All our snaps that use browser-support plug crash on userns_create

[KDE]

snappy-debug

= AppArmor =
Time: 2025-01-21T07:1
Log: apparmor="DENIED" operation="userns_create" class="namespace" profile="snap.falkon.falkon" pid=14213 comm="falkon" requested="userns_create" denied="userns_create"

Crash:

[14213:14213:0121/071207.596254:FATAL:credentials.cc(126)] Check failed: . : Permission denied (13)
Trace/breakpoint trap (core dumped)

[KDE (kde-community)]

Also affects digikam snap

https://bugs.kde.org/show_bug.cgi?id=498663

[KDE (kde-community)]

Angelfish

= AppArmor =
Time: 2025-01-21T07:3
Log: apparmor="DENIED" operation="userns_create" class="namespace" profile="snap.angelfish.angelfish" pid=114675 comm="angelfish" requested="userns_create" denied="userns_create"

[KDE (kde-community)]

Marble

= AppArmor =
Time: 2025-01-21T07:3
Log: apparmor="DENIED" operation="userns_create" class="namespace" profile="snap.marble.marble" pid=115508 comm="marble" requested="userns_create" denied="userns_create"

[KDE (kde-community)]

Ghostwriter

= AppArmor =
Time: 2025-01-21T07:3
Log: apparmor="DENIED" operation="userns_create" class="namespace" profile="snap.ghostwriter.ghostwriter" pid=118952 comm="ghostwriter" requested="userns_create" denied="userns_create"

kalgebra

= AppArmor =
Time: 2025-01-21T07:4
Log: apparmor="DENIED" operation="userns_create" class="namespace" profile="snap.kalgebra.kalgebra" pid=119438 comm="kalgebra" requested="userns_create" denied="userns_create"

[Maciej Borzecki (maciek-borzecki)]

Thanks for reporting this. Is this a new behavior in KDE frameworks that it attempts to create a new user namespace during app startup?

[KDE (kde-community)]

Apparently. We never hit this bug before. It appears qt6webengine is the culprit. soumyadeep suggested

  # browser-sandbox:
  # interface: browser-support
  # allow-sandbox: true

and it works.

now trying QTWEBENGINE_DISABLE_SANDBOX: 1

to see if the snap still works.

[KDE (kde-community)]

Fixing these on my end. bug can be closed