Discord ptrace AppArmor denials

Connecting discord snap to system-observe gives it permissions to hook into your processes willy-nilly with ptrace and do whatever they want with that. Including perhaps sending in-memory secrets to their servers. Not that they are doing it, but if someone finds a bug in the really sub-par electron app - that’s exactly what they will be able to do.

If you are not so keen on allowing discord to do this, but want to remove the denies from the logs permanently, you can do the following:

Copy the /var/lib/snapd/apparmor/profiles/snap.discord.discord file into the /etc/apparmor.d directory, thereby locking it in time. The future snap updates won’t revert your changes.

Add the following three lines to the new /etc/apparmor.d/snap.discord.discord before the final }.

deny /proc/@{pid}/cmdline r,
deny ptrace (read),
deny capability sys_ptrace,

The explicit deny statements instruct apparmor not to track these actions in the syslog. Then restart apparmor, so it will pick up your copy with sudo systemctl restart apparmor.service. You might to restart snapd and other stuff as well or just reboot.