Check the syslog for DENIED messages from apparmor. You can also use snappy-debug from the store to get helpful hints as to interfaces that are required; just install and then run at the same time you run your app to see what it detects is being denied and any potential mitigations.
I suspect you’re missing either network or network-bind interface plug.
I have added network interface to .yaml file below the command line as:
plugs:
- network
but still getting the error:
<module 'paho.mqtt.client' from '/snap/config-mqtt/x1/lib/python3.6/site-packages/paho/mqtt/client.py'>
Traceback (most recent call last):
File "/snap/config-mqtt/x1/bin/config-mqtt", line 11, in <module>
load_entry_point('config-mqtt==0.1.dev0', 'console_scripts', 'config-mqtt')()
File "/snap/config-mqtt/x1/lib/python3.6/site-packages/config_mqtt/config_mqtt.py", line 9, in init
client = mqtt.Client()
File "/snap/config-mqtt/x1/lib/python3.6/site-packages/paho/mqtt/client.py", line 566, in __init__
self._sockpairR, self._sockpairW = _socketpair_compat()
File "/snap/config-mqtt/x1/lib/python3.6/site-packages/paho/mqtt/client.py", line 273, in _socketpair_compat
listensock.listen(1)
PermissionError: [Errno 1] Operation not permitted
and in the apparmor:
= AppArmor =
Time: Feb 19 09:06:40
Log: apparmor="DENIED" operation="file_inherit" profile="snap.config-mqtt.config-mqtt" name="/snap/code/25/usr/share/code/chrome_100_percent.pak" pid=8873 comm="snap-exec" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
File: /snap/code/25/usr/share/code/chrome_100_percent.pak (read)
Suggestion:
* adjust program to read necessary files from $SNAP, $SNAP_DATA, $SNAP_COMMON, $SNAP_USER_DATA or $SNAP_USER_COMMON
plugs: [network] also has the same error. @ogra
any thoughts to fix this please?
Traceback (most recent call last):
File "/snap/olibox-core/x1/lib/python3.6/site-packages/olibox_core/olibox_core/olibox_core.py", line 63, in main
connect_mqtt()
File "/snap/olibox-core/x1/lib/python3.6/site-packages/olibox_core/olibox_core/olibox_core.py", line 45, in connect_mqtt
client = pkg.config_mqtt()
File "/snap/olibox-core/x1/lib/python3.6/site-packages/olibox_core/olibox_core/olibox_pkg/oli_mqtt.py", line 82, in config_mqtt
client.tls_set('ca-certificates.crt')
File "/snap/olibox-core/x1/lib/python3.6/site-packages/paho/mqtt/client.py", line 827, in tls_set
context.load_verify_locations(ca_certs)
PermissionError: [Errno 13] Permission denied
I have already added home to plugs.
The .crt file and the python module are in the same directory.
I also place the .crt file in project home directory as well (just to avoid path issues).
I’m not sure if I have to move .crt file to $SNAP_USER_DATA.
any guidance please? thanks
Its a cerficate file that works fine without snap.
In normal app this file is working fine and being used.
I didn’t set any permission and I’m not sure about it.
= AppArmor =
Time: Feb 19 11:42:12
Log: apparmor="DENIED" operation="open" profile="snap.olibox-core.olibox-core" name="/proc/6399/mounts" pid=6399 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /proc/6399/mounts (read)
Suggestions:
* adjust program to not access '@{PROC}/@{pid}/mounts'
* add one of 'mount-observe, network-control' to 'plugs'
I have already added mount-observe and network-control.
can you please help me out to adjust program to not access '@{PROC}/@{pid}/mounts', how can I do this? thanks
It looks like you’re trying to copy a file from outside the snap into $SNAP_USER_DATA. How do you plan to guarantee that this file will exist on users’ systems and will exist in the location you expect it to?
Your code above copies from ./ which means the current working directory. This will be whatever directory that the user is within when launching the application, and cannot be guaranteed unless you first do a cd /known/path/location first.
you mean it still complains about /proc/*/mounts ?
you are jumping back and forth between topics here, this is very hard to follow … could you work on one thing at a time ?
