Permission denied when executing df command

guyluz11 · March 26, 2021, 2:25am

My snap was working long time and suddenly it started to crash in all the devices.

Logs show that when trying to execute the command
df -h /
inside the snap I am getting

Permission denied

Does snapd got update lately to its Interface default permissions?.
If so what Interface should I add in order to make it work again.

(The next command is /sbin/blkid so it may also arrive from here).

ijohnson · March 26, 2021, 8:01pm

Can you share system denials when this happens?

journalctl --no-pager | grep DENIED
snap version

guyluz11 · March 27, 2021, 1:48am

userName@nanopiduo2:~$ journalctl --no-pager | grep DENIED
Mar 25 15:26:21 nanopiduo2 kernel: audit: type=1400 audit(1616685981.519:112576): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:21 nanopiduo2 kernel: audit: type=1400 audit(1616685981.519:112577): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:21 nanopiduo2 kernel: audit: type=1400 audit(1616685981.523:112578): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:21 nanopiduo2 kernel: audit: type=1400 audit(1616685981.523:112579): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:21 nanopiduo2 audit[13392]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:21 nanopiduo2 audit[13392]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:21 nanopiduo2 audit[13392]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:21 nanopiduo2 audit[13392]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13392 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:24 nanopiduo2 audit[13433]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13433 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:24 nanopiduo2 audit[13433]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13433 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:24 nanopiduo2 audit[13433]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13433 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:24 nanopiduo2 audit[13433]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13433 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 audit[13502]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 audit[13502]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 audit[13502]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 audit[13502]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 kernel: audit: type=1400 audit(1616685986.143:112584): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 kernel: audit: type=1400 audit(1616685986.143:112585): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 kernel: audit: type=1400 audit(1616685986.143:112586): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:26 nanopiduo2 kernel: audit: type=1400 audit(1616685986.143:112587): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13502 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 audit[13534]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 kernel: audit: type=1400 audit(1616685987.891:112588): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 kernel: audit: type=1400 audit(1616685987.891:112589): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 kernel: audit: type=1400 audit(1616685987.891:112590): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 kernel: audit: type=1400 audit(1616685987.891:112591): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 audit[13534]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 audit[13534]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:27 nanopiduo2 audit[13534]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13534 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:28 nanopiduo2 audit[13567]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13567 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:28 nanopiduo2 audit[13567]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13567 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:28 nanopiduo2 audit[13567]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13567 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:28 nanopiduo2 audit[13567]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13567 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:28 nanopiduo2 kernel: audit: type=1400 audit(1616685988.407:112592): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13567 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:28 nanopiduo2 kernel: audit: type=1400 audit(1616685988.407:112593): apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13567 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:29 nanopiduo2 audit[13598]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13598 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:29 nanopiduo2 audit[13598]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13598 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:29 nanopiduo2 audit[13598]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13598 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:29 nanopiduo2 audit[13598]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13598 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13629]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13629 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13629]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13629 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13629]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13629 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13629]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13629 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13661]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13661 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13661]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13661 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13661]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13661 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 15:26:30 nanopiduo2 audit[13661]: AVC apparmor="DENIED" operation="exec" profile="snap.security-bear.security-bear" name="/usr/bin/ip" pid=13661 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:56 nanopiduo2 audit[14439]: AVC apparmor="DENIED" operation="open" profile="snap.cybear-jinni.cybear-jinni" name="/etc/sys_info" pid=14439 comm="turnOffWiringPi" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Mar 25 18:12:56 nanopiduo2 kernel: audit: type=1400 audit(1616695976.679:112608): apparmor="DENIED" operation="open" profile="snap.cybear-jinni.cybear-jinni" name="/etc/sys_info" pid=14439 comm="turnOffWiringPi" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Mar 25 18:12:57 nanopiduo2 audit[14473]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14473 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:57 nanopiduo2 audit[14473]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14473 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:57 nanopiduo2 kernel: audit: type=1400 audit(1616695977.834:112609): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14473 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:57 nanopiduo2 kernel: audit: type=1400 audit(1616695977.834:112610): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14473 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 audit[14504]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14504 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 audit[14504]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14504 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 kernel: audit: type=1400 audit(1616695978.430:112611): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14504 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 kernel: audit: type=1400 audit(1616695978.430:112612): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14504 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 audit[14536]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14536 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 audit[14536]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14536 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 kernel: audit: type=1400 audit(1616695978.890:112613): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14536 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:58 nanopiduo2 kernel: audit: type=1400 