Public bug reported: (Mirrored from the upstream report by Paddy Landau: https://github.com/fwupd/fwupd/issues/10706)
### Describe the bug _As [discussed on](https://discourse.ubuntu.com/t/85170) Ubuntu Discourse…_ On Ubuntu Core 26, `fwupdmgr` and the underlying `fwupd` snap daemon fail to operate due to strict AppArmor confinement rules blocking DBus communication with PolicyKit (`polkit`). Because Ubuntu Core is an immutable, snap-only environment without a traditional desktop authentication agent, the snap attempts to register or check authorizations and is instantly blocked by the kernel. Local workarounds like `fwupdtool` or flags to disable checks also fail due to these strict sandbox rules. ### Steps to reproduce 1. Boot a device running a clean image of **Ubuntu Core 26**. 2. Install the `fwupd` snap. 3. Run any basic state command: `fwupdmgr refresh` or `fwupdmgr get-devices` or `fwupdmgr update`. 4. The command fails with an access/policy restriction error. ### Expected behavior The `fwupd` snap should use a valid DBus plug or fallback mechanism when running on Ubuntu Core environments where an active user Polkit session agent does not exist. ### System Information * **OS:** Ubuntu Core 26 (Stable/Candidate) * **Deployment:** Snap-based immutable system * **Affected Component:** `snap.fwupd.fwupdmgr` and `snap.fwupd.fwupd` ### AppArmor Denial Logs The kernel ring buffer (`journalctl --dmesg`) captures explicit `DENIED` flags for `dbus_method_call` operations when interacting with `org.freedesktop.PolicyKit1.Authority`: <details> <summary>journalctl --dmesg</summary> ```shell $ sudo journalctl --dmesg | grep "apparmor.*DENIED.*fwupd" Jul 22 12:58:03 localhost kernel: audit: type=1400 audit(1784725083.067:460): apparmor="DENIED" operation="capable" class="cap" profile="snap.fwupd.fwupdmgr" pid=3123 comm="fwupd-command" capability=2 capname="dac_read_search" Jul 22 12:58:03 localhost kernel: audit: type=1400 audit(1784725083.067:460): apparmor="DENIED" operation="capable" class="cap" profile="snap.fwupd.fwupdmgr" pid=3123 comm="fwupd-command" capability=1 capname="dac_override" Jul 22 13:02:07 localhost kernel: audit: type=1107 audit(1784725327.414:528): pid=956 uid=100 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/PolicyKit1/Authority" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.22" pid=3355 label="snap.fwupd.fwupdmgr" peer_pid=3267 peer_label="unconfined" Jul 22 13:02:07 localhost kernel: audit: type=1107 audit(1784725327.415:529): pid=956 uid=100 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/PolicyKit1/Authority" interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" mask="send" name=":1.22" pid=3355 label="snap.fwupd.fwupdmgr" peer_pid=3267 peer_label="unconfined" Jul 22 13:04:08 localhost kernel: audit: type=1400 audit(1784725448.613:558): apparmor="DENIED" operation="open" class="file" profile="snap.fwupd.fwupdtool" name="/proc/1/cgroup" pid=3404 comm="fwupdtool" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 Jul 22 13:04:13 localhost kernel: audit: type=1107 audit(1784725453.560:564): pid=956 uid=100 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1/unit/snap_2efwupd_2efwupd_2eservice" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name=":1.3" pid=3448 label="snap.fwupd.fwupdtool" peer_pid=1 peer_label="unconfined" Jul 22 13:04:13 localhost kernel: audit: type=1107 audit(1784725453.561:565): pid=956 uid=100 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call" bus="system" path="/org/freedesktop/systemd1/unit/snap_2efwupd_2efwupd_2eservice" interface="org.freedesktop.systemd1.Unit" member="Stop" mask="send" name=":1.3" pid=3448 label="snap.fwupd.fwupdtool" peer_pid=1 peer_label="unconfined" Jul 22 13:04:49 localhost kernel: audit: type=1400 audit(1784725489.888:579): apparmor="DENIED" operation="open" class="file" profile="snap.fwupd.fwupdtool" name="/proc/1/cgroup" pid=3516 comm="fwupdtool" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 ``` </details> ### Additional Context Attempts to manually link interfaces or bypass via `udisks2` fail as `udisks2` is not pre-installed or structured as a typical slot on this base image configuration. The