AppArmor policy blocks org.freedesktop.ReserveDevice1 D-Bus access

snapcraft
1

Hi Snapcraft team,

I’m trying to make my app work with the ALSA device reservation system via rd_acquire(). The goal is to reserve the ALSA device used by the system, using D-Bus through the org.freedesktop.ReserveDevice1.Audio* name.

However, I keep running into this error at runtime:

An AppArmor policy prevents this sender from sending this message to this recipient; type=“method_call”, sender=“:1.646” (uid=1002 pid=311737 comm=“/snap/myapp” label=“snap.myapp (enforce)”) interface=“org.freedesktop.ReserveDevice1” member=“RequestRelease” destination=“org.freedesktop.ReserveDevice1.Audio1”

  • I added the following to the plugs section:
  alsa-device-reservation-plug:
    interface: dbus
    bus: session
    name: org.freedesktop.ReserveDevice1.Audio1
  • I also tried defining a slot:
  alsa-device-reservation-slot:
    interface: dbus
    bus: session
    name: org.freedesktop.ReserveDevice1.Audio1
  • if I don’t define the slot I get this error at runtime:

Connection “:1.644” is not allowed to own the service “org.freedesktop.ReserveDevice1.Audio1” due to AppArmor policy

  • These are the plugs declared in the manifest:

plugs: [home, audio-plugins-user, removable-media, network-bind, network, alsa, browser-support, audio-record, audio-playback, alsa-device-reservation-plug]

How can I get my snap to work with rd_acquire() and communicate over org.freedesktop.ReserveDevice1.Audio* without triggering AppArmor blocks?

Also, Is there a wildcard or pattern I can specify in my snap manifest to allow owning multiple names like org.freedesktop.ReserveDevice1.Audio*? This would help supporting multiple audio devices dynamically.

Thanks a lot in advance!

2

Can you run snappy-debug alongside your app ? It will actually try to make suggestions for plugs needed based on the denials, perhaps that gives you some more hints …

3

I did it but I got this message without any suggestion:

= AppArmor = Time: 2025-06-18T15:0 Log: apparmor=“DENIED” operation=“dbus_method_call” bus=“session” path=“/org/freedesktop/ReserveDevice1/Audio1” interface=“org.freedesktop.ReserveDevice1” member=“RequestRelease” mask=“send” name=“org.freedesktop.ReserveDevice1.Audio1” pid=14339 label=“snap.n-trackstudio.n-trackstudio” peer_pid=4052 peer_label=“unconfined” DBus access

4

Just following up in case this got buried. Would really appreciate any input!