Apparmor denies bind to abstract unix sockets such as @/var/lib/juju/mutex-/store-lock

[Nicholas Skaggs]

After snapping up the juju client, attempting to perform a bootstrap gives me:

Log: apparmor="DENIED" operation="bind" profile="snap.juju.juju" pid=11972 comm="juju" family="unix" sock_type="stream" protocol=0 requested_mask="bind" denied_mask="bind" addr="@/var/lib/juju/mutex-/store-lock"

[Nicholas Skaggs (nskaggs)]

Jamie, what's the status on this?

[Jamie Strandboge (jdstrand)]

@Nicholas, planned but not implemented yet. It was deprioritized to make room for various GA work but is starting to bubble up to the top of the queue again.

[Jamie Strandboge (jdstrand)]

Is this still an issue for the juju snap?

[Adam Stokes (adam-stokes)]

Yes this is still an issue with juju confined snaps

[Zygmunt Krynicki (zyga)]

Is this an issue with apparmor proper or with snapd's use of apparmor for interfaces and confinement in general? Do we need to add a rule to one of the existing interfaces? Is this a new interface for juju specifically?

[Jamie Strandboge (jdstrand)]

FYI, I detailed some of what this might look like here: https://forum.snapcraft.io/t/how-to-use-dbus-run-session-on-ubuntu-core/7077/2 (where we allow snaps to create abstract sockets at @snap.SNAP_NAME.**). This concept could be extended in a similar fashion as the dbus interface, where it might be called 'socket' with a declared name that requires a snap declaration to use the name (that interface I would think would support both abstract and named sockets).

[Tim McNamara (tim-clicks)]

Adding Juju as an affected project as this bug affects our ability to use strict confinement for our snaps.

[Zygmunt Krynicki (zyga)]

Jamie's post https://forum.snapcraft.io/t/how-to-use-dbus-run-session-on-ubuntu-core/7077/2 seems to indicate that this was fixed in 2.36

I'm marking it as fixed released. Please reopen if there is something specific that is also needed.

[Canonical Juju QA Bot (juju-qa-bot)]

This bug has not been updated in 2 years, so we're marking it Low importance. If you believe this is incorrect, please update the importance.