[snap] Permission denied on Private encrypted folder

[Alex N.]

When accessing the Private (/home/username/Private, Encrypted Directory) folder (e.g. via "Link save as...") it shows "Could not read contents of Private, Error opening directory ...: Permission denied"

Package: chromium-browser
Version: 77.0.3865.120-0ubuntu1~snap1

[Olivier Tilloy (osomon)]

I can reliably reproduce the issue after creating an encrypted Private directory with ecryptfs-setup-private (see https://help.ubuntu.com/community/EncryptedPrivateDirectory#Setup_Your_Encrypted_Private_Directory).

The problem stems from the fact that the home interface doesn't allow reading/writing to hidden folders in $HOME, and the ~/Private folder is actually backed by encrypted data in ~/.Private.

This is not specific to chromium, other strictly confined snaps using the home interface would be similarly affected.

Interestingly, saving a file to the folder still works, despite the error and the fact that the file dialog is unable to show the contents of the folder.

[Jamie Strandboge (jdstrand)]

Encrypted home is typically setup as ~/.Private, not ~/Private and the policy already allows:

  owner @{HOME}/.Private/** mrixwlk,
  owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,

The home interface should already allow ~/Private. What is the denial you see in the logs?

[Olivier Tilloy (osomon)]

Indeed I can see the rules you mention in /etc/apparmor.d/abstractions/base, which is included by /var/lib/snapd/apparmor/profiles/snap.chromium.chromium.

However I can reliably reproduce the issue, and I'm seeing the following denial:

  AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/ubuntu/.Private/" pid=11167 comm="pool" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000

[Jamie Strandboge (jdstrand)]

Ok, that is a read on /home/ubuntu/.Private/. Is the encrypted home mounted at the time of the denial?

[Olivier Tilloy (osomon)]

Yes, it is mounted:

ubuntu@bionicvm:~$ mount | grep Private
/home/ubuntu/.Private on /home/ubuntu/Private type ecryptfs (rw,nosuid,nodev,relatime,ecryptfs_fnek_sig=11d8701311f9dc77,ecryptfs_sig=4ca5cd476d88b7cd,ecryptfs_cipher=aes,ecryptfs_key_bytes=16,ecryptfs_unlink_sigs)

[Jamie Strandboge (jdstrand)]

Ok, I'll fix this in the next batch of policy updates for snapd.

[Olivier Tilloy (osomon)]

Thanks Jamie.
I'll mark the bug invalid for chromium. Even though chromium is visibly affected, the root cause has been identified and is going to be fixed soon.

[Jamie Strandboge (jdstrand)]

https://github.com/snapcore/snapd/pull/7779