I’ve now also tried with --devmode
which should disable confinement, but even then something is wrong with the syscall. It gets allowed but comes back -2, which is ENOENT (I think?) ultimately still rendering temporary files broken. This does work fine when using the same Qt build on xenial outside snapd though.
Mai 17 14:40:28 ajax audit[1750]: AVC apparmor="ALLOWED" operation="open" profile="snap.okular.okular" name="/etc/xdg/QtProject/qtlogging.ini" pid=1750 comm="okular" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Mai 17 14:40:28 ajax audit[1750]: SYSCALL arch=c000003e syscall=2 success=yes exit=4 a0=717478 a1=80000 a2=1b6 a3=7179e0 items=1 ppid=11578 pid=1750 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts6 ses=2 comm="okular" exe="/snap/okular/x17/usr/bin/okular" key=(null)
Mai 17 14:40:28 ajax audit[1750]: AVC apparmor="ALLOWED" operation="open" profile="snap.okular.okular" name="/proc/sys/kernel/core_pattern" pid=1750 comm="okular" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Mai 17 14:40:28 ajax audit[1750]: SYSCALL arch=c000003e syscall=2 success=yes exit=7 a0=7b3a18 a1=80000 a2=1b6 a3=7f1a48f6a0d2 items=1 ppid=11578 pid=1750 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts6 ses=2 comm="okular" exe="/snap/okular/x17/usr/bin/okular" key=(null)
Mai 17 14:40:28 ajax audit[1750]: AVC apparmor="ALLOWED" operation="link" info="Failed name lookup - deleted entry" error=-2 profile="snap.okular.okular" name="/home/me/snap/okular/x17/.local/config/session/#35531993" pid=1750 comm="okular" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000
Mai 17 14:40:28 ajax audit[1750]: AVC apparmor="ALLOWED" operation="link" profile="snap.okular.okular" name="/home/me/snap/okular/x17/.local/config/session/okular_10616a6178000152656082800000081640087_1526560828_381499" pid=1750 comm="okular" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000 target="/home/me/snap/okular/x17/.local/config/session/#35531993"
Mai 17 14:40:28 ajax audit[1750]: SYSCALL arch=c000003e syscall=265 success=no exit=-2 a0=ffffff9c a1=14cb1e8 a2=ffffff9c a3=14be428 items=2 ppid=11578 pid=1750 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts6 ses=2 comm="okular" exe="/snap/okular/x17/usr/bin/okular" key=(null)
Mai 17 14:40:28 ajax audit[1750]: AVC apparmor="ALLOWED" operation="link" info="Failed name lookup - deleted entry" error=-2 profile="snap.okular.okular" name="/home/me/snap/okular/x17/.local/config/#35531995" pid=1750 comm="okular" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000
Mai 17 14:40:28 ajax audit[1750]: AVC apparmor="ALLOWED" operation="link" profile="snap.okular.okular" name="/home/me/snap/okular/x17/.local/config/okularrc" pid=1750 comm="okular" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000 target="/home/me/snap/okular/x17/.local/config/#35531995"
Mai 17 14:40:28 ajax audit[1750]: SYSCALL arch=c000003e syscall=265 success=no exit=-2 a0=ffffff9c a1=14d35b8 a2=ffffff9c a3=1504d08 items=2 ppid=11578 pid=1750 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts6 ses=2 comm="okular" exe="/snap/okular/x17/usr/bin/okular" key=(null)