All Snaps are denied the ability to use DBus for notifications and apptray indicators in KDE-based flavors

[Aaron Rainbolt]

OS: Kubuntu Noble 24.04 Alpha (two-day old install)
snapd version: 2.61.2
Affected Snaps: firefox, thunderbird, element-desktop

Steps to reproduce:

# For Firefox:
1. Open the Firefox Snap.
2. Open https://www.bennish.net/web-notifications.html.
3. Click "Authorize" and allow the website to send notifications.
4. Click "Show".
Expected result: A notification should be displayed by Plasma, similar to other notifications the system displays.
Actual result: The notification shows up in the upper-right corner of the display, improperly themed and obviously generated by Firefox as a fallback.

# For Thunderbird:
1. Open the Thunderbird Snap.
2. Ensure you are connected to an email account.
3. Unfocus the Thunderbird window.
4. Wait for an email to come through.
Expected result: When the email comes through, a notification should be displayed by Plasma, similar to other notifications the system displays.
Actual result: The notification shows up improperly themed and obviously generated by Thunderbird as a fallback.

# For Element:
1. Open the Element Snap.
Expected result: An apptray indicator should appear in the system tray with the Element logo.
Actual result: No such indicator appears.
2. Log in, ask someone to ping you, then unfocus the window and wait for the ping to come through.
Expected result: A notification should be displayed by Plasma, similar to other notifications the system displays.
Actual result: No notification appears at all.

Additional information:

Based on the output of snappy-debug, this appears to be AppArmor related, at least for element-desktop (but presumably for the others too). Of note are some of the following log entries:
```
= AppArmor =
Time: 2024-03-10T13:4
Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="ListActivatableNames" mask="send" name="org.freedesktop.DBus" pid=2950 label="snap.element-desktop.element-desktop" peer_label="unconfined"
DBus access

= AppArmor =
Time: 2024-03-10T13:4
Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/modules/kwalletd5" interface="org.kde.KWallet" member="isEnabled" mask="send" name="org.kde.kwalletd5" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=1762 peer_label="unconfined"
DBus access

= AppArmor =
Time: 2024-03-10T13:4
Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/modules/kwalletd5" interface="org.kde.KWallet" member="close" mask="send" name="org.kde.kwalletd5" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=1762 peer_label="unconfined"
DBus access

= AppArmor =
Time: 2024-03-10T13:4
Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/StatusNotifierItem" interface="org.freedesktop.DBus.Properties" member="GetAll" name=":1.45" mask="receive" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=2394 peer_label="plasmashell"
DBus access

= AppArmor =
Time: 2024-03-10T13:4
Log: apparmor="DENIED" operation="dbus_signal" bus="session" path="/StatusNotifierItem" interface="org.kde.StatusNotifierItem" member="NewToolTip" mask="send" name="org.freedesktop.DBus" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=2394 peer_label="plasmashell"
DBus access
```

Booting with `apparmor=0` set on the kernel command line fixes the issue with Element (apptray indicator appears, notifications show up). Obviously this is not a solution, but it does isolate AppArmor as being at least partially at fault.

This issue seems to be somewhat similar to https://forum.snapcraft.io/t/dbus-related-apparmor-denials/37422, however it seems as if Element is trying to hit the right paths and interfaces and is still being denied (based on looking at the info in https://github.com/snapcore/snapd/blob/master/interfaces/builtin/desktop_legacy.go and comparing the paths and interfaces there with the paths and interfaces shown by snappy-debug.

I talked about this issue with Erich Eickmeyer and he mentioned that it occurred after a Plasma update. This doesn't make a great deal of sense to me, and I suspect possibly some other component of the affected systems happened to get updated at the same time (perhaps the snapd Snap), but it's definitely worth mentioning.

An example of one of Thunderbird's fallback notifications is attached as a screenshot (as I happened to get an email while typing this report).

[Aaron Rainbolt (arraybolt3)]

Screenshot

[Erich Eickmeyer (eeickmeyer)]

The thunderbird fallback notification bug is here, so this *might* be a dupe: https://bugs.launchpad.net/bugs/2056481

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[John Johansen (jjohansen)]

the rejects here are all from the snap.element-desktop.element-desktop profile. We will need to dig into that profiles permissions. If its getting all the right paths correct then I suspect the peer_label match might be the issue.

[Alex Murray (alexmurray)]

> Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/freedesktop/DBus" interface="org.freedesktop.DBus" member="ListActivatableNames" mask="send" name="org.freedesktop.DBus" pid=2950 label="snap.element-desktop.element-desktop" peer_label="unconfined"

This is provided by the system-observe interface in snapd - currently it looks like element-desktop does not plug this so the element-desktop snap needs to be updated to include this.

> Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/modules/kwalletd5" interface="org.kde.KWallet" member="isEnabled" mask="send" name="org.kde.kwalletd5" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=1762 peer_label="unconfined"
> Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/modules/kwalletd5" interface="org.kde.KWallet" member="close" mask="send" name="org.kde.kwalletd5" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=1762 peer_label="unconfined"

These are provided by the password-manager-service interface in snapd - again currently it looks like element-desktop does not plug this so the element-desktop snap needs to be updated to include this as well.

Finally, for the last two

> Log: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/StatusNotifierItem" interface="org.freedesktop.DBus.Properties" member="GetAll" name=":1.45" mask="receive" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=2394 peer_label="plasmashell"
> Log: apparmor="DENIED" operation="dbus_signal" bus="session" path="/StatusNotifierItem" interface="org.kde.StatusNotifierItem" member="NewToolTip" mask="send" name="org.freedesktop.DBus" pid=2950 label="snap.element-desktop.element-desktop" peer_pid=2394 peer_label="plasmashell"

Yes this is due to the peer_label mismatch - previously plasmashell would run without an AppArmor profile and so was "unconfined" - the most recent apparmor release in Noble contains a new profile for plasmashell in /etc/apparmor.d/plasmashell with the label "plasmashell" - and so now the peer_label doesn't match.

This likely needs to be fixed on the snapd side (or we figure out a way in apparmor to not ship this profile).

[John Johansen (jjohansen)]

the plasmashell profile is necessary for it to work under unprivileged user namespace restrictions.

[Alex Murray (alexmurray)]

So I installed kubuntu-desktop on an up-to-date noble VM and then after logging into the kubuntu session I was able to reproduce the issue for Notifications but I couldn't see anything owning the /StatusNotifierItem dbus path.

For notifications I submitted https://github.com/snapcore/snapd/pull/13737 to snapd which should resolve that but if anyone can help me reproduce the issue for the status notifier item that would be great. FWIW I have attached a screenshot of d-feet showing the various dbus paths owned by plasmashell and /StatusNotifierItem is not listed. Am I perhaps missing some other package that doesn't get pulled in by the standard kubuntu-desktop metapackage?

[Aaron Rainbolt (arraybolt3)]

I assume you didn't install Kubuntu Noble on a VM due to a Calamares bug who's fix isn't managing to migrate out of -proposed. There's a fairly easy workaround for that issue (`vim /lib/x86_64-linux-gnu/calamares/modules/networkcfg/main.py`, search for "0o" via `/0o` and then change the `f` to `f.fileno()`, save and quit with `:wq` and then everything works), so you might try that. (It might also work to just install Calamares from noble-proposed while on the live ISO, then install.)

You can probably compare your list of installed packages with the list of packages in the latest Kubuntu Noble ISO's manifest (https://cdimage.ubuntu.com/kubuntu/daily-live/pending/noble-desktop-amd64.manifest) to see what you're missing, but if you have an additional DE installed alongside, a component of it could be interfering with reproducing the bug.

[Alex Murray (alexmurray)]

Yes I hit that exact issue in Calamares but after fixing it I then hit another similar crash in a different script in calamares - will see if I can reproduce and provide you with details.

[Alex Murray (alexmurray)]

The subsequent error is:

Main script file /usr/lib/x86_64-linux-gnu/calamares/modules/automirror/main.py for python job automirror raised an exception.

Is there any way I can debug this further?

[Alex Murray (alexmurray)]

Ah although it seems I can reboot the VM at this point and whilst Calamares appeared to run again again in the rebooted vm if I choose Install Calamares closes and I see the installed kubuntu environment - weird....

Anyway I think I will be able to use this to debug the original issue further - will continue and let you know what I find.

[Alex Murray (alexmurray)]

Ok whilst I still can't see the /StatusNotifierItem object listed via d-feet I can reproduce the denials when launching element-desktop so I have added some additional changes to the aforementioned PR which resolve these as well. With all the changes from that PR in place all of these mentioned denials are resolved.

[Alex Lowe (lengau)]

Confirming that with snapd from edge (revision 21508), both the notifications and apptray denials are resolved for me.

[Theofilos Intzoglou (parapente)]

I can also confirm that telegram and slack show up correctly in the system tray after updating snapd to revision 21508.

[Khairul Aizat Kamarudzzaman (fenris)]

I can confirm that refresh snapd to edge channel resolved for me too rev 21649

[Erich Eickmeyer (eeickmeyer)]

Confirmed, switching to snapd in edge fixed the issue.

[Melquisedeque Nunes Lopes (melkbr)]

snapd from beta channel fixed the issue for me.