snap's internal slot declarations likely need updating for modern `snapd` engines running on full AppArmor lockdown profiles. **fwupd version information** ```shell $ fwupdmgr --version Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.24" (uid=1000 pid=3355 comm="/snap/fwupd/8528/usr/bin/pkttyagent --notify-fd 6" label="snap.fwupd.fwupdmgr (enforce)") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.22" (uid=111 pid=3267 comm="/usr/lib/polkit-1/polkitd --no-debug --log-level=n" label="unconfined") (g-dbus-error-quark, 9) compile info.libusb 1.0.27 compile org.freedesktop.fwupd 2.1.4 compile com.hughsie.libxmlb 0.3.24 compile io.snapcraft.fwupd 8528 runtime com.hughsie.libxmlb 0.3.24 runtime org.kernel 7.0.0-27-generic runtime org.freedesktop.fwupd 2.1.4 ``` **fwupdtool get-report-metadata** See attachment: [fwupd get-report-metadata.log](https://github.com/user- attachments/files/30270389/fwupd.get-report-metadata.log) <details> <summary>fwupdtool hwids</summary> ```shell $ sudo fwupd.fwupdtool hwids Loading… ▕⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣤ ▏ Computer Information -------------------- BiosVendor: innotek GmbH BiosVersion: VirtualBox BiosMajorRelease: 0 BiosMinorRelease: 1 BiosReleaseDate: 12/01/2006 FirmwareMajorRelease: 00 FirmwareMinorRelease: 01 Manufacturer: innotek GmbH Family: Virtual Machine ProductName: VirtualBox ProductSku: EnclosureKind: 1 BaseboardManufacturer: Oracle Corporation BaseboardProduct: VirtualBox Hardware IDs ------------ {ff9c49e3-f125-5d20-9719-dbd5970ba560} <- Manufacturer + Family + ProductName + ProductSku + BiosVendor + BiosVersion + BiosMajorRelease + BiosMinorRelease {1bba8754-6554-5172-be0f-1813f791c415} <- Manufacturer + Family + ProductName + BiosVendor + BiosVersion + BiosMajorRelease + BiosMinorRelease {503997e3-4712-5f0c-9684-d466f4fbd6c2} <- Manufacturer + ProductName + BiosVendor + BiosVersion + BiosMajorRelease + BiosMinorRelease {f72c5db0-4b5b-58fa-a29c-7a9c7bbc915d} <- Manufacturer + Family + ProductName + ProductSku + BaseboardManufacturer + BaseboardProduct {93ddc337-8dd5-5912-b125-22c643abfbc1} <- Manufacturer + Family + ProductName + ProductSku {f4af0e4f-b6b1-51e6-b1b0-e89122ff97c2} <- Manufacturer + Family + ProductName {5000b2bf-afb4-5815-927d-dcc25a78600d} <- Manufacturer + ProductSku + BaseboardManufacturer + BaseboardProduct {33b0683a-dbd1-5eb0-88b9-d82705e4f82c} <- Manufacturer + ProductSku {49844b5b-317b-59c5-be11-831e91fba136} <- Manufacturer + ProductName + BaseboardManufacturer + BaseboardProduct {d115e295-974b-5e75-9adc-d977e762cf4b} <- Manufacturer + ProductName {e2b17f4b-e031-596f-b8b4-1f1ded72e1cf} <- Manufacturer + Family + BaseboardManufacturer + BaseboardProduct {d85b4471-f11d-5da8-9969-7418961197e5} <- Manufacturer + Family {5036187d-2671-5cd8-8843-4719dfd33c5e} <- Manufacturer + EnclosureKind {b0a9a493-f142-5cac-9da7-3722cb43c13e} <- Manufacturer + BaseboardManufacturer + BaseboardProduct {d14a935a-d678-579f-8875-3aab3d456c85} <- Manufacturer ``` </details> ### Installation <details> <summary>snap install fwupd</summary> ```shell $ snap install fwupd 2026-07-22T12:07:32Z INFO snap "fwupd" has bad plugs or slots: polkit (cannot use "action-prefix" attribute: "/usr/share/polkit-1/actions" is not writable) fwupd 2.1.4 from Canonical✓ installed WARNING: There is 1 new warning. See 'snap warnings'. $ snap warnings last-occurrence: today at 12:15 UTC warning: | snap "fwupd" has bad plugs or slots: polkit (cannot use "action-prefix" attribute: "/usr/share/polkit-1/actions" is not writable) ``` </details> ### `fwupd` information <details> <summary>fwupd device information</summary> Please provide the output of the fwupd devices recognized in your system. ```shell fwupdmgr get-devices --show-all-devices Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.40" (uid=1000 pid=4126 comm="/snap/fwupd/8528/usr/bin/pkttyagent --notify-fd 6" label="snap.fwupd.fwupdmgr (enforce)") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.22" (uid=111 pid=3267 comm="/usr/lib/polkit-1/polkitd --no-debug --log-level=n" label="unconfined") (g-dbus-error-quark, 9) WARNING: UEFI ESP partition not detected or configured See