When launched from browser extension, parent 1password process is inheriting browser fds/sockets

While doing some other checks, I noticed that the parent 1password process (/opt/1Password/1password --silent), when automatically started from the browser extension at browser startup, is keeping the browser's file-descriptors open, including some sockets in CLOSE_WAIT state.

Is that to be expected? It looks at least suspicious when first encountered, also because it has e.g. the browser extension files open.

(output below is filtered for user ids and ip addresses)

$ lsof $(pgrep --oldest 1password) -n  | grep mozilla
1password 9394 <userid>    9r      REG                0,1    722920    83331 /memfd:mozilla-ipc (deleted)
1password 9394 <userid>   11w      REG              253,1         0 10887672 /home/<userid>/.mozilla/firefox/<profile>.default/.parentlock
1password 9394 <userid>   27r      REG              253,1   1650557 42336290 /home/<userid>/.cache/mozilla/firefox/<profile>.default/startupCache/startupCache.8.little
1password 9394 <userid>   28r      REG                0,1       308    85182 /memfd:mozilla-ipc (deleted)
1password 9394 <userid>   31r      REG              253,1    606769 42337768 /home/<userid>/.cache/mozilla/firefox/<profile>.default/startupCache/scriptCache-child-current.bin (deleted)
1password 9394 <userid>   33r      REG              253,1   8517949 42337749 /home/<userid>/.cache/mozilla/firefox/<profile>.default/startupCache/scriptCache-current.bin (deleted)
1password 9394 <userid>   36r      REG              253,1    673732  4983179 /usr/lib/firefox/browser/features/[email protected]
1password 9394 <userid>   42r      REG              253,1    163312  4983183 /usr/lib/firefox/browser/features/[email protected]
1password 9394 <userid>   43r      REG                0,1    316306    87173 /memfd:mozilla-ipc (deleted)
1password 9394 <userid>   45u      REG              253,1      1255 10361637 /home/<userid>/.cache/mozilla/firefox/<profile>.default/cache2/entries/0E446D648C56680FE37EA1F761F6CD0AE888192E
1password 9394 <userid>   55r      REG              253,1    209003 11016314 /home/<userid>/.mozilla/firefox/<profile>.default/extensions/[email protected]
$ lsof  -p $(pgrep --oldest 1password) -n -i -a
1password 9394 <userid>   87u  IPv6  84139      0t0  TCP <local ipv6>:50392->[2600:9000:21c7:...]:https (CLOSE_WAIT)
1password 9394 <userid>  146u  IPv4  81153      0t0  TCP <local ipv4>:59894->151.101....:https (CLOSE_WAIT)
1password 9394 <userid>  148u  IPv4  79714      0t0  TCP <local ipv4>:40790->35.244....:https (CLOSE_WAIT)
1password 9394 <userid>  216u  IPv6  82358      0t0  TCP <local ipv6>:54196->[2606:4700:20::..]:https (CLOSE_WAIT)
1password 9394 <userid>  217u  IPv6  80720      0t0  TCP <local ipv6>:36732->[2a00:1450:4013:..]:https (CLOSE_WAIT)
1password 9394 <userid>  223u  IPv6  91253      0t0  TCP <local ipv6>:46302->[2606:4700:10:...]:https (CLOSE_WAIT)

initially, those connections are even ESTABLISHED, but after several hours that remain present as CLOSE_WAIT.
I checked a separately started 1password instance, and the connections observed there are less (just 3) and to different IP ranges.

Using Firefox version 88.0 as provided by Ubuntu on 18.04 LTS.


1Password Version: 8.0.33-53.BETA
Extension Version: 1.24.1
OS Version: Ubuntu 18.04.5 LTS
Sync Type: Not Provided


  • Dayton_agDayton_ag

    Team Member

    Hey there @lieverse, thanks so much for bringing this to our attention - I apologize for the delay here!

    I've spoke with the Development team about this issue and we've created an internal issue to explore this further. Of note, it does seem to be related to this Mozilla bug, so it may be that we'll need to wait for Mozilla on this one, but nonetheless our Dev team will be looking at it from our end. Thanks again for bringing this to our attention! :smile:

Leave a Comment

BoldItalicStrikethroughOrdered listUnordered list
Align leftAlign centerAlign rightToggle HTML viewToggle full pageToggle lights
Drop image/file