Access to timedatectl inside a snap with core24

jenny.murphy · May 15, 2025, 12:16pm

We have a snap which we mabve migrated from core18 to core24. The access to timedatecl is now denied. It used to work (see this issue which was part of the initial effort to get it working with a core18 based snap Managing time, date and timezone in Ubuntu Core).

Now with core 24 when I open a shell inside the snap I get the following error:

$ snap run --shell epi-edge.main
$ timedatectl
Failed to connect to bus: Permission denied

Also from the journal at the same time.

May 15 11:58:42 episensor-e45f01b79b67 audit[529003]: AVC apparmor="DENIED" operation="bind" profile="snap.epi-edge.main" pid=529003 comm="timedatectl.rea" family="unix" sock_type="stream" protocol=0 requested_mask="bind" denied_mask="bind" addr="@f2c62d8594021f15/bus/timedatectl.rea/system"
May 15 11:58:42 episensor-e45f01b79b67 kernel: audit: type=1400 audit(1747310322.053:78910): apparmor="DENIED" operation="bind" profile="snap.epi-edge.main" pid=529003 comm="timedatectl.rea" family="unix" sock_type="stream" protocol=0 requested_mask="bind" denied_mask="bind" addr="@f2c62d8594021f15/bus/timedatectl.rea/system"

The same interfaces are connected as previously.

ogra · May 15, 2025, 2:33pm

Hmm, this is clearly weird, the interface has not changed since the last discussion:

github.com

canonical/snapd/blob/master/interfaces/builtin/time_control.go#L75


      
              bus=system
              path=/org/freedesktop/timedate1
              interface=org.freedesktop.DBus.Properties
              member=PropertiesChanged
              peer=(label=unconfined),
          
          # As the core snap ships the timedatectl utility we can also allow
          # clients to use it now that they have access to the relevant
          # D-Bus methods for setting the time via timedatectl's set-time and
          # set-local-rtc commands.
          /usr/bin/timedatectl{,.real} ixr,
          
          # Silence this noisy denial. systemd utilities look at /proc/1/environ to see
          # if running in a container, but they will fallback gracefully. No other
          # interfaces allow this denial, so no problems with silencing it for now. Note
          # that allowing this triggers a 'ptrace trace peer=unconfined' denial, which we
          # want to avoid.
          deny @{PROC}/1/environ r,
          
          # Allow write access to system real-time clock
          # See 'man 4 rtc' for details.

brendan.carroll · May 16, 2025, 8:31am

Hi Ogra, thanks for jumping on this. Have you managed to confirm the difference in timedatectl handling between core18 and core24? Would appreciate some direction as this is the last thing preventing release of our app on core24.

brendan.carroll · May 20, 2025, 10:36am

@ogra - if you’re away, is there anyone else in Canonical who could assist? Thanks!

ogra · May 20, 2025, 11:16am

You should always be able to use the support portal and the support team might be able to help …

gairepravesh · May 21, 2025, 10:58am

Adding comment here too for public. This issue has been already addressed by PR.