*** This bug is a security vulnerability ***
Private security bug reported:
On Ubuntu 26.04 (Resolute), clicking HTTPS links in Papers fails
when Firefox is installed as a Snap.
Environment:
- Ubuntu 26.04
- Papers 50.2-0ubuntu0.1
- AppArmor 5.0.2-0ubuntu1~26.04.1
- Snap 2.77.1
- Firefox installed as a Snap
Steps to reproduce:
1. Set Firefox Snap as the default browser.
2. Open a PDF in Papers.
3. Click an HTTPS hyperlink.
Expected result:
Firefox opens the URL.
Actual result:
Papers reports "panic: permission denied".
The kernel log reports an AppArmor denial for execution of:
/snap/snapd/28254/usr/lib/snapd/snapd
The denial occurs under the profile:
/usr/bin/papers//snap_browsers
Workaround:
In /etc/apparmor.d/abstractions/snap_browsers, I changed the
permission rule for /usr/lib/snapd/snapd from "r," to "ixr,".
After reloading the Papers AppArmor profile, opening links worked.
Please investigate whether the snap_browsers abstraction needs
an updated execution permission for snapd.
ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: apparmor 5.0.2-0ubuntu1~26.04.1
ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14
Uname: Linux 7.0.0-38-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Wed Oct 14 12:35:02 2026
InstallationDate: Installed on 2026-06-02 (134 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
ProcEnviron:
LANG=es_ES.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic
root=UUID=f8bc8def-fff9-4943-acc6-42652923d50e ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: apparmor
UpgradeStatus: No upgrade log present (probably fresh install)
mtime.conffile..etc.apparmor.d.abstractions.snap_browsers:
2026-10-14T12:19:22.816017
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug resolute wayland-session
** Information type changed from Public to Private Security
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170808
Title:
AppArmor denies snapd execution when opening HTTPS links from Papers
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2170808/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
