search

brave / brave-browser

Brave browser for Android, iOS, Linux, macOS, Windows.
https://brave.com
Mozilla Public License 2.0
17.91k stars 2.34k forks source link

Components randomly unable to update for users #38609

Open Saoiray opened 5 months ago

Saoiray commented 5 months ago

Description

For quite some time now I have been seeing users complain about things like Widevine not being recognized or ads no longer being blocked. Typically those experiencing this issue will be able to go to brave://components and will see something that says Update Error and will display Version 0.0.0.0 for components. This is especially happening with the components associated with Shields.

In the past, this could be fixed by launching as administrator, but this doesn't seem to work anymore. There have been a variety of workarounds by users, but it seems like it should be more important to get devs to work on this. I've reported it to Mattches and others, but haven't seen any open Github issues or movement on finding solutions. Perhaps it's just internal only or I'm missing it, but wanted to bring here and hope we can get some eyes on it. Thanks

@rebron or @ShivanKaul either of you able to handle or pass to whoever can?

Steps to reproduce

  1. Open Brave
  2. Go to content and experience issues
  3. Go to brave://components and realize it won't update

Actual result

image

Expected result

image

Reproduces how often

Intermittent issue

Desktop Brave version (brave://version info)

This has been happening for a very long time across Desktop and Android, with primarily occurring on Desktop. Hope you don't mind me not putting in revision and all here.

Android device

Misc. Please see variety of links in Miscellaneous Information below as an example.

Channel information

Reproducibility

Miscellaneous information

Posts for example:

https://community.brave.com/t/the-adblocker-is-not-working/550312/2

https://community.brave.com/t/why-i-am-seeing-youtube-ads-in-brave-browser-again-and-also-component-update-error/546476

https://community.brave.com/t/fingerprinting-protection-no-longer-as-good/548139/11

https://www.reddit.com/r/brave_browser/comments/1cl3gtc/unable_to_drag_and_drop_files_in_youtube/

https://www.reddit.com/r/brave_browser/comments/1ck069h/ad_block_suddenly_doesnt_work/

https://community.brave.com/t/several-brave-components-are-not-updating/539258

https://community.brave.com/t/widevine-content-decryption-module-status-update-error-version-0-0-0-0/536020

https://community.brave.com/t/youtube-still-blocking-ads-component-issue/531055

https://community.brave.com/t/getting-ad-blocker-from-youtube/528672/6

https://community.brave.com/t/update-errors-on-components-page/519950

https://community.brave.com/t/brave-component-updates-fail-with-error/513846

https://community.brave.com/t/component-update-issue/510694

https://community.brave.com/t/youtube-ad-blocking-was-glitched/497287/5

https://community.brave.com/t/brave-shields-is-not-working/445208/8

https://community.brave.com/t/brave-ads-resources-error/271085

https://community.brave.com/t/brave-android-ad-block-doesnt-block-ads-brave-adblock-page-is-empty/215943

https://community.brave.com/t/brave-shields-ad-blocker-not-working-after-new-install/181478

https://community.brave.com/t/internal-component-fail-to-update/149628

https://community.brave.com/t/brave-stopped-blocking-ads/538720/17

Examples of suggested workarounds/solutions

https://community.brave.com/t/brave-stopped-blocking-ads/538720/32

https://community.brave.com/t/brave-stopped-blocking-ads/538720/8

https://community.brave.com/t/brave-stopped-blocking-ads/538720/13

Brave-Matt commented 5 months ago

cc @ryanbr @rebron

ShivanKaul commented 5 months ago

Thanks @Saoiray, we're looking into this but we haven't been able to repro so far.

ShivanKaul commented 5 months ago

@Saoiray are you on Windows?

Saoiray commented 5 months ago

Hey @ShivanKaul. Before I answer, let me emphasize I'm not personally experiencing this issue. I created the Github to report it as it's an ongoing issue that I keep seeing raise its ugly little head on Reddit, Brave Community, etc. That said, I am on Windows 11 Pro.

To give a brief rundown, this has happened randomly for over a year. Originally just launching Brave as administrator would resolve it completely. However, newer replies have said this only resolves it on a per session basis and the next time they launch Brave regularly the issue returns.

The more long-term solution at this time had been more like the one proposed at https://community.brave.com/t/brave-stopped-blocking-ads/538720/8 and is further explained at https://community.brave.com/t/brave-stopped-blocking-ads/538720/13

Beyond that, I know I've also seen it resolved just simply by telling people to do a new installation on top of their current browser to do a forced manual update, though this isn't 100% accurate.

