Apps hit apparmor denial trying to connect to unity8's mir_socket

[Michael Terry]

For example, trying to use edge ubuntu-calculator-app (non devmode) in the unity8-session snap, I see:

AVC apparmor="DENIED" operation="connect" profile="snap.ubuntu-calculator-app.ubuntu-calculator-app" name="/run/user/1002/snap.unity8-session/mir_socket" pid=12459 comm="qmlscene" requested_mask="wr" denied_mask="wr" fsuid=1002 ouid=1002

And then the app can't finish launching because of this. I'm guessing the unity8 interface needs a hole poked for this file.

$ snap --version
snap 2.18+unity8-1
snapd 2.18+unity8-1
series 16
ubuntu 16.04

(my snapd is from silo 2129's PPA)

$ snap list ubuntu-calculator-app
Name Version Rev Developer Notes
ubuntu-calculator-app 2.3 19 ubuntucoredev -

[Pat McGowan (pat-mcgowan)]

dupe of lp:1638334?

[Michael Terry (mterry)]

Maybe that's related. But I think here we also have a factor of unity8 not yet exposing its slot?

[Jamie Strandboge (jdstrand)]

With what was discussed in The Hague, the unity8 snap should 'slots: [mir]' and then snaps should 'plugs: [unity8, mir]'. The unity8 snap should put the mir socket in /run/user/[0-9]*/mir_socket as specified in mirConnectedPlugAppArmor in interfaces/builtin/mir.go.

[Pat McGowan (pat-mcgowan)]

fwiw I am not seeing this now

[Michael Terry (mterry)]

This is addressed by https://github.com/snapcore/snapd/pull/2787 and apps specifying "mir" as a plug.