Ok, that makes a lot of sense. snap-confine needs to be update to work on nfs (eg, add 'network inet, network inet6,'. Based on 'name="/home/r/"' it looks like you are still using the '@{HOMEDIRS}+=/home/u/' change to the home tunable (or perhaps you didn't reload snap-confine's profile after changing it)?
Robert, can you:
1. adjust the tunable to have: @{HOMEDIRS}+=/home/*/
2. adjust /etc/apparmor.d/usr.lib.snapd.snap-confine to have: #include <abstractions/nameservice>
3. reload the snap-confine profile with:
sudo apparmor_parser -r /etc/apparmor.d/usr.lib.snapd.snap-confine
I suspect you may need to also add to /etc/apparmor.d/usr.lib.snapd.snap-confine:
#include <abstractions/base>
Once you do the above, can you report back? I suspect that any snaps that don't 'plugs: [ network ]' will fail to work for the same reasons as snap-confine. Eg, hello-world will fail, but vlc will not.
Ok, that makes a lot of sense. snap-confine needs to be update to work on nfs (eg, add 'network inet, network inet6,'. Based on 'name="/home/r/"' it looks like you are still using the '@{HOMEDIRS} +=/home/ u/' change to the home tunable (or perhaps you didn't reload snap-confine's profile after changing it)?
Robert, can you: +=/home/ */ d/usr.lib. snapd.snap- confine to have: #include <abstractions/ nameservice> d/usr.lib. snapd.snap- confine
1. adjust the tunable to have: @{HOMEDIRS}
2. adjust /etc/apparmor.
3. reload the snap-confine profile with:
sudo apparmor_parser -r /etc/apparmor.
I suspect you may need to also add to /etc/apparmor. d/usr.lib. snapd.snap- confine:
#include <abstractions/base>
Once you do the above, can you report back? I suspect that any snaps that don't 'plugs: [ network ]' will fail to work for the same reasons as snap-confine. Eg, hello-world will fail, but vlc will not.