Public bug reported:
(I have no idea what I have done, i solved this problem for me with an AI -
privatemode.ai - and it suggested to open a bug report). It even gave me the
following text. Regards, Jan
---
Since a recent update on Ubuntu 24.04 (apparmor
4.0.1really4.0.1-0ubuntu0.24.04),
snaps with network access are denied TCP traffic by their AppArmor profiles.
Affected snaps (as user-reported): ecosia-browser, nextcloud-desktop-client.
Non-snap browsers (Firefox .deb) are unaffected.
Symptoms:
- Chromium-based snap browser: ERR_ACCESS_DENIED on every page
- Nextcloud client: "Invalid Socket Descriptor"
Kernel audit log shows:
apparmor="DENIED" operation="file_perm" class="net"
profile="snap.ecosia.ecosia" sock_type="stream" protocol=6
faddr=... fport=443 requested="receive" denied="receive"
(likewise for snap.nextcloud-desktop-client.nextcloud, denied="send")
Workaround (confirmed working by the user):
sudo apparmor_parser -r -C /var/lib/snapd/apparmor/profiles/snap.ecosia.ecosia
sudo apparmor_parser -r -C
/var/lib/snapd/apparmor/profiles/snap.nextcloud-desktop-client.nextcloud
i.e. putting the generated snap profiles into complain mode restores
connectivity. This suggests the generated profiles lack proper network
mediation rules after the AppArmor 4.x transition.
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169387
Title:
AppArmor 4.0.1 snap profiles deny TCP network traffic (file_perm
class="net") for snappy apps
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2169387/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
