[snap] apparmor warning when using chromedriver

[yves renier]

Hello,

I noticed my logs are flooded by the following messages when using the chromedriver snap (95.0.4638.69):

AVC apparmor="DENIED" operation="open" profile="snap.chromium.chromedriver" name="/proc/2749786/mem" pid=2749786 comm="bef84659f723721" requested_mask="r" denied_mask="r" fsuid=1001 ouid=1001

I managed to fix it by adding the following line in /var/lib/snapd/apparmor/profiles/snap.chromium.chromedriver :

owner @{PROC}/@{pid}/mem r,

and then running :

sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.chromium.chromedriver

However I understand this change will get overwritten every time the snap is updated, so it would make sense to add this line in the snap package itself.

[Olivier Tilloy (osomon)]

Indeed, this change will get overwritten every time the snap is updated.

Are you observing functional regressions caused by this denial? Or is the problem only about log flooding?

[yves renier (yves-renier)]

It is about log flooding, I did not see any impact otherwise.

[John Johansen (jjohansen)]

If its just log flooding then denying access would get rid of the logging without adding extra permissions. ie.

  deny owner @{PROC}/@{pid}/mem r,

[yves renier (yves-renier)]

True, but I don't see the harm of allowing an application to access information about his own process. Anyway as long as the log don't get flooded anymore, I will be happy :-)

[Launchpad Janitor (janitor)]

[Expired for chromium-browser (Ubuntu) because there has been no activity for 60 days.]