profile snap-update-ns.firefox is denied

[Dimitri John Ledkov]

profile snap-update-ns.firefox is denied

on fresh kinetic boot

[Dimitri John Ledkov (xnox)]

# journalctl --file /tmp/system.journal | grep denied | grep appar
Oct 19 00:18:59 xnox-Standard-PC-Q35-ICH9-2009 audit[1922]: AVC apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/cups/doc-root/" pid=1922 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 19 00:18:59 xnox-Standard-PC-Q35-ICH9-2009 audit[1922]: AVC apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/gimp/2.0/" pid=1922 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 19 00:18:59 xnox-Standard-PC-Q35-ICH9-2009 kernel: audit: type=1400 audit(1666135139.644:56): apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/cups/doc-root/" pid=1922 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 19 00:18:59 xnox-Standard-PC-Q35-ICH9-2009 kernel: audit: type=1400 audit(1666135139.644:57): apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/gimp/2.0/" pid=1922 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 19 00:18:59 xnox-Standard-PC-Q35-ICH9-2009 audit[1922]: AVC apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/libreoffice/help/" pid=1922 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 19 00:18:59 xnox-Standard-PC-Q35-ICH9-2009 audit[1922]: AVC apparmor="DENIED" operation="open" class="file" profile="snap-update-ns.firefox" name="/var/lib/" pid=1922 comm="6" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Oct 19 00:18:59 xnox-Standard-PC-Q35-ICH9-2009 kernel: audit: type=1400 audit(1666135139.648:58): apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/libreoffice/help/" pid=1922 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0

[Dimitri John Ledkov (xnox)]

on encrypted zfs install

[Brian Murray (brian-murray)]

I've also seen this on a fresh install of Ubuntu 22.10 (20221018) with zfs+encryption.

[Thomas Ward (teward)]

Confirmed in QEMU 22.10 from the current ISO image at this time, LVM, no encryption.

$ journalctl | grep denied | grep appa | grep fire
Oct 18 20:09:51 teward-Standard-PC-Q35-ICH9-2009 audit[1248]: AVC apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/cups/doc-root/" pid=1248 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 18 20:09:51 teward-Standard-PC-Q35-ICH9-2009 kernel: audit: type=1400 audit(1666138191.488:56): apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/cups/doc-root/" pid=1248 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 18 20:09:51 teward-Standard-PC-Q35-ICH9-2009 audit[1248]: AVC apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/gimp/2.0/" pid=1248 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 18 20:09:51 teward-Standard-PC-Q35-ICH9-2009 audit[1248]: AVC apparmor="DENIED" operation="mkdir" class="file" profile="snap-update-ns.firefox" name="/usr/share/libreoffice/help/" pid=1248 comm="6" requested_mask="c" denied_mask="c" fsuid=0 ouid=0
Oct 18 20:09:51 teward-Standard-PC-Q35-ICH9-2009 audit[1248]: AVC apparmor="DENIED" operation="open" class="file" profile="snap-update-ns.firefox" name="/var/lib/" pid=1248 comm="6" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

(All firefox related apparmor items are visible at https://pastebin.ubuntu.com/p/jrwcBm62y7/ but I shortened to just the DENIED ones here)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Aaron Rainbolt (arraybolt3)]

Also affects normal installations (ext4, no encryption). Installed, rebooted, logged in, searched logs and found messages.

[Brian Murray (brian-murray)]

Despite the presence of the error messages in my log I'm still able to use Firefox and `snap refresh firefox` seems like it would have worked if there was an update.

[Alberto Mardegan (mardy)]

At least some of these seem could have been fixed by https://github.com/snapcore/snapd/pull/12127 (which has been merged in master, but is not part of any release yet).

[meven (meven29)]

I am experiencing this issue in Ubuntu 22.04.2 LTS.

It possibly causes freezes.