https://github.com/fwupd/fwupd/wiki/PluginFlag:esp-not-found for more information. innotek GmbH VirtualBox │ ├─Core™ i7-10700T CPU @ 2.00GHz: │ Device ID: 4bde70ba4e39b28f9eab1628f9dd6e6244c03027 │ Vendor: Intel │ GUIDs: a45b0522-5722-54bd-b802-86cd044262df ← CPUID\PRO_0&FAM_06&MOD_A5 │ 538440cb-7cac-5185-bc01-d93a1e474058 ← CPUID\PRO_0&FAM_06&MOD_A5&STP_5 │ Device Flags: • Internal device │ ├─SBAT: │ Device ID: 6469856584e2f5873b2f148302e46c9313c7d054 │ Summary: Generation number based revocation mechanism │ Current version: 1.5.4 │ Vendor: OS:ubuntu-core │ GUID: 009def40-8820-52da-8435-8353cfe3d72c ← UEFI\OS_ubuntu-core&VAR_SbatLevelRT │ Device Flags: • Updatable │ • Needs a reboot after installation │ • Signed Payload │ ├─TPM: │ Device ID: 1d8d50a4dbc65618f5c399c2ae827b632b3ccc11 │ Current version: 8217.4131.22.13878 │ Vendor: IBM (TPM:IBM) │ GUIDs: d06686f1-eeac-50d0-9003-6431006d1e0c ← TPM\VEN_IBM&DEV_0001 │ 9a57146f-f92a-5dfb-b497-5a95573a8fff ← TPM\VEN_IBM&MOD_SWTPM │ d2805168-df28-55a3-976d-6f86e3d363a6 ← TPM\VEN_IBM&DEV_0001&VER_2.0 │ 5a26d015-2e4d-5269-819e-daf2d4547fbb ← TPM\VEN_IBM&MOD_SWTPM&VER_2.0 │ Device Flags: • Internal device │ • System requires external power source │ • Needs a reboot after installation │ • Device can recover flash failures │ • Signed Payload │ • Can tag for emulation │ ├─UEFI Key Exchange Key: │ │ Device ID: 2a4c23bfb79b5dabe474cb7b1b3e604645d6f9c6 │ │ Device Flags: • Internal device │ │ │ └─KEK CA: │ Device ID: b7a1d3d90faa1f6275d9a98da4fb3be7118e61c7 │ Current version: 2023 │ Vendor: Microsoft (UEFI:Microsoft) │ URL: https://fwupd.github.io/libfwupdplugin/uefi-db.html │ GUIDs: 814e950f-1449-566a-a190-42c9d3a3a2df ← UEFI\VENDOR_Microsoft&NAME_Microsoft-KEK-CA │ cd94ec34-7163-5f27-8549-1bd4b7872ae8 ← UEFI\CRT_DEC64D7746D983DB3774829A00BF829D9F19E9CF │ Device Flags: • Internal device │ • Updatable │ • Needs a reboot after installation │ • Device is usable for the duration of the update │ • Signed Payload │ • Can tag for emulation │ ├─UEFI PK: │ Device ID: 6924110cde4fa051bfdc600a60620dc7aa9d3c6a │ Summary: UEFI Platform Key │ Current version: 2021 │ Vendor: Oracle Corporation │ GUIDs: 4586d6be-a832-5402-829f-2b58650b84dd ← UEFI\VENDOR_Oracle-Corporation&NAME_UEFI-PK │ 983fb870-5c15-54a4-8d4f-61a3dd79c441 ← UEFI\CRT_AC0986515833A7A0D72BF3076205152B32640CE7 │ Device Flags: • Internal device │ ├─UEFI Signature Database: │ │ Device ID: 0352a8acc949c7df21fec16e566ba9a74e797a97 │ │ Device Flags: • Internal device │ │ │ ├─Option ROM UEFI CA: │ │ Device ID: 92120fc1a625f725901333cbfec152b8d6e42d43 │ │ Current version: 2023 │ │ Vendor: Microsoft (UEFI:Microsoft) │ │ GUIDs: ca4668d9-734f-5b2b-aae8-8120b196f659 ← UEFI\VENDOR_Microsoft&NAME_Microsoft-Option-ROM-UEFI-CA │ │ 965d1919-0e18-5b63-9ebd-e5d122cd11df ← UEFI\CRT_F45B559FC1C60F31B3071021298D5ED7D77280B0 │ │ Device Flags: • Internal device │ │ • Updatable │ │ • Needs a reboot after installation │ │ • Signed Payload │ │ • Can tag for emulation │ │ │ ├─UEFI CA: │ │ Device ID: 5bc922b7bd1adb5b6f99592611404036bd9f42d0 │ │ Current version: 2023 │ │ Vendor: Microsoft (UEFI:Microsoft) │ │ URL: https://fwupd.github.io/libfwupdplugin/uefi-db.html │ │ GUIDs: 26f42cba-9bf6-5365-802b-e250eb757e96 ← UEFI\VENDOR_Microsoft&NAME_Microsoft-UEFI-CA │ │ 308281c7-d0c5-52e0-8c1a-810540de03df ← UEFI\CRT_7CD7437C555F89E7C2B50E21937E420C4E583E80 │ │ Device Flags: • Internal device │ │ • Updatable │ │ • Supported on remote server │ │ • Needs a reboot after installation │ │ • Signed Payload │ │ • Can tag for emulation │ │ │ └─Windows UEFI CA: │ Device ID: d31da5f926c6d962ed810b284fab5a2ef623007b │ Current version: 2023 ``` </details> ### Additional questions - **Operating system and version:** Ubuntu Core 26 - **Have you tried rebooting?** Yes, many times. - **Is this a regression?** I don't know. But it works correctly on Ubuntu Desktop 26.04 and on Ubuntu Server 26.04. ** Affects: fwupd (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161598 Title: Ubuntu Core 26: fwupdmgr and fwupd blocked by AppArmor DBus PolicyKit denials To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/fwupd/+bug/2161598/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
