AppArmor denied operation open to snap pick-colour-picker

Bug #1851661 reported by Douglas Silva
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
apparmor (Ubuntu)
Invalid
Undecided
Unassigned

Bug Description

I've written an issue here: https://github.com/stuartlangridge/ColourPicker/issues/63

Pick (a color picker distributed as a snap) will not launch. The creator of the application believes this to be a problem with my system, not with their app. Apparently, AppArmor is preventing it from starting. I'm not familiar with this MAC implementation, but the logs suggest that this is the problem. See the attachment.

```
nov 07 11:18:29 alq22 audit[27542]: AVC apparmor="DENIED" operation="open" profile="snap.pick-colour-picker.pick-colour-picker" name="/proc/27542/mounts" pid=27542 comm="python3" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
nov 07 11:18:29 alq22 kernel: audit: type=1400 audit(1573136309.796:304): apparmor="DENIED" operation="open" profile="snap.pick-colour-picker.pick-colour-picker" name="/proc/27542/mounts" pid=27542 comm="python3" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
```

This is a fresh installation of Ubuntu 18.04.3. I take great care not to mess with system components such as snapd. Other snaps are working properly.

Revision history for this message
Douglas Silva (o-alquimista) wrote :
Revision history for this message
Seth Arnold (seth-arnold) wrote :

Hello Douglas, thanks for the report. AppArmor is one of several tools the snap packaging system uses to enforce confinement on packages. The AppArmor project doesn't supply the policy though, just the enforcement mechanism. I believe you'll need to talk to whoever wrote the snap package, as they request the privileges necessary when packaging the application.

Try 'snap info' on the name of the snap package that provides the colour picker; it should provide some contact details for the packager.

Thanks

Changed in apparmor (Ubuntu):
status: New → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.