We run pulseaudio in daemon mode because we share a computer and like to be able to share control of the same audio device eg. mute the other person’s stream when they’ve gone for a coffee and we’re about to take a call.
This works fine, but it means confined snaps don’t have audio. Installing spotify with
--devmode reveals that, according to apparmor’s log output, all that we need to do is grant
rw access to
/run/pulse/native and it’ll probably work?
Except, from what I see on this thread, there is no mechanism by which we can override this for our machine? Is that still the case?
Otherwise, what options do we have? It seems unlikely a PR to add this path to the stock interface for pulse would be accepted since our use case is so niche?
The system does not currently allow conveniently adding arbitrary rules to the snap’s policy. This or similar functionality may be added at a future date.
It is possible to update the policy directly in /var/lib/snapd/apparmor/profiles/snap.name.command and then loading that into the kernel with
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.name.command. Keep in mind, snapd will periodically rewrite this file, so you would have to keep adding it.
It is also possible to modify the apparmor abstractions that the applications
#include, which will persist on reboots/etc without snapd rewriting it. Eg,
grep '#include' /var/lib/snapd/apparmor/profiles/snap.spotify.spotify |sort -u shows that spotify uses a number of abstractions, though none specific to pulseaudio. Since pulseaudio does use the X protocol on classic distro and many snaps that ‘plugs: [ x11 ]’ also ‘plugs: [ pulseaudio ]’, one workaround that might make sense for you is to add this to /etc/apparmor.d/abstractions/X:
# workaround for https://forum.snapcraft.io/t/pulseaudio-in-daemon-mode/6606
Then load with:
$ sudo apparmor_parser -r --write-cache --cache-loc=/var/cache/apparmor /var/lib/snapd/apparmor/profiles/snap.name.command
Please note that by modifying this abstraction, all apparmor profiles that
#include <abstractions/X> will pick up the updated rule. If you are using confined applications that use X but you don’t want them to have access to the pulseaudio daemon service, you would not want to do the above.