DBus : cannot access Instrospect member from org.freedesktop.DBus.Introspectable interface

Hello,

I’m trying to snap pogo, the music player.

When I run my snap, I get this error message :

ERROR Introspect error on :1.76:/org/gnome/SettingsDaemon/MediaKeys: dbus.exceptions.DBusException: org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type=“method_call”, sender=":1.648" (uid=1000 pid=72425 comm="/snap/pogo/x9/usr/bin/python3 /snap/pogo/x9/pogo.p" label=“snap.pogo.pogo (enforce)”) interface=“org.freedesktop.DBus.Introspectable” member=“Introspect” error name="(unset)" requested_reply=“0” destination=":1.76" (uid=1000 pid=7376 comm="/usr/libexec/gsd-media-keys " label=“unconfined”)

I thought adding the system-observe interface would be the solution, but that didn’t change anything.

Here’s the complete snapcraft.yaml

I am a bit lost with that DBus thing, there’s not a lot of documentation about that.

Any bit of help will be appreciated ! Thanks.

What apparmor denial do you see journalctl --no-pager | grep DENIED | grep pogo

Hi ! Sorry it took that long !

Here’s what I get from journalctl :

sep 08 01:16:52 heimdall dbus-daemon[6299]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/org/freedesktop/DBus" member="ListNames" mask="send" name="org.freedesktop.DBus" pid=642967 label="snap.pogo.pogo" peer_label="unconfined"
sep 08 01:16:53 heimdall dbus-daemon[6299]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/org/gnome/SettingsDaemon/MediaKeys" interface="org.freedesktop.DBus.Introspectable" member="Introspect" mask="send" name=":1.77" pid=642967 label="snap.pogo.pogo" peer_pid=8304 peer_label="unconfined"
sep 08 01:16:53 heimdall dbus-daemon[6299]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/org/gnome/SettingsDaemon" interface="org.freedesktop.DBus.Introspectable" member="Introspect" mask="send" name=":1.77" pid=642967 label="snap.pogo.pogo" peer_pid=8304 peer_label="unconfined"
sep 08 01:16:53 heimdall dbus-daemon[6299]: apparmor="DENIED" operation="dbus_method_call"  bus="session" path="/org/gnome/SettingsDaemon" interface="org.gnome.SettingsDaemon" member="GrabMediaPlayerKeys" mask="send" name=":1.77" pid=642967 label="snap.pogo.pogo" peer_pid=8304 peer_label="unconfined"

While the desktop interface does grant access to the MediaKeys interface on gnome-settings-daemon, it doesn’t grant org.freedesktop.DBus.Introspectable. It sounds like pogo is depending on runtime introspection to generate the Python API to the service, so doesn’t ever try to call the actual MediaKeys API (which would be allowed).

It seems like it would be a good idea to add this to the desktop interface in snapd. I’m not sure how easy it’d be to avoid this from the snap end if you continue using the old dbus-python bindings.

I guess I can always try and patch the source code, then send a PR upstream.

I does not prevent the snap from working, it’s just output some ugly logs :slight_smile:, and of course the media keys won’t work.

Thanks for your help !

Having a quick look, it might be enough to do the following in pogo/modules/GnomeMediaKeys.py:

  • Add introspect=False as a keyword argument to the get_object calls.
  • Add a signature keyword argument to the D-Bus method calls. For GrabMediaPlayerKeys, it should be "su", and for ReleaseMediaPlayerKeys use "s".

I think that would be enough to get by without introspection.

Oh wow !! Thanks ! I’ll try that as soon as possible !