audit(1616695978.890:112614): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14536 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:59 nanopiduo2 audit[14569]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14569 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:59 nanopiduo2 audit[14569]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14569 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:59 nanopiduo2 kernel: audit: type=1400 audit(1616695979.442:112615): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14569 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:59 nanopiduo2 kernel: audit: type=1400 audit(1616695979.442:112616): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14569 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:59 nanopiduo2 audit[14600]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14600 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:59 nanopiduo2 kernel: audit: type=1400 audit(1616695979.886:112617): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14600 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 25 18:12:59 nanopiduo2 audit[14600]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=14600 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:23:58 nanopiduo2 audit[18165]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18165 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:23:58 nanopiduo2 audit[18165]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18165 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:23:58 nanopiduo2 kernel: audit: type=1400 audit(1616768638.417:112627): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18165 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:23:58 nanopiduo2 kernel: audit: type=1400 audit(1616768638.417:112628): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18165 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:00 nanopiduo2 audit[18218]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18218 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:00 nanopiduo2 audit[18218]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18218 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:00 nanopiduo2 kernel: audit: type=1400 audit(1616768640.477:112629): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18218 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:00 nanopiduo2 kernel: audit: type=1400 audit(1616768640.477:112630): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18218 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 audit[18250]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18250 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 audit[18250]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18250 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 kernel: audit: type=1400 audit(1616768642.208:112631): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18250 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 kernel: audit: type=1400 audit(1616768642.208:112632): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18250 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 audit[18281]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18281 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 audit[18281]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18281 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 kernel: audit: type=1400 audit(1616768642.948:112633): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18281 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:02 nanopiduo2 kernel: audit: type=1400 audit(1616768642.948:112634): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18281 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:03 nanopiduo2 audit[18313]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18313 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:03 nanopiduo2 audit[18313]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18313 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:03 nanopiduo2 kernel: audit: type=1400 audit(1616768643.676:112635): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18313 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:03 nanopiduo2 kernel: audit: type=1400 audit(1616768643.676:112636): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18313 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:04 nanopiduo2 audit[18345]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18345 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:04 nanopiduo2 audit[18345]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18345 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:04 nanopiduo2 kernel: audit: type=1400 audit(1616768644.152:112637): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18345 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:04 nanopiduo2 kernel: audit: type=1400 audit(1616768644.152:112638): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18345 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:14 nanopiduo2 audit[18428]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18428 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:14 nanopiduo2 audit[18428]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18428 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:14 nanopiduo2 kernel: audit: type=1400 audit(1616768654.700:112639): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18428 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:14 nanopiduo2 kernel: audit: type=1400 audit(1616768654.700:112640): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18428 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 audit[18459]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18459 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 kernel: audit: type=1400 audit(1616768655.412:112641): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18459 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 kernel: audit: type=1400 audit(1616768655.412:112642): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18459 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 audit[18459]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18459 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 audit[18490]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18490 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 audit[18490]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18490 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 kernel: audit: type=1400 audit(1616768655.908:112643): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18490 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:15 nanopiduo2 kernel: audit: type=1400 audit(1616768655.908:112644): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18490 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 audit[18521]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18521 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 audit[18521]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18521 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 kernel: audit: type=1400 audit(1616768656.400:112645): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18521 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 kernel: audit: type=1400 audit(1616768656.400:112646): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18521 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 audit[18553]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18553 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 audit[18553]: AVC apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18553 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 kernel: audit: type=1400 audit(1616768656.928:112647): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18553 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Mar 26 14:24:16 nanopiduo2 kernel: audit: type=1400 audit(1616768656.928:112648): apparmor="DENIED" operation="exec" profile="snap.cybear-jinni.cybear-jinni" name="/usr/bin/df" pid=18553 comm="DartWorker" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
userName@nanopiduo2:~$ snap version
snap    2.49.1
snapd   2.49.1
series  16
ubuntu  20.04
kernel  5.8.16-sunxi

I was talking about the snap cybear-jinni, but as I took a look at this journal I found that my second snap security-bear received a similar error too.

