Drawio snap runs only once after installation, with many apparmor messages

After installing the drawio snap on Ubuntu 22.10, the first command line invocation takes ~2 seconds and kinda works and exits with status 0, but subsequent identical invocations quickly exit status 1 and apparently do nothing. Apparmor emits numerous DENIED messages.

(⋮ indicates an edit to remove text)

$ cat /etc/issue
Ubuntu 22.10 \n \l

$ sudo snap remove drawio
drawio removed

$ sudo snap install drawio
drawio 21.1.2 from draw.io (jgraph✓) installed

$ drawio --help

(drawio:305092): Gtk-WARNING **: 08:46:36.687: Theme parsing error: gtk.css:1422:23: 'font-feature-settings' is not a valid property name
⋮
Options:
  -V, --version                                 output the version number
⋮
  -h, --help                                    display help for command

$ echo $?
0

$ drawio --help
[nothing displayed]

$ echo $?
1

$ sudo snap remove drawio
drawio removed

$ sudo snap install drawio
drawio 21.1.2 from draw.io (jgraph✓) installed

$ drawio -v -x -fsvg docs/images/components.drawio 

(drawio:307756): Gtk-WARNING **: 08:55:44.681: Theme parsing error: gtk.css:1422:23: 'font-feature-settings' is not a valid property name

(drawio:307756): Gtk-WARNING **: 08:55:44.683: Theme parsing error: gtk.css:3308:25: 'font-feature-settings' is not a valid property name

(drawio:307756): Gtk-WARNING **: 08:55:44.684: Theme parsing error: gtk.css:3770:23: 'font-feature-settings' is not a valid property name
WARNING: Kernel has no file descriptor comparison support: Operation not permitted
Error: input file/directory not found

$ drawio -v -x -fsvg docs/images/components.drawio 
[nothing displayed]

$ 

In another window, I captured the following (dmesg -wT) after the first drawio --help:

[Thu Apr 13 05:40:50 2023] kauditd_printk_skb: 19 callbacks suppressed
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.838:32458): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/4c599c202bc5c08e2d34565a40eac3b2-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.838:32459): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/3830d5c3ddfd5cd38a049b759396e72e-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.842:32460): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/c855463f699352c367813e37f3f70ea7-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.842:32461): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/32b6488e5b8292a2e95c79d947e009e8-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.850:32462): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/57e423e26b20ab21d0f2f29c145174c3-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.854:32463): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/573ec803664ed168555e0e8b6d0f0c7f-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.854:32464): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/7ef2298fde41cc6eeb7af42e48b7d293-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.854:32465): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/d82eb4fd963d448e2fcb7d7b793b5df3-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.866:32466): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/e13b20fdb08344e0e664864cc2ede53d-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
[Thu Apr 13 05:40:50 2023] audit: type=1400 audit(1681046164.922:32467): apparmor="DENIED" operation="open" class="file" profile="snap.drawio.drawio" name="/home/reece/.cache/fontconfig/707971e003b4ae6c8121c3a920e507f5-le64.cache-7" pid=315701 comm="drawio" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000

And after the second drawio --help (that doesn’t display anything):

[Thu Apr 13 05:41:19 2023] kauditd_printk_skb: 60 callbacks suppressed
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32528): apparmor="DENIED" operation="file_inherit" class="net" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" pid=316036 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32529): apparmor="DENIED" operation="file_inherit" class="net" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" pid=316036 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32530): apparmor="DENIED" operation="file_inherit" class="net" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" pid=316036 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32531): apparmor="DENIED" operation="file_inherit" class="file" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" name="/home/reece/.config/Code/logs/20230408T210541/window1/exthost/exthost.log" pid=316036 comm="snap-confine" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32532): apparmor="DENIED" operation="file_inherit" class="file" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" name="/home/reece/.config/Code/logs/20230408T210541/window1/exthost/extensionTelemetry.log" pid=316036 comm="snap-confine" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32533): apparmor="DENIED" operation="file_inherit" class="file" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" name="/home/reece/.config/Code/logs/20230408T210541/window1/exthost/output_logging_20230408T210542/1-markdownlint.log" pid=316036 comm="snap-confine" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32534): apparmor="DENIED" operation="file_inherit" class="file" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" name=2F686F6D652F72656563652F2E636F6E6669672F436F64652F6C6F67732F3230323330343038543231303534312F77696E646F77312F657874686F73742F6F75747075745F6C6F6767696E675F3230323330343038543231303534322F322D59414D4C20537570706F72742E6C6F67 pid=316036 comm="snap-confine" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32535): apparmor="DENIED" operation="file_inherit" class="file" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" name=2F686F6D652F72656563652F2E636F6E6669672F436F64652F6C6F67732F3230323330343038543231303534312F77696E646F77312F657874686F73742F7673636F64652E6769746875622D61757468656E7469636174696F6E2F4769744875622041757468656E7469636174696F6E2E6C6F67 pid=316036 comm="snap-confine" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32536): apparmor="DENIED" operation="file_inherit" class="file" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" name="/home/reece/.config/Code/logs/20230408T210541/window1/exthost/output_logging_20230408T210542/4-Python.log" pid=316036 comm="snap-confine" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000
[Thu Apr 13 05:41:19 2023] audit: type=1400 audit(1681046194.013:32537): apparmor="DENIED" operation="file_inherit" class="file" profile="/snap/snapd/18596/usr/lib/snapd/snap-confine" name=2F686F6D652F72656563652F2E636F6E6669672F436F64652F6C6F67732F3230323330343038543231303534312F77696E646F77312F657874686F73742F6F75747075745F6C6F6767696E675F3230323330343038543231303534322F362D4D616B6566696C6520746F6F6C732E6C6F67 pid=316036 comm="snap-confine" requested_mask="a" denied_mask="a" fsuid=1000 ouid=1000