6

I've been using Snaps such as telegram-desktop and caprine for some time. caprine worked for a few days, but then AppArmor started to show denials in dmesg. caprine didn't even start, just crashed when I tried to launch it. So, I uninstalled it and installed a deb package of caprine, which works fine.

telegram started to have issues too. I can't download/upload files. It just shows "Failed" whenever I try to download/upload something. I looked at my dmesg, and here's what was there:

audit: type=1400 audit(1618899013.777:481): apparmor="DENIED" operation="mkdir" profile="snap.telegram-desktop.telegram-desktop" ...

It seems Snaps don't have AppArmor properly configured. Is there a way to configure this? I had a similar situation with MySQL, where I edited some files and allowed specific paths. How is this done with Snaps?

1 Answer 1

2

I had problems with the Brave browser from snap. It was being blocked from preventing the screen saver from kicking in, so streaming was constantly interrupted. I found the problem to be a couple of things: First, the apparmor policy for all snaps is very restrictive, and second, the profiles provided for individual snap applications aren't picked up automatically.

To start, do what Alexis Evelyn suggests here: Open /lib/apparmor/rc.apparmor.functions and look for the line ADDITIONAL_PROFILE_DIR= and paste your snapd profile directory into that line. For me, the profile directory was /var/lib/snapd/apparmor/profiles/

Then open up the apparmor profile for the program affected for editing (using sudo), like snap.brave.brave. Some of these are very long, so look for a place that seems appropriate, or just scroll to the end (before the closing curly brace) and add a block similar to this, but with the info from your syslog error:

dbus (send)
    bus=session
    interface=org.freedesktop.PowerManagement.Inhibit
    path=/org/freedesktop/PowerManagement/Inhibit
    member=Inhibit
    peer=(label=unconfined),

Hope that helps!

1
  • The ADDITIONAL_PROFILE_DIR advice seems out dated, at least for Ubuntu 22.04.1 when I do sudo apparmor_status --verbose I see all the snap generated profiles from /var/lib/snapd/apparmor/profiles/ listed there.
    – Maks
    Mar 6, 2023 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .