On-Access scanning is blocking firefox 26 on Xubuntu 12.04

Question

What Linux I have $ uname -a Linux AOA-110-Bb 3.2.0-57-generic #87-Ubuntu SMP Tue Nov 12 21:38:12 UTC 2013 i686 i686 i386 GNU/Linux $ lsb_release -a No LSB modules are available. Distributor ID:    Ubuntu Description:    Ubuntu 12.04.3 LTS Release:    12.04 Codename:    precise What Sophos Antivirus I use $ sudo /opt/sophos-av/bin/savdstatus --version Copyright 1989-2013 Sophos Limited. All rights reserved. Sophos Anti-Virus       = 9.5.0 Threat detection engine = 3.48.0 Threat data             = 4.96 Threat count            = 6151965 Threat data release     = Wed 11 Dec 2013 12:00:00 AM What is the problem If you try to update the Firefox for Ubuntu (from the canonical repository) with the following description: Changes for the versions: Installed version: 24.0+build1-0ubuntu0.12.04.1 Available version: 26.0+build2-0ubuntu0.12.04.2 the update will fail, if the On-Access scanning is enabled, with the following log: installArchives() failed: E: Could not open file /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb - open (62: Timer expired) E: Unable to determine the file size - fstat (9: Bad file descriptor) E: Read error - read (9: Bad file descriptor) E: Prior errors apply to /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/firefox-globalmenu_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/firefox-locale-en_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/flashplugin-installer_11.2.202.332ubuntu0.12.04.1_i386.deb debconf: apt-extracttemplates failed: Illegal seek E: Could not open file /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb - open (62: Timer expired) E: Unable to determine the file size - fstat (9: Bad file descriptor) E: Read error - read (9: Bad file descriptor) E: Prior errors apply to /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/firefox-globalmenu_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/firefox-locale-en_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/flashplugin-installer_11.2.202.332ubuntu0.12.04.1_i386.deb debconf: apt-extracttemplates failed: Illegal seek E: Could not open file /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb - open (62: Timer expired) E: Unable to determine the file size - fstat (9: Bad file descriptor) E: Read error - read (9: Bad file descriptor) E: Prior errors apply to /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/firefox-globalmenu_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/firefox-locale-en_26.0+build2-0ubuntu0.12.04.2_i386.deb E: Prior errors apply to /var/cache/apt/archives/flashplugin-installer_11.2.202.332ubuntu0.12.04.1_i386.deb debconf: apt-extracttemplates failed: Illegal seek dpkg-split: error: unable to read part file `/var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb': Timer expired dpkg: error processing /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb (--unpack):  subprocess dpkg-split returned error exit status 2 No apport report written because MaxReports is reached already (Reading database ... (Reading database ... 5%% (Reading database ... 10%% (Reading database ... 15%% (Reading database ... 20%% (Reading database ... 25%% (Reading database ... 30%% (Reading database ... 35%% (Reading database ... 40%% (Reading database ... 45%% (Reading database ... 50%% (Reading database ... 55%% (Reading database ... 60%% (Reading database ... 65%% (Reading database ... 70%% (Reading database ... 75%% (Reading database ... 80%% (Reading database ... 85%% (Reading database ... 90%% (Reading database ... 95%% (Reading database ... 100%% (Reading database ... 450484 files and directories currently installed.) Preparing to replace firefox-globalmenu 24.0+build1-0ubuntu0.12.04.1 (using .../firefox-globalmenu_26.0+build2-0ubuntu0.12.04.2_i386.deb) ... Unpacking replacement firefox-globalmenu ... Preparing to replace firefox-locale-en 24.0+build1-0ubuntu0.12.04.1 (using .../firefox-locale-en_26.0+build2-0ubuntu0.12.04.2_i386.deb) ... Unpacking replacement firefox-locale-en ... Preparing to replace flashplugin-installer 11.2.202.310ubuntu0.12.04.1 (using .../flashplugin-installer_11.2.202.332ubuntu0.12.04.1_i386.deb) ... Unpacking replacement flashplugin-installer ... Processing triggers for update-notifier-common ... flashplugin-installer: downloading http://archive.canonical.com/pool/partner/a/adobe-flashplugin/adobe-flashplugin_11.2.202.332.orig.tar.gz Installing from local file /tmp/tmpIeiG2k.gz Flash Plugin installed. Errors were encountered while processing:  /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb Error in function: Setting up firefox-globalmenu (26.0+build2-0ubuntu0.12.04.2) ... Setting up flashplugin-installer (11.2.202.332ubuntu0.12.04.1) ... Setting up firefox-locale-en (26.0+build2-0ubuntu0.12.04.2) ... If the On-Access scanning is instead disabled, the update is going fine. This can be considered as a minor problem (or even a necessary effort) but it has happened for the first time since I have been updating Ubuntu in the last 4 years. I have never seen any problems before in Ubuntu update due to Sophos antivirus On-Access scanning. This is NOT only an installation problem: if the On-Access ability is enabled again after the (successful) update to Mozilla Firefox 26, such browser doesn’’’’t start. Why am I sure that the problem is only in On-Access scanning functionality? The answer is simply; the Firefox works fine if you disable again the On-Access scanning. Just to be more sure, I have further investigated. The problem is in the following Debian binary package: /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb [You can download it, by yourself, from the canonical page: packages.ubuntu.com/.../download ] If the On-access scanning is disabled, the standard linux command ‘‘‘‘cksum’’’’ or ‘‘‘‘file’’’’ works fine for it, but if the On-access scanning is enabled, the following errors will arise: $ cksum firefox* cksum: firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb: Timer expired 3556819684 8958 firefox-globalmenu_26.0+build2-0ubuntu0.12.04.2_i386.deb $ file firefox* firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb:            regular file, no read permission firefox-globalmenu_26.0+build2-0ubuntu0.12.04.2_i386.deb: Debian binary package (format 2.0) As you can seen also above, the Debian binary package like: firefox-globalmenu_26.0+build2-0ubuntu0.12.04.2_i386.deb is not affected by this problem. The problem is clearly on read and execute access to the other file; On-Access scanning is blocking its execution! Please provide a solution as soon as possible: the browser functionality is the fundamental one! Thanks, Kuba :46225

Kuba · Accepted Answer

Hi, I have followed the DouglasLeeder suggestion and examined the dmesg log. I found there another file with the timeout issue, reporting as follows: ... Timeout occurred while opening /usr/lib/firefox/libxul.so on behalf of process firefox[XXXXX] owned by ... i.e. the file indicated also by BigBird . So, I have applied the BigBird solution with the addition of the initial Debian binary package exclusion. $ sudo /opt/sophos-av/bin/savconfig --all query ... ExcludeFilePaths: /var/cache/apt/archives/firefox_26.0+build2-0ubuntu0.12.04.2_i386.deb                                   /usr/lib/firefox/libxul.so ... ScanArchives: enabled ... Firefox 26.0 is working now correctly even with the archive scanning turned on! Thanks to all for your support, Kuba :46309