An excessive number of AppArmor denials

[Roman Odaisky]

On advice given in another bug, I ran `journalctl | fgrep DEN`. This produced as much as a gigabyte of output which certainly sounds excessive for one week that it represents. I replaced numbers with placeholders so I could `uniq -c` it (<hexN> stands for N hex characters), the top offenders are below. Is something misconfigured?

1152937 audit[<dec>]: AVC apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/Favicons-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
 455154 audit[<dec>]: AVC apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/History-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
 196028 audit[<dec>]: AVC apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
 195406 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
 195406 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
 164056 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/Favicons-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
 130756 audit[<dec>]: AVC apparmor="DENIED" operation="unlink" profile="snap.chromium.chromium" name=<hex168> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
 111779 audit[<dec>]: AVC apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
 111480 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
 111480 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  96203 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/History-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
  62594 audit[<dec>]: AVC apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_www.youtube.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
  62340 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_www.youtube.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
  62340 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_www.youtube.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  49838 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex140> pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  44399 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/Cookies-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  42368 audit[<dec>]: AVC apparmor="DENIED" operation="unlink" profile="snap.chromium.chromium" name=<hex172> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41786 audit[<dec>]: AVC apparmor="DENIED" operation="unlink" profile="snap.chromium.chromium" name=<hex164> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41592 audit[<dec>]: AVC apparmor="DENIED" operation="unlink" profile="snap.chromium.chromium" name=<hex158> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41488 audit[<dec>]: AVC apparmor="DENIED" operation="rmdir" profile="snap.chromium.chromium" name=<hex146> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41398 audit[<dec>]: AVC apparmor="DENIED" operation="unlink" profile="snap.chromium.chromium" name=<hex188> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41398 audit[<dec>]: AVC apparmor="DENIED" operation="unlink" profile="snap.chromium.chromium" name=<hex178> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41398 audit[<dec>]: AVC apparmor="DENIED" operation="unlink" profile="snap.chromium.chromium" name=<hex166> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41398 audit[<dec>]: AVC apparmor="DENIED" operation="rmdir" profile="snap.chromium.chromium" name=<hex158> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  41290 audit[<dec>]: AVC apparmor="DENIED" operation="rmdir" profile="snap.chromium.chromium" name=<hex142> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
  40584 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/Cookies-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  38584 audit[<dec>]: AVC apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name=<hex156> pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
  23639 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/Cookies-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  21997 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex178> pid=<dec> comm="Chrome_SyncThre" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  20733 audit[<dec>]: AVC apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_www.youtube.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
  20612 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_www.youtube.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
  20612 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_www.youtube.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  19260 audit[<dec>]: AVC apparmor="DENIED" operation="mkdir" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_publisher.liveperson.net_0.indexeddb.leveldb/" pid=<dec> comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
  19212 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex158> pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
  19212 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex158> pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
  19129 audit[<dec>]: AVC apparmor="DENIED" operation="mkdir" profile="snap.chromium.chromium" name=<hex160> pid=<dec> comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
  14013 audit[<dec>]: AVC apparmor="DENIED" operation="mknod" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/.org.chromium.Chromium.<alnum>" pid=<dec> comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
  12336 audit[<dec>]: AVC apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/History-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   9740 audit[<dec>]: AVC apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_lpcdn.lpsnmedia.net_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
   9702 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_lpcdn.lpsnmedia.net_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   9702 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_lpcdn.lpsnmedia.net_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   8580 audit[<dec>]: AVC apparmor="DENIED" operation="mknod" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/.org.chromium.Chromium.<alnum>" pid=<dec> comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
   7838 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/QuotaManager-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   7591 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex178> pid=<dec> comm="Chrome_SyncThre" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   6061 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/QuotaManager-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   5376 audit[<dec>]: AVC apparmor="DENIED" operation="mknod" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/.org.chromium.Chromium.<alnum>" pid=<dec> comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
   5298 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/QuotaManager-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   5158 audit[<dec>]: AVC apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/Favicons-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   4732 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex140> pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   4392 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="mknod" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/.org.chromium.Chromium.<alnum>" pid=<dec> comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
   3826 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
   3202 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
   2887 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/History-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   2510 dbus-daemon[<dec>]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/PowerManagement/Inhibit" interface="org.freedesktop.PowerManagement.Inhibit" member="Inhibit" mask="send" name="org.freedesktop.PowerManagement" pid=<dec> label="snap.chromium.chromium" peer_pid=<dec> peer_label="unconfined"
   2269 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/Cookies-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   2134 audit[<dec>]: AVC apparmor="DENIED" operation="rmdir" profile="snap.chromium.chromium" name=<hex152> pid=<dec> comm="ThreadPoolForeg" requested_mask="d" denied_mask="d" fsuid=1000 ouid=1000
   1978 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   1974 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   1946 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   1680 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex174> pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   1553 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/Favicons-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   1344 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name=<hex172> pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   1277 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="rename_src" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/IndexedDB/https_www.youtube.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wd" denied_mask="wd" fsuid=1000 ouid=1000
   1207 audit[<dec>]: AVC apparmor="DENIED" operation="truncate" profile="snap.chromium.chromium" name=<hex146> pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   1128 audit[<dec>]: AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOG" pid=<dec> comm="ThreadPoolForeg" requested_mask="wc" denied_mask="wc" fsuid=1000 ouid=1000
   1116 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1135/.config/chromium/Default/QuotaManager-journal" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
   1020 audit[<dec>]: AVC apparmor="DENIED" operation="mknod" profile="snap.chromium.chromium" name=<hex246> pid=<dec> comm="ThreadPoolForeg" requested_mask="c" denied_mask="c" fsuid=1000 ouid=1000
   1017 kernel: audit: type=1400 audit(<float>:<dec>): apparmor="DENIED" operation="open" profile="snap.chromium.chromium" name="/home/roma/snap/chromium/1123/.config/chromium/Default/IndexedDB/https_docs.google.com_0.indexeddb.leveldb/LOCK" pid=<dec> comm="ThreadPoolForeg" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000

[Sebastien Bacher (seb128)]

Thank you for your bug report, what distribution/version are you using?

The warnings mention liveperson.net, do you have some special extension enabled?

[Roman Odaisky (to-roma-from-lp)]

Ubuntu 20.04, snap version 81.0.4044.138.

I don’t think the mention of the three domain names docs.google.com, youtube.com and lpcdn.lpsnmedia.net is anything special. Most likely these are simply the domains that caused the highest number of filesystem access requests that are for some reason denied. Further down the list (when not truncated at 1000 entries) twitter.com, app.slack.com and other high-profile domains make their appearances.

[Olivier Tilloy (osomon)]

It looks like the chromium snap was automatically refreshed while running, causing this slew of apparmor denials when trying to write to a profile directory that didn't exist any longer.

I'm marking as a duplicate of bug #1616650. To mitigate the problem, I recommend enabling Refresh App Awareness (https://forum.snapcraft.io/t/wip-refresh-app-awareness/10736).