Additional context, in case it matters for triage: this system was upgraded 24.04 -> 26.04 with do-release-upgrade, and that upgrade was interrupted. It left packages in "iU" state and an initramfs built with modules from a different kernel, so the machine did not boot at all until I finished the upgrade manually with "dpkg --configure -a" from a chroot.
So the obvious question is whether AppArmor was simply left in an inconsistent state. As far as I can tell, it was not: - dpkg --audit is clean and "apt full-upgrade" reports 0 upgraded, 0 newly installed, 0 to remove - the upgrade is fully completed now - apparmor_parser -Q /etc/apparmor.d/glycin.bwrap returns 0, the profile is syntactically valid - aa-status lists :glycin:bwrap and :glycin:loaders among the loaded profiles - systemctl reload apparmor does not change the behaviour - a full reboot does not change it either - the failure is reproducible on every boot - apt install --reinstall librsvg2-common (which re-runs the gdk-pixbuf loaders trigger) does not help, and the SVG loader is present in the loaders cache - the failure is not format-specific: PNG fails the same way through glycin-image-rs The only thing that makes image loading work is setting kernel.apparmor_restrict_unprivileged_userns = 0. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172325 Title: glycin loaders fail when apparmor_restrict_unprivileged_userns=1: bwrap denied net_admin by unprivileged_userns profile, no image loads at all To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/glycin-loaders/+bug/2172325/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
