Public bug reported:
On Ubuntu 26.04.1 LTS (upgraded from 24.04), no image can be decoded through
gdk-pixbuf/glycin
while kernel.apparmor_restrict_unprivileged_userns = 1 (the Ubuntu default).
The glycin loader
sandbox fails to start, so every image load returns NULL. This affects every
format, not just
SVG: PNG fails the same way in glycin-image-rs.
This breaks the GDM greeter completely: gnome-shell --mode=gdm fails to load
the distro logo
(/usr/share/pixmaps/ubuntu-logo-text-dark.svg, set by
10_ubuntu-settings.gschema.override),
throws "JS ERROR: Error: Argument 'child' may not be null" in _updateLogoTexture
(loginDialog.js:1005), and LoginDialog is never constructed - the login screen
shows the top
bar and nothing else. The machine is unusable without autologin.
STEPS TO REPRODUCE
1. Ubuntu 26.04.1 with default kernel.apparmor_restrict_unprivileged_userns = 1
2. Run:
python3 -c "import gi; gi.require_version('GdkPixbuf','2.0'); from
gi.repository import GdkPixbuf;
print(GdkPixbuf.Pixbuf.new_from_file('/usr/share/pixmaps/ubuntu-logo-
text-dark.svg').get_width())"
EXPECTED
Prints the image width (187). It does, as soon as the restriction is
turned off.
ACTUAL
gi.repository.GLib.GError: gdk-pixbuf-error-quark: Failed to load image
"/usr/share/pixmaps/ubuntu-logo-text-dark.svg": Loader process exited early
with status '1'
Command: "bwrap" "--unshare-all" "--die-with-parent" "--chdir" "/" "--ro-bind"
"/usr" "/usr"
"--dev" "/dev" ... "/usr/libexec/glycin-loaders/2+/glycin-svg" "--dbus-fd" "13"
The same with a PNG, through a different loader:
"... /usr/libexec/glycin-loaders/2+/glycin-image-rs" "--dbus-fd" "13"
Running a bwrap invocation by hand gives:
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
Kernel audit at the same moment:
apparmor="DENIED" operation="capable" class="cap"
profile="unprivileged_userns" comm="bwrap" capability=12 capname="net_admin"
apparmor="DENIED" operation="capable" class="cap"
profile="unprivileged_userns" comm="bwrap" capability=8 capname="setpcap"
So bwrap is confined by the generic unprivileged_userns profile instead of
transitioning into
:glycin:bwrap, which does grant "capability net_admin" and "capability setpcap".
WHAT I CHECKED
- /etc/apparmor.d/glycin.bwrap exists and is valid: apparmor_parser -Q returns 0
- the profiles ARE loaded: aa-status lists :glycin:bwrap, :glycin:loaders,
bwrap, unpriv_bwrap
- other bwrap users work: aa-status shows flatpak bwrap processes confined by
/usr/bin/bwrap
- systemctl reload apparmor does NOT help, the transition still does not happen
- the loader path matches the profile rule. /etc/apparmor.d/glycin.bwrap line
75 reads:
/usr/libexec/glycin-loaders/@{d}+/glycin-* Px -> bwrap//&loaders,
and on disk the directory is /usr/libexec/glycin-loaders/2+/
- packages are intact: libglycin-2-0, glycin-loaders, glycin-thumbnailers,
bubblewrap all "ii"
- librsvg2-common is installed and the SVG loader is present in the gdk-pixbuf
loaders cache
- not SVG-specific: PNG fails identically via glycin-image-rs
WORKAROUND
echo 'kernel.apparmor_restrict_unprivileged_userns = 0' | sudo tee
/etc/sysctl.d/99-userns-glycin.conf
With that, the python3 one-liner prints 187 and the GDM greeter renders
normally. This weakens
system-wide isolation, so it is not an acceptable long-term fix.
VERSIONS
- Ubuntu 26.04.1 LTS (resolute), kernel 7.0.0-38-generic
- libglycin-2-0 / glycin-loaders / glycin-thumbnailers: 2.1.5+ds-0ubuntu0.2
- bubblewrap: 0.11.1-1ubuntu0.3
- librsvg2-common: 2.61.3+dfsg-3ubuntu0.1
- gdm3: 50.1-0ubuntu0.1
- gnome-shell: 50.1-0ubuntu1.4
- apparmor: 212 profiles loaded, 127 in enforce mode
- GPU: NVIDIA, nvidia-driver-595-open 595.99.02-0ubuntu0.26.04.1
SIDE NOTE
The same class of denial appears for fusermount3 in the journal (dac_override,
setuid, mount),
which may or may not share a root cause.
** Affects: glycin-loaders (Ubuntu)
Importance: Undecided
Status: New
** Tags: apparmor gdm regression-release userns
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172325
Title:
glycin loaders fail when apparmor_restrict_unprivileged_userns=1:
bwrap denied net_admin by unprivileged_userns profile, no image loads
at all
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/glycin-loaders/+bug/2172325/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