userName@nanopiduo2:~$ sudo snap logs security-bear 
2021-03-25T15:26:30Z security-bear.security-bear[13632]: Unhandled exception:
2021-03-25T15:26:30Z security-bear.security-bear[13632]: ProcessException: Permission denied
2021-03-25T15:26:30Z security-bear.security-bear[13632]:   Command: ip route
2021-03-25T15:26:30Z systemd[1]: snap.security-bear.security-bear.service: Main process exited, code=exited, status=255/EXCEPTION
2021-03-25T15:26:30Z systemd[1]: snap.security-bear.security-bear.service: Failed with result 'exit-code'.
2021-03-25T15:26:31Z systemd[1]: snap.security-bear.security-bear.service: Scheduled restart job, restart counter is at 8.
2021-03-25T15:26:31Z systemd[1]: Stopped Service for snap application security-bear.security-bear.
2021-03-25T15:26:31Z systemd[1]: snap.security-bear.security-bear.service: Start request repeated too quickly.
2021-03-25T15:26:31Z systemd[1]: snap.security-bear.security-bear.service: Failed with result 'exit-code'.
2021-03-25T15:26:31Z systemd[1]: Failed to start Service for snap application security-bear.security-bear.

As you can see this time it crushe on the command ip route

guyluz11 · March 29, 2021, 2:18pm

With --devmode it is working.

Tested it again with all the plugs from here (connected them manually) and it is not working.
List of plugs
plugs: [account-control, accounts-service, adb-support, alsa, appstream-metadata, audio-playback, audio-record, autopilot-introspection, avahi-control, avahi-observe, block-devices, bluetooth-control, bluez, bool-file, broadcom-asic-control, browser-support, calendar-services, camera, can-bus, cifs-mount, classic-support, contacts-service, content, core-support, cpu-control, cups-control, daemon-notify, dbus, dcdbas-control, desktop, desktop-legacy, device-buttons, display-control, docker, docker-support, dummy, dvb, firewall-control, framebuffer, fuse-support, fwupd, gpg-keys, gpg-public-keys, gpio, gpio-control, gpio-memory-control, greengrass-support, gsettings, hardware-observe, hardware-random-control, hardware-random-observe, hidraw, home, hostname-control, i2c, iio, intel-mei, io-ports-control, jack1, joystick, juju-client-observe, kernel-module-control, kernel-module-observe, kubernetes-support, kvm, libvirt, locale-control, location-control, location-observe, login-session-control, login-session-observe, log-observe, lxd, lxd-support, maliit, media-hub, mir, modem-manager, mount-observe, mpris, multipass-support, netlink-audit, netlink-connector, network, network-bind, network-control, network-manager, network-manager-observe, network-observe, network-setup-control, network-setup-observe, network-status, ofono, online-accounts-service, opengl, openvswitch, openvswitch-support, optical-drive, packagekit-control, password-manager-service, personal-files, physical-memory-control, physical-memory-observe, ppp, process-control, pulseaudio, raw-usb, raw-volume, removable-media, screencast-legacy, screen-inhibit-control, serial-port, shutdown, snapd-control, spi, ssh-keys, ssh-public-keys, storage-framework-service, system-backup, system-files, system-observe, system-packages-doc, system-source-code, system-trace, thumbnailer-service, time-control, timeserver-control, timezone-control, tpm, u2f-devices, ubuntu-download-manager, udisks2, uhid, uinput, uio, unity7, unity8, unity8-calendar, unity8-contacts, upower-observe, wayland, x11]

While connecting I got small warnings I think are not relevant

snap warnings
last-occurrence:  today at 16:51 IDT
warning: |
  snap "cybear-jinni" has bad plugs or slots: personal-files (cannot add personal-files plug: needs
  valid "read" or "write" attribute); system-files (cannot add system-files plug: needs valid "read"
  or "write" attribute); dbus (cannot find attribute 'bus'); content (content plug must contain
  target path); calendar-services (unknown interface "calendar-services")

ijohnson · March 29, 2021, 3:47pm

What is the output of snap debug confinement?

guyluz11 · March 29, 2021, 8:37pm

This is on the stable release

sudo snap debug confinement
partial

ijohnson · March 30, 2021, 2:39pm

This doesn’t seem to be an ubuntu kernel, where did you get the kernel from on this system?

guyluz11 · March 31, 2021, 10:23am

This is the karnel that comes with Armbian OS.
I got similar error in my Kubuntu machine.
Do you want me to paste all the output of the commands again from there?.

ogra · March 31, 2021, 11:00am

it is definitely missing security options that snapd requires

looking at your plugs list above, what do you expect to achieve with adding all possible interfaces ?

some are contradicting each other, some need extra configuration and will prevent you from installing if they are not configured (i.e. system-files) …

instead of “adding the world” when creating a snap, do not add any of them, install the snappy-debug snap and run snappy-debug in a second terminal while executing your app.

you will then get suggestions in that terminal which plugs your app does really need …