Public bug reported:
## Summary
After upgrading an Ubuntu 24.04 system to Ubuntu 26.04.1, GNOME
displayed several severe graphical symptoms:
- GDM showed the background, mouse pointer and clock, but no usable login UI.
- Many GNOME icons were black or incorrectly rendered.
- GNOME Shell logged failures while loading SVG resources.
- GdkPixbuf/Glycin failed to load SVG files because the Glycin sandbox could
not start correctly.
The root cause was an old locally-created AppArmor profile:
/etc/apparmor.d/local-bwrap
which was still present after the upgrade and also attached to:
/usr/bin/bwrap
Ubuntu 26.04 now provides its own official profile:
/etc/apparmor.d/bwrap-userns-restrict
which also attaches to `/usr/bin/bwrap`.
Having both profiles present caused AppArmor "conflicting profile
attachments" messages and prevented Bubblewrap from operating correctly.
Removing the obsolete local profile fixed Bubblewrap, Glycin SVG
loading, GNOME icons and GDM.
## System
Upgraded from:
Ubuntu 24.04 LTS
to:
Ubuntu 26.04.1 LTS
Relevant packages:
apparmor 5.0.2-0ubuntu1~26.04.1
bubblewrap 0.11.1-1ubuntu0.3
glycin-loaders 2.1.5+ds-0ubuntu0.2
gnome-shell 50.1-0ubuntu1.3
gnome-shell-common 50.1-0ubuntu1.3
gdm3 50.1-0ubuntu0.1
## Symptoms after upgrade
GDM started but did not display the normal login controls.
GNOME Shell also reported errors while loading SVG resources, for
example:
Could not load a pixbuf from
/org/gnome/shell/icons/scalable/actions/accessibility-large-text-symbolic.svg
Several GNOME icons were rendered black or incorrectly.
Autologin allowed the GNOME session to start, but the icon rendering
problem remained.
## Glycin / GdkPixbuf failure
The following test failed:
python3 - <<'PY'
import gi
gi.require_version("GdkPixbuf", "2.0")
gi.require_version("Gio", "2.0")
from gi.repository import Gio, GdkPixbuf
bundle = "/usr/share/gnome-shell/gnome-shell-icons.gresource"
resource = Gio.Resource.load(bundle)
Gio.resources_register(resource)
name = "/org/gnome/shell/icons/scalable/actions/accessibility-large-
text-symbolic.svg"
pix = GdkPixbuf.Pixbuf.new_from_resource(name)
print(pix.get_width(), pix.get_height())
PY
It failed with:
Loader process exited early with status '1'
The command shown in the exception was using Bubblewrap to start:
/usr/libexec/glycin-loaders/2+/glycin-svg
## Bubblewrap failure
A simple Bubblewrap test also failed:
bwrap --unshare-all \
--ro-bind /usr /usr \
--proc /proc \
--dev /dev \
/usr/bin/true
with:
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
## AppArmor logs
The kernel log repeatedly showed:
apparmor="AUDIT"
operation="exec"
info="conflicting profile attachments"
profile="unconfined"
name="/usr/bin/bwrap"
followed by:
apparmor="DENIED"
operation="capable"
profile="unprivileged_userns"
capname="setpcap"
and:
apparmor="DENIED"
operation="capable"
profile="unprivileged_userns"
capname="net_admin"
## Conflicting profiles
The system contained both:
/etc/apparmor.d/bwrap-userns-restrict
and:
/etc/apparmor.d/local-bwrap
`local-bwrap` contained:
abi <abi/4.0>,
include <tunables/global>
profile local-bwrap /usr/bin/bwrap flags=(unconfined) {
userns,
include if exists <local/bwrap>
}
This file did not belong to any installed package:
$ dpkg -S /etc/apparmor.d/local-bwrap
dpkg-query: no path found matching pattern /etc/apparmor.d/local-
bwrap
The Ubuntu-provided profile contained another attachment to
`/usr/bin/bwrap`:
profile bwrap /usr/bin/bwrap ...
Both profiles were loaded:
bwrap
local-bwrap
unpriv_bwrap
## Workaround / fix
The old local profile was backed up and removed:
sudo apparmor_parser -R /etc/apparmor.d/local-bwrap
sudo mv /etc/apparmor.d/local-bwrap \
/root/apparmor-backup/local-bwrap.disabled
sudo systemctl reload apparmor
After this:
apparmor_status
showed:
:glycin:bwrap
bwrap
unpriv_bwrap
but no longer:
local-bwrap
The previous Bubblewrap `RTM_NEWADDR: Operation not permitted`
failure disappeared.
Most importantly, the same GdkPixbuf/Glycin SVG test that previously
failed then succeeded:
SUCCESS
size: 16 x 16
alpha: True
After this change:
- GNOME icons rendered correctly again.
- GDM displayed correctly again.
- The SVG loading failures disappeared.
## Expected behaviour
When upgrading to Ubuntu 26.04, the presence of an existing locally-created
AppArmor profile attached to `/usr/bin/bwrap` should not silently result in
a conflicting profile configuration that breaks Bubblewrap and applications
depending on Glycin.
Ideally the upgrade should:
- detect conflicting AppArmor profiles attached to `/usr/bin/bwrap`, or
- warn the administrator clearly during the upgrade, or
- avoid loading both profiles simultaneously, if possible.
This is particularly serious because the resulting failure can make the
default GDM login screen unusable.
## Additional note
The `local-bwrap` profile was presumably created on an older Ubuntu release
as a workaround for the AppArmor unprivileged user namespace restrictions.
Ubuntu 26.04 now ships its own `bwrap-userns-restrict` profile, making such
older local workarounds conflict with the distribution-provided policy.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: apparmor 5.0.2-0ubuntu1~26.04.1
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
NonfreeKernelModules: zfs
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Thu Oct 1 20:29:54 2026
InstallationDate: Installed on 2026-02-14 (229 days ago)
InstallationMedia: Ubuntu 24.04.4 LTS "Noble Numbat" - Release amd64 (20260210)
ProcEnviron:
LANG=fr_FR.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcKernelCmdline: BOOT_IMAGE=/vmlinuz-7.0.0-38-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: apparmor
UpgradeStatus: Upgraded to resolute on 2026-10-01 (0 days ago)
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169201
Title:
Upgrade to Ubuntu 26.04 leaves local-bwrap AppArmor profile
conflicting with bwrap-userns-restrict, breaking glycin SVG loading
and GDM
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2169201/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
