x11 plug doesn't allow getsockname, breaks xeyes

[Chad Miller]

$ cat snapcraft.yaml
name: xeyes
version: 1
description: eyes
summary: toy
apps:
 xeyes:
  command: usr/bin/xeyes
  plugs: [ x11 ]
parts:
 pkg:
  plugin: nil
  stage-packages: [ x11-apps ]

$ sudo snap install xeyes_1_amd64.snap

$ /snap/bin/xeyes
Bad system call

$ sudo snap remove xeyes; sudo snap install xeyes_1_amd64.snap --devmode

$ dmesg

[14679.559162] audit: type=1400 audit(1461575043.232:81): apparmor="DENIED" operation="open" profile="/usr/bin/ubuntu-core-launcher" name="/home/.ecryptfs/cmiller/.Private/" pid=17382 comm="ubuntu-core-lau" requested_mask="rw" denied_mask="rw" fsuid=1000 ouid=1000
[14679.559225] audit: type=1400 audit(1461575043.232:82): apparmor="DENIED" operation="open" profile="/usr/bin/ubuntu-core-launcher" name="/home/.ecryptfs/cmiller/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWb4VZJUL514cESvVcp5DUiJnlmnLbK3jZjVm2NAu0yQBQyD7yyIFBnaJE--/" pid=17382 comm="ubuntu-core-lau" requested_mask="rw" denied_mask="rw" fsuid=1000 ouid=1000
[14679.559280] audit: type=1400 audit(1461575043.232:83): apparmor="DENIED" operation="open" profile="/usr/bin/ubuntu-core-launcher" name="/home/.ecryptfs/cmiller/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWb4VZJUL514cESvVcp5DUiJnlmnLbK3jZjVm2NAu0yQBQyD7yyIFBnaJE--/ECRYPTFS_FNEK_ENCRYPTED.FWb4VZJUL514cESvVcp5DUiJnlmnLbK3jZjVSLLqGjPZbPkisPnF3LfOn---/" pid=17382 comm="ubuntu-core-lau" requested_mask="rw" denied_mask="rw" fsuid=1000 ouid=1000
[14679.559345] audit: type=1400 audit(1461575043.232:84): apparmor="DENIED" operation="open" profile="/usr/bin/ubuntu-core-launcher" name="/home/.ecryptfs/cmiller/.Private/ECRYPTFS_FNEK_ENCRYPTED.FWb4VZJUL514cESvVcp5DUiJnlmnLbK3jZjVm2NAu0yQBQyD7yyIFBnaJE--/ECRYPTFS_FNEK_ENCRYPTED.FWb4VZJUL514cESvVcp5DUiJnlmnLbK3jZjVSLLqGjPZbPkisPnF3LfOn---/ECRYPTFS_FNEK_ENCRYPTED.FWb4VZJUL514cESvVcp5DUiJnlmnLbK3jZjVCxyq5n0vRbI7ulhTVdrjek--/" pid=17382 comm="ubuntu-core-lau" requested_mask="rw" denied_mask="rw" fsuid=1000 ouid=1000

[Chad Miller (cmiller)]

Doesn't seem to be dependent on ecryptfs home.

[Zygmunt Krynicki (zyga)]

I just tried this locally and the issue seems to be "getsockname" which is not in the x11 interface.

[Zygmunt Krynicki (zyga)]

This is fixed by this branch: https://github.com/ubuntu-core/snappy/pull/1069

[Adam Conrad (adconrad)]

Hello Chad, or anyone else affected,

Accepted snapd into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snapd/2.0.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Steve Langasek (vorlon)]

The verification of the Stable Release Update for snapd has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.