In summary, I guess it just seems like at some point during updates Brave is losing privileges on devices. There never seems to be any shared firewall, internet security, or anything in common. Then as people experience this, they come to say things like Brave is no longer blocking ads.

But I get that randomness and not being able to directly reproduce might make this challenging. But I did at least try to provide variety of links so you guys can kind of see it happening and have data there. This includes an ongoing post at https://community.brave.com/t/the-adblocker-is-not-working/550312 if you or others want to try to get info from them while they are experiencing the issue.

Saoiray commented 5 months ago

And another new one at https://www.reddit.com/r/brave_browser/comments/1d5t3pd/brave_browser_stopped_blocking_ads_unless_i_run/

ShivanKaul commented 5 months ago

So far all of these look like they're on Windows and are related to folder permissions.

Saoiray commented 5 months ago

So far all of these look like they're on Windows and are related to folder permissions.

Yeah, I mentioned primarily seeing it on Desktop. In terms of folder permissions, I guess struggle is determining why people are losing permissions. Perhaps it's related to what TEMP-ad was mentioning.

Btw, have one more shared today

https://community.brave.com/t/youtube-ads-on-brave-browser-need-assistance/552112

Saoiray commented 5 months ago

Another +1 https://community.brave.com/t/fingerprinting-protection-blocklist-update-error/553270

bsclifton commented 4 months ago

Hi folks - thanks for capturing all the incidents, @Saoiray

I'd like to propose some steps we can try with users in the future. If this works, we can consider putting a permissions check in place in Brave and then linking to a help article with steps similar to this.

If the person is NOT on Windows, I think there is a different problem. We should capture information about that in a new issue.

When issue happens

  1. Find out if install was a system level install or a user level install.

    • System level means prompt elevated installer to Admin when doing the install.
    • You can tell if it's system level because it'll be installed at %programfiles%\BraveSoftware\Brave-Browser\Application
    • User level will be installed to %LOCALAPPDATA%\BraveSoftware\Brave-Browser\Application

  2. Let's check the profile directory.

    • Windows + R, paste in %LOCALAPPDATA%\BraveSoftware\Brave-Browser\ (or whichever channel affected), and hit enter
    • Once folder is open, right click User Data folder and pick Properties.
    • Click Security tab
    • Make sure the user account the person is running is in the Group of user names field. For example, my account is brian image If that is NOT set, add the user by clicking Edit and then adding the user account.
    • If the user IS in that list, click the Advanced button image
    • Ensure the user account the person is running is listed as the OWNER image
    • If that user account is NOT the owner
    • click Change image
    • Enter the user account, hit Check Names to make sure it's valid, then hit OK image
    • Once that window closes, check the bottom left of the new window
    • Tick the box Replace all child object permission entries with inheritable permission entries from this object and then click Apply image

  3. If the above does NOT fix the issue, we'll need to dig in more.

Why can this happen?

If someone is copying the directory over from another machine or restoring a backup, the folder might not have the current user as the owner of the directory.

If the above steps don't help, there might be another root cause too - which we'll need to find.

ghost commented 4 months ago

@bsclifton

I don't think that's the reason why this happens to many people. I know that because people haven't said anything about copying anything over, but adblocker just stopped working, and then I give the fix and they say it worked, which means it's just for some reason Brave got started as Administrator.

The issue can be replicated by starting any version as admin: All users installation, Per user or Standalone/Zipped/Portable, you will get the same problem, and this only affects the version numbers of the components, not other folders (apparently).

The best way to see this is by brave.exe --user-data-dir=%USERPROFILE%\Desktop\TEMP in Terminal (Admin) and you will see any component version downloaded will look like this:

image

If you close brave and now start brave.exe --user-data-dir=%USERPROFILE%\Desktop\TEMP without admin rights, you will see you can't update the components anymore and you can't even access the folders anymore without you doing it from a file manager with admin rights or Terminal (I use Far).

And that's because as you can see user can't read or write the folder, which causes the folder to be there, but since Brave can't access the folder without admin rights, it causes an error where it can't download a new version.

Of course, the inheritance has to be properly fixed, if not Brave can never access and download new versions of the components.

How to properly fix this? It's very simple.

