1

Ubuntu 18.04 Desktop

GIMP snap installed (graphic images manipulation)

AppArmor in use as installed then configured by Canonical

All them in virtual machine hypervisored by VmWare

Host machine shares a folder with guest machine. Shared folder is mounted to /mnt/hm-sf/.

On system was found also:

/var/lib/snapd/apparmor/profiles/snap.gimp.gimp

The problem is GIMP snap can't open files from VB shared folder. To fix it local modification of GIMP apparmor profile was implemented then placed to /etc/apparmor.d/local/snap.gimp.gimp.

So /etc/apparmor.d/local/snap.gimp.gimp looks now like:

/mnt/hm-sf/**/ r,
/mnt/hm-sf/**[^/]  rw,

Subsequent profile reload however fails:

$ sudo apparmor_parser -R /etc/apparmor.d/local/snap.gimp.gimp 
AppArmor parser error for /etc/apparmor.d/local/snap.gimp.gimp in \
  /etc/apparmor.d/local/snap.gimp.gimp at line 1: syntax error, \
  unexpected TOK_MODE, expecting TOK_OPEN

How to fix it?

UPDATE

I realized snap architecture features own security layer - snap permissions. Quite possibly it interconnects to AppArmor. Interestingly it provides really convenient GUI interface in Snap Store app for each installed snap app. I used it to enable access to removal media for GIMP snap - and it helps. Possibly it is built that way snap permission was last closed gate on the path to VB shared folder, all were being open. No need to dig into apparmor rules. Hopefully will find soon little time to look into GIMP rules to identify matching one.

6
  • So what is on line two? Jun 6, 2019 at 21:00
  • Are you asking about profile modification file?
    – Fifi Cek
    Jun 6, 2019 at 21:03
  • Yes, it says "line 2: syntax error". Jun 6, 2019 at 21:08
  • Oh, sorry. Log is fixed now. For one but quick verification I had line #1 commented out for short time. Old log was dated to those minutes. Actually every line generates this error. Question presents whole body of profile modification file. There are no other lines in file.
    – Fifi Cek
    Jun 6, 2019 at 21:10
  • I still don't you! Can we see the entire apparmor file? Jun 6, 2019 at 21:13

0

You must log in to answer this question.

Browse other questions tagged .