snap can not start chromium-browser with cgroup v2 and hierarchy

[Daniele Cruciani]

Message from the command line

> $ chromium-browser
> /sys/fs/cgroup/unified/user.slice/user-1000.slice/cgroup.procs

As a workaround I ran the script found in https://github.com/systemd/systemd/issues/3388

```
#!/usr/bin/env bash

set -euo pipefail

file=/sys/fs/cgroup/user.slice/user-$(id -u).slice/cgroup.procs

sudo chown $(whoami):root $file
sudo chmod g+w $file
```

Now the error is:

> $ chromium-browser
> /user.slice/user-1000.slice/session-1.scope is not a snap cgroup

In boot option I have

> GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=1"

Running docker with option

> "exec-opts": ["native.cgroupdriver=systemd"],

rif. https://lists.ubuntu.com/archives/ubuntu-devel/2021-August/041598.html (this was merged)
https://github.com/systemd/systemd/issues/3388

Ubuntu 21.10 uname -a

> Linux iltoshibo 5.13.0-22-generic #22-Ubuntu SMP Fri Nov 5 13:21:36 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

> $ grep cgroup /proc/filesystems
> nodev cgroup
> nodev cgroup2

> $ grep ^cgroup /etc/mtab
> cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime 0 0

ProblemType: Bug
DistroRelease: Ubuntu 21.10
Package: snapd 2.53+21.10ubuntu1
ProcVersionSignature: Ubuntu 5.13.0-22.22-generic 5.13.19
Uname: Linux 5.13.0-22-generic x86_64
ApportVersion: 2.20.11-0ubuntu71
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: XFCE
Date: Mon Jan 10 11:59:32 2022
InstallationDate: Installed on 2020-03-22 (659 days ago)
InstallationMedia: Xubuntu 19.10 "Eoan Ermine" - Release amd64 (20191017)
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: snapd
UpgradeStatus: Upgraded to impish on 2022-01-02 (7 days ago)
modified.conffile..etc.xdg.autostart.snap-userd-autostart.desktop: [deleted]

[Daniele Cruciani (daniele-smartango)]

related also to https://github.com/snapcore/snapd/pull/7825 maybe

[Maciej Borzecki (maciek-borzecki)]

Please attach the output of `SNAPD_DEBUG=1 snap run chromium-browser`.

[Daniele Cruciani (daniele-smartango)]

```
$ SNAPD_DEBUG=1 snap run chromium-browser
2022/01/10 12:56:07.461103 tool_linux.go:204: DEBUG: restarting into "/snap/snapd/current/usr/bin/snap"
error: cannot find current revision for snap chromium-browser: readlink /snap/chromium-browser/current: no such file or directory
```

[Daniele Cruciani (daniele-smartango)]

Sorry, I think it was "chromium" simply:

$ SNAPD_DEBUG=1 snap run chromium
2022/01/10 12:58:44.366692 tool_linux.go:204: DEBUG: restarting into "/snap/snapd/current/usr/bin/snap"
2022/01/10 12:58:44.385669 cmd_run.go:425: DEBUG: SELinux not enabled
2022/01/10 12:58:44.386362 tracking.go:45: DEBUG: creating transient scope snap.chromium.chromium
2022/01/10 12:58:44.388636 tracking.go:185: DEBUG: using session bus
2022/01/10 12:58:44.393780 tracking.go:290: DEBUG: StartTransientUnit failed with "org.freedesktop.DBus.Error.Spawn.ChildExited": [Process org.freedesktop.systemd1 exited with status 1]
2022/01/10 12:58:44.393815 cmd_run.go:1187: DEBUG: snapd cannot track the started application
2022/01/10 12:58:44.393836 cmd_run.go:1188: DEBUG: snap refreshes will not be postponed by this process
DEBUG: umask reset, old umask was 02
DEBUG: security tag: snap.chromium.chromium
DEBUG: executable: /usr/lib/snapd/snap-exec
DEBUG: confinement: non-classic
DEBUG: base snap: core18
DEBUG: ruid: 1000, euid: 0, suid: 0
DEBUG: rgid: 1000, egid: 1000, sgid: 1000
DEBUG: apparmor label on snap-confine is: /snap/snapd/14295/usr/lib/snapd/snap-confine
DEBUG: apparmor mode is: enforce
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: opening lock file: /run/snapd/lock/.lock
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: sanity timeout initialized and set for 30 seconds
DEBUG: acquiring exclusive lock (scope (global), uid 0)
DEBUG: sanity timeout reset and disabled
DEBUG: ensuring that snap mount directory is shared
DEBUG: unsharing snap namespace directory
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: releasing lock 5
DEBUG: opened snap-update-ns executable as file descriptor 5
DEBUG: opened snap-discard-ns executable as file descriptor 6
DEBUG: creating lock directory /run/snapd/lock (if missing)
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: opening lock directory /run/snapd/lock
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: opening lock file: /run/snapd/lock/chromium.lock
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: sanity timeout initialized and set for 30 seconds
DEBUG: acquiring exclusive lock (scope chromium, uid 0)
DEBUG: sanity timeout reset and disabled
DEBUG: initializing mount namespace: chromium
DEBUG: setting up device cgroup
DEBUG: libudev has current tags support
DEBUG: device /sys/devices/pci0000:00/0000:00:02.0/drm/card0 has matching current tag
DEBUG: set_effective_identity uid:0 (change: no), gid:0 (change: yes)
DEBUG: get bpf object at path /sys/fs/bpf/snap/snap_chromium_chromium
DEBUG: set_effective_identity uid:0 (change: no), gid:1000 (change: yes)
DEBUG: found e...

[Maciej Borzecki (maciek-borzecki)]

2022/01/10 12:58:44.388636 tracking.go:185: DEBUG: using session bus
2022/01/10 12:58:44.393780 tracking.go:290: DEBUG: StartTransientUnit failed with "org.freedesktop.DBus.Error.Spawn.ChildExited": [Process org.freedesktop.systemd1 exited with status 1]
2022/01/10 12:58:44.393815 cmd_run.go:1187: DEBUG: snapd cannot track the started application

Indicates that snap asked systemd to create a new scope for the application (since establishing device filtering in your current cgroup would break your session), but that failed. Judging by the error message, `systemd --user` exited or was restarted, hard to tell. Unfortunately there is nothing snapd can do about that.