beta with native messaging support (as mentioned by others), over the other alternatives which also have their drawbacks. Install it with:

sudo snap refresh firefox --beta

On a fully updated Ubuntu 22.04 LTS, I did not have to do any additional steps mentioned in the Heise article, such as systemctl --user restart xdg-desktop-portal.

The Firefox beta (105.0b3) works well with KeePassXC (2.7.1) from the official PPA and the Firefox KeePassXC-Browser extension (version 1.8.1). Other KeePassXC packages did not work for me. Install KeePassXC with:

sudo add-apt-repository ppa:phoerious/keepassxc
sudo apt update
sudo apt install keepassxc

Answer 3

As an alternative to the other answer (without PPA), simply use the official version from mozilla.org.

It can be used as static/portable installation, the executable is path/to/firefox/firefox. It can also be installed system-level as said here (as per comment by @mook75), something which copies that folder to /opt, creates needed symlinks (so that a command like firefox starts the browser), and provides a launcher.

Testing in 22.04 (portable) I have found no limitations compared to the previous non-snap version, all addons work, there is just the fact that update has to be done with a click in Help - About Firefox.

With portable install we need to create a launcher for it, manually or with a menu editor like Alacarte or KDE Menu Editor.

Answer 4

I really dislike snap, so I decided to uninstall and use apt

KeepassXC browser integration was working with the snap version, but not with apt version. So, I tried to revert, and it was no longer working with snap.

Hours later, I solved it and managed to have the Firefox apt version connecting with KeepassXC without deactivating the apparmor protection. I primarily based my solution on the KeepassXC Troubleshoot:

1. . Add the rules below to /etc/apparmor.d/usr.bin.firefox just somewhere before you encounter the first profile (in my case it is called profile lsb_release):

  # Native Messaging
  owner @{HOME}/.mozilla/**/native-messaging-hosts/** ixr,
  /usr/bin/keepassxc-proxy ixr,
  /run/user/1000/org.keepassxc.KeePassXC.BrowserServer ixr,
  /run/user/1000/app/org.keepassxc.KeePassXC/org.keepassxc.KeePassXC.BrowserServer wr,

(DISCLAIMER: no idea how important is the place where you add this)

2. Save the file and restart apparmor

sudo service apparmor restart

3. Restart Firefox, if necessary.

Still not working?

If your problem is associated to apparmor, you will find the errors in the syslog:

1. Try to connect keepassXC from Firefox (to make sure that the error is at the end of the syslog)

2. Search for errors associated to syslog: tail -n 100 /var/log/syslog | grep keepass

3. Or to Firefox: tail -n 100 /var/log/syslog | grep firefox

This comment helped me get an idea of what is happening.

Answer 5

Just wait :)

This is a known issue, and a fix is underway, expected somewhere in June

See the Native messaging section here: https://ubuntu.com/blog/how-are-we-improving-firefox-snap-performance-part-1

UPDATE

AFAICS this is fixed now.

Not sure if the KeePassXC integration is already working, but other native-messaging apps are.

Just check them with:

flatpak permissions webextensions

And add a permission with:

flatpak permission-set webextensions xx.yy.zz snap.firefox yes

Answer 6

Earlier answers are no longer relevant as Native Messaging support arrived in Stable Version of Firefox Snap around November 2022. Firefox snap is now unlikely to be the cause of the browser integration failure.

Ubuntu software app might install keepassxc as a snap and keepassxc snap does not support native messaging (and seems unlikely to do so anytime soon). If so, remove the snap version and reinstall keepassxc as a ppa for browser integration to work.

• Remove keepassxc using Ubuntu Software app
• sudo add-apt-repository ppa:phoerious/keepassxc
• sudo apt update
• sudo apt update
• Start keepassxc and go to Tools -> Settings -> Browser Integration
• Select Enable browser integration and Firefox)