How to connect to localhost MongoDB in Snap? AppArmor prevents

xet7 · October 10, 2018, 6:22pm

Hi,
I have this snapcraft.yaml using MongoDB 4.0.3:
https://github.com/wekan/wekan/blob/edge/snapcraft.yaml

It’s Wekan https://wekan.github.io using meteor-1.8.1-beta.0 with Node 8.12.0.

By default MongoDB is listening 127.0.0.1:27019
https://github.com/wekan/wekan/blob/edge/snap-src/bin/config

But it seems AppArmor denies Node connecting to MongoDB:

loka 10 21:04:03 user kernel: audit: type=1400 audit(1539194642.995:2287): apparmor="DENIED" operation="open" profile="snap.wekan.mongodb" name="/proc/15195/net/netstat" pid=15195 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
loka 10 21:04:03 user kernel: audit: type=1400 audit(1539194642.999:2288): apparmor="DENIED" operation="open" profile="snap.wekan.mongodb" name="/proc/15195/net/snmp" pid=15195 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
loka 10 21:04:03 user audit[15195]: AVC apparmor="DENIED" operation="open" profile="snap.wekan.mongodb" name="/proc/15195/net/netstat" pid=15195 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
loka 10 21:04:03 user audit[15195]: AVC apparmor="DENIED" operation="open" profile="snap.wekan.mongodb" name="/proc/15195/net/snmp" pid=15195 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
loka 10 21:04:04 user kernel: audit: type=1400 audit(1539194643.999:2289): apparmor="DENIED" operation="open" profile="snap.wekan.mongodb" name="/proc/15195/net/netstat" pid=15195 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
loka 10 21:04:04 user kernel: audit: type=1400 audit(1539194643.999:2290): apparmor="DENIED" operation="open" profile="snap.wekan.mongodb" name="/proc/15195/net/snmp" pid=15195 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

How I can make Node connect to MongoDB correctly? Do I need to add some permission to snap?

xet7 · October 10, 2018, 7:54pm

It seems that I can connect to mongo this way:

 sudo mongo mongodb://%2Fvar%2Fsnap%2Fwekan%2Fx1%2Fshare%2Fmongodb-27017.sock

And this could be correct unix socket setting:

sudo snap set wekan mongodb-bind-unix-socket='share'

I’m still trying to figure out how to get it to work, for example with unix socket.

jdstrand · October 13, 2018, 9:10pm

FYI, the apparmor denials can be solved in wekan.mongodb by connecting the ‘network-observe’ interface.

xet7 · October 17, 2018, 12:54pm

@jdstrand

How? What should I add to snapcraft.yaml or snap directories?
https://github.com/wekan/wekan/tree/edge

ryanjyoder · October 18, 2018, 1:25am

I wonder if those denials are a red herring. If you set the socket to a relative directory, I doubt it will work properly. Here on line 10, the mongodb url is being created, but on line 22, it cd’s to a new directory before starting the application. Try setting the absolute path. Or try using the socket file name mongodb-27017.sock and line 12 will create a full absolute path.

github.com

wekan/wekan/blob/ced56ed83ff6475f101146b4bbeaa7bfabd0d08d/snap-src/bin/wekan-control#L10


#!/bin/bash
# get wekan/mongo settings
source $SNAP/bin/wekan-read-settings
export NODE_PATH=$SNAP/bin
# if possible we prefer to bind over unix socket
if [ "nill" != "$MONGODB_BIND_UNIX_SOCKET" ] && [ "x" != "x$MONGODB_BIND_UNIX_SOCKET" ]; then
    if [ -d $MONGODB_BIND_UNIX_SOCKET ]; then
        export MONGO_URL="mongodb://$MONGODB_BIND_UNIX_SOCKET/mongodb-${MONGODB_PORT}.sock/wekan"
    else
        export MONGO_URL="mongodb://$SNAP_DATA/shared/$MONGODB_BIND_UNIX_SOCKET/wekan"
    fi
else
    [ "x" == "x$MONGODB_BIND_IP" ] && MONGODB_BIND_IP="127.0.0.1"
    export MONGO_URL="mongodb://$MONGODB_BIND_IP:$MONGODB_PORT/wekan"
fi
echo -e "MONGO_URL=$MONGO_URL"
APPLICATION_DIRECTORY=$SNAP

But I coudl be wrong… that’s just a first glance.

xet7 · October 22, 2018, 1:42pm

I tried those tips and did not get Wekan connecting to MongoDB correctly in Snap.

So currently only Source and Docker version works.

ryanjyoder · October 22, 2018, 2:32pm

I was able to it running with this config:

sudo snap set wekan mongodb-bind-unix-socket='/var/snap/wekan/current/share/'

At least it appears to be running. I got a log in page, and could register and login.

xet7 · October 23, 2018, 11:45am

@ryanjyoder

Thanks! Because it seems that I get with that only Meteor 1.6.0.1 and MongoDB 3.2.21 working, I’ll continue with it, until some day I get Meteor 1.8.x and MongoDB 4.0.3 working in Snap.