GUI: You go to the Advanced Security Settings from the User Data folder (TEMP in the case of --user-data-dir=), and just disable inheritance and remove all inherited permissions from this object, and then instead of hitting apply, just just Enable the inheritance so it only does it once. This will force all files to app to get the proper inheritance from the %userprofile% for the three SYSTEM, Administrators and Users.

CMD You start terminal with admin rights and use icacls "User Data" /t /reset or TEMP or whatever folder you placed the User Data and done. or you CD the user data and icacls * /t /reset and it will simply fix it by resetting and adding the proper inhiritance.

When did this started?

It started with https://github.com/brave/brave-browser/releases/tag/v1.53.43 when Chromium 114 got released in Nightly. You should see the same exact behavior in that version.

If you use https://github.com/brave/brave-browser/releases/tag/v1.53.42 the behavior is different, but it was never 'good'.

1.53.42 will work after starting the browser with admin rights, the problem is it is still not inheriting the permissions correctly, it the User permission will only be Read & Execute. Which means, it will be able to read and download new versions BUT it won't remove the old versions, which means you will accumulate all versions a component updates until you fix the inheritance issues, because the folder doesn't have permissions to write.

image

So the permissions were never set correctly to begin with as you can see, TrustedInstaller, CREATOR OWNER, ALL APPLICATIONS AND ALL PACKAGES, and no inherited permissions (Heredado de Objecto primario = Inherited from None), but they were better than what's going on now, at least the updates happened even if they didn't get removed on exit.

That's the whole story about this, easy to reproduce, easy to manually fix, and it is something being caused by whatever it is downloading the components and for some reason doing some strange magic by avoiding giving proper inheritance to the folder, it's only giving 2 of 3 permissions, which I have never seen happening, because you can't really do it, but I guess, and apparently, you can do somehow.

bsclifton commented 4 months ago

@TEMP-ad this is great information - thank you! I'll dig in some more and try to share an update

Mozoloa commented 4 months ago

Hi folks - thanks for capturing all the incidents, @Saoiray

I'd like to propose some steps we can try with users in the future. If this works, we can consider putting a permissions check in place in Brave and then linking to a help article with steps similar to this.

If the person is NOT on Windows, I think there is a different problem. We should capture information about that in a new issue.

When issue happens

  1. Find out if install was a system level install or a user level install.
  • System level means prompt elevated installer to Admin when doing the install.
  • You can tell if it's system level because it'll be installed at %programfiles%\BraveSoftware\Brave-Browser\Application
  • User level will be installed to %LOCALAPPDATA%\BraveSoftware\Brave-Browser\Application
  1. Let's check the profile directory.
  • Windows + R, paste in %LOCALAPPDATA%\BraveSoftware\Brave-Browser\ (or whichever channel affected), and hit enter
  • Once folder is open, right click User Data folder and pick Properties.
  • Click Security tab
  • Make sure the user account the person is running is in the Group of user names field. For example, my account is brian image If that is NOT set, add the user by clicking Edit and then adding the user account.
  • If the user IS in that list, click the Advanced button image
  • Ensure the user account the person is running is listed as the OWNER image

  • If that user account is NOT the owner

    • click Change image
    • Enter the user account, hit Check Names to make sure it's valid, then hit OK image
    • Once that window closes, check the bottom left of the new window
    • Tick the box Replace all child object permission entries with inheritable permission entries from this object and then click Apply image
  1. If the above does NOT fix the issue, we'll need to dig in more.

Why can this happen?

If someone is copying the directory over from another machine or restoring a backup, the folder might not have the current user as the owner of the directory.

If the above steps don't help, there might be another root cause too - which we'll need to find.

This has worked for me where nothing else worked (other than running as admin but I don't want to), I did transfer my old profiles from my old machine at some point a while back but I'm surprised it only started falling appart recently.

For me I had the right permissions on the surface but checking the box and forcing permission update on all the subfolders seem to have fixed it.

spideymang commented 4 months ago

None of @bsclifton nor ghost (deleted account) suggestions worked for me It still shows error in the Components dashboard to update adblocker components :(

Below my device and browser info image

AiZahid commented 4 months ago

Please help me, in Ubuntu 24.04 LTS , facing the same problem, image

spideymang commented 3 months ago

Hi team!

