Public bug reported:
Classic snaps that use the chromium content api create a lot of log spam
due to bug #1849753. Eg:
Oct 29 16:37:45 utumno audit[3275]: AVC apparmor="DENIED"
operation="file_inherit" profile="/snap/core/7917/usr/lib/snapd/snap-confine"
pid=3275 comm="snap-confine" family="unix" sock_type="stream" protocol=0
requested_mask="send receive" denied_mask="send receive" addr=none
peer_addr=none
Oct 29 16:37:45 utumno audit[3275]: AVC apparmor="DENIED"
operation="file_inherit" profile="/snap/core/7917/usr/lib/snapd/snap-confine"
name="/dev/shm/.org.chromium.Chromium.6xtos6" pid=3275 comm="snap-confine"
requested_mask="wr" denied_mask="wr" fsuid=1000 ouid=1000
On a system with vscode and slack, there are thousands of these per day:
$ grep file_inherit ./audit.log |grep -E '(family="unix" .* addr=none
peer_addr=none|/dev/shm/\.org\.chromium\.Chromium)'|wc -l
101912
(and the day isn't over yet).
I suggest for now we explicitly deny the noisiest denials until bug
#1849753 is fixed. The number of log entries is way too high to do
anything else IMO. These are the rules I am looking at:
# Explicitly deny noisy file_inherit denials until LP: #1849753
# is fixed.
deny unix,
deny /dev/shm/.org.chromium.Chromium.* rw,
There is no chance of regression for this since snap-confine is already
denying them. We could consider making these allowed rather than
explicit deny, but people haven't been complaining about these classic
chromium content api snaps not working, so I'd like to continue denying
for now.
** Affects: snapd
Importance: Medium
Assignee: Jamie Strandboge (jdstrand)
Status: In Progress
** Package changed: snapd (Ubuntu) => snapd
** Changed in: snapd
Status: New => In Progress
** Changed in: snapd
Assignee: (unassigned) => Jamie Strandboge (jdstrand)
** Changed in: snapd
Importance: Undecided => Medium
** Summary changed:
- logs spam with file_inherit denials from classic snaps
+ logs spammed with file_inherit denials from classic snaps
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1850552
Title:
logs spammed with file_inherit denials from classic snaps
To manage notifications about this bug go to:
https://bugs.launchpad.net/snapd/+bug/1850552/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
