I posted this query a while back but got no response.
The setup is this. Debian 9 with a LVM logical volume mounted on /var/lib/snapd. This is because the main disk in an NVME one and is of a limited size reserved for home and root.
snapd appears to install correctly save the other I pointed out with apparmor config.
Preparing to unpack .../snapd_2.27.6-2_amd64.deb ... Unpacking snapd (2.27.6-2) ... Setting up snapd (2.27.6-2) ... Created symlink /etc/systemd/system/multi-user.target.wants/snapd.autoimport.service → /lib/systemd/system/snapd.autoimport.service. Created symlink /etc/systemd/system/timers.target.wants/snapd.refresh.timer → /lib/systemd/system/snapd.refresh.timer. Created symlink /etc/systemd/system/sockets.target.wants/snapd.socket → /lib/systemd/system/snapd.socket. Created symlink /etc/systemd/system/multi-user.target.wants/snapd.service → /lib/systemd/system/snapd.service. Warning from /etc/apparmor.d/usr.lib.snapd.snap-confine.real (/etc/apparmor.d/usr.lib.snapd.snap-confine.real line 396): Unconfined exec qualifier (ux) allows some dangerous environment variables to be passed to the unconfined process; 'man 5 apparmor.d' for details.
snaps also appear to install fine no complaints.
snap install hello-world 2018-01-09T18:28:35Z INFO Waiting for restart... hello-world 6.3 from 'canonical' installed
But running the snap proves impossible.
hello-world cannot bind-mount the mount namespace file /proc/25509/ns/mnt -> hello-world.mnt: Permission denied support process for mount namespace capture exited abnormally
I initially thought it was an apparmor thing but stopping apparmor did not seem to solve the problem.
The lv is mounted with standard perms.
/dev/mapper/vg_ssd-snap on /var/lib/snapd type xfs (rw,relatime,attr2,inode64,noquota)
And the snaps seem to mount fine too.
/var/lib/snapd/snaps/core_3748.snap on /snap/core/3748 type squashfs (ro,nodev,relatime) tmpfs on /run/snapd/ns type tmpfs (rw,nosuid,noexec,relatime,size=3270688k,mode=755) /var/lib/snapd/snaps/hello-world_27.snap on /snap/hello-world/27 type squashfs (ro,nodev,relatime)
perms on /proc seems normal to me too.
dr-xr-xr-x 501 root root 0 Jan 8 20:45 proc
So what is happening?
snapd 2.27.6-2 Linux 4.14.0-2-amd64