I have fixed the issue in my case with the Adblock components with "update error" Browsing similar issues I found this ticket and comment https://github.com/brave/brave-browser/issues/21753#issuecomment-1073796716

Taking in account this part image

I deleted that folder cffkpbalmllkdoenhmdmpbkajipdjfam from C:\Users\[user_windows]\AppData\Local\BraveSoftware\Brave-Browser\User Data and relaunch the browser

The browser created new folders with updated info of the components, these are the new created folders:

adcocjohghhfpidemphmcmlmhnfgikei
fcggndnjiecfkiomngolonakcmagfomn
gkboaolpopklhgplhaaiboijnklogmbc
iodkpdagapdfkphljnddpjlldadblomo
mfddibmblmbccpadfndgakiopmmhebop
Safe Browsing

Thats the solution for my case but hope this help as a reference for someone else

And now all the missing components from Adblock are updated correctly 😺

cc @Saoiray

chrome___components_

Mozoloa commented 3 months ago

Update, the permission solution worked for a while but now it looks like even more components are failing and ads are back image

Saoiray commented 2 months ago

Trying to get more information, but another person reporting at https://community.brave.com/t/component-update-error-and-extension-installation-issues/564289/

Saoiray commented 2 months ago

Another +1 at https://community.brave.com/t/brave-shield-is-not-working-today/566134/2

szilardszaloki commented 2 months ago

Actually, it's not just components not updating/working properly, but wrong permissions are also likely the root cause of users not being able to access their profiles.

Launching Brave as admin does result in the updater creating component folders with the wrong access permissions (so does launching Chrome by the way).

I'll check if it's the unzip service that creates those component folders with the wrong permissions — by the look of it, it should create them with the default security descriptor (code passes nullptr to CreateDirectoryW()), which means they should inherit the ACEs from their parent directory.

szilardszaloki commented 2 months ago

A simple test program like

CreateDirectoryW(LR"(C:\Users\szilard\Desktop\default_security_descriptor\test)", nullptr);

run as non-admin user or admin (or even Local System, for that matter), always yields the same ACLs for C:\Users\szilard\Desktop\default_security_descriptor\test (inherited from C:\Users\szilard\Desktop\default_security_descriptor, hence there's always an ACE for the user as well) — as expected.

The default security descriptors do differ (see below), but it shouldn't matter, as the access token is not inspected when creating directories.

Deciphering the SDDL syntax:

(A;;GA;;;S-1-5-21-XXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-1000):

Type: A (Access Allowed)
Flags: —
Permissions: GA (Generic All)
ObjectType: —
InheritedObjectType: –
Trustee (SID): S-1-5-21-XXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-1000 (non-admin user)

(A;;GA;;;BA):

Type: A (Access Allowed)
Flags: —
Permissions: GA (Generic All)
ObjectType: —
InheritedObjectType: –
Trustee (SID): BA (Built-in Administrators)

(A;;GA;;;SY):

Type: A (Access Allowed)
Flags: —
Permissions: GA (Generic All)
ObjectType: —
InheritedObjectType: –
Trustee (SID): SY (Local System)

(A;;GXGR;;;S-1-5-5-0-331003):

Type: A (Access Allowed)
Flags: —
Permissions: GXGR (Generic Execute, Generic Read)
ObjectType: —
InheritedObjectType: –
Trustee (SID): S-1-5-5-0-331003 (logon session)
szilardszaloki commented 2 months ago

I opened a ticket for Chromium folks here: https://issues.chromium.org/u/1/issues/365594097

It would be nice to find out why the affected users launch Brave as admin from time to time.

szilardszaloki commented 2 months ago

FWIW, I pinged a few users on Brave Community to get logs and contacted the Chromium team via DMs as well to raise some awareness — they're looking into it on their end.

szilardszaloki commented 2 months ago

Easily reproducible with Chrome:

https://github.com/user-attachments/assets/ad472b31-322b-475f-a3b7-6b107b465869

bsclifton commented 2 months ago

Issue logged upstream with more information here: https://issues.chromium.org/u/1/issues/365594097

szilardszaloki commented 2 months ago

The change that introduced the above behavior in Chromium: https://source.chromium.org/chromium/chromium/src/+/39f446846c5beb0ebfce00c78adc99bd83b10b2f:base/files/file_util_win.cc;dlc=1fe91ecf8212c7ffc27db1e9dc27c4acd3a8e859 — CreateNewTempDirectory() (PathService::Get(DIR_PROGRAM_FILES, &parent_dir) vs. GetSecureSystemTemp(&parent_dir)).