thresh
May 16, 2018, 11:40am
1
Hello,
the VLC snap includes some utilities from Neon project to nicely integrate with KDE when launched on a respective platform.
However, it does not seem to work and I’d like to have some guidance on how to debug this – I think it might be related to apparmor rules, but I’m not entirely sure it’s the case.
So to reproduce, you need to run LC_ALL=C snap run vlc -vvv under Plasma, with VLC from stable channel, or any other actually - they all share the same behaviour. In VLC Qt interface, click “Media” -> “Open file” and you’ll be presented with nice error windows, saying
and when you click “OK”, the next one pops in:
The open file dialog is KDE-looking, but is completely useless, rendering many errors.
Meanwhile in the console we can see:
Why all the denials? Arent those directories supposed to be accessible by VLC?
thresh
May 16, 2018, 11:41am
2
In dmesg while this was all happening:#279434158 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#279434158 "#279434158 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#279434158 "#828661888 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661888 "#279434158 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#279434158 "#279434158 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#279434158 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#3054268 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054268 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#3054272 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3054272 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#828661889 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#828661889 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000#3056070 "#3056070 " pid=313 comm=“vlc” requested_mask=“l” denied_mask=“l” fsuid=1000 ouid=1000
thresh
May 16, 2018, 11:41am
3
thresh@coal ~ $ dpkg -l | egrep -e '(snap|apparmor)'
ii apparmor 2.12-4 amd64 user-space parser utility for AppArmor
ii apparmor-utils 2.12-4 amd64 utilities for controlling AppArmor
ii libapparmor1:amd64 2.12-4 amd64 changehat AppArmor library
ii libsnappy1v5:amd64 1.1.7-1 amd64 fast compression/decompression library
ii python3-apparmor 2.12-4 amd64 AppArmor Python3 utility library
ii python3-libapparmor 2.12-4 amd64 AppArmor library Python3 bindings
ii snapd 2.30-5+b1 amd64 Tool to interact with Ubuntu Core Snappy.
thresh@coal ~ $ snap info --verbose vlc
name: vlc
summary: The ultimate media player
publisher: videolan
contact: https://www.videolan.org/support/
license: unknown
description: |
VLC is the VideoLAN project's media player.
Completely open source and privacy-friendly, it plays every multimedia file and streams.
It notably plays MKV, MP4, MPEG, MPEG-2, MPEG-4, DivX, MOV, WMV, QuickTime, WebM, FLAC, MP3,
Ogg/Vorbis files, BluRays, DVDs, VCDs, podcasts, and multimedia streams from various network sources.
It supports subtitles, closed captions and is translated in numerous languages.
commands:
- vlc
notes:
private: false
confinement: strict
devmode: false
jailmode: false
trymode: false
enabled: true
broken: false
ignore-validation: false
snap-id: RT9mcUhVsRYrDLG8qnvGiy26NKvv6Qkd
tracking: beta
refreshed: 2018-05-16T09:08:24+03:00
installed: 3.0.2-51-gfb3a5ca (333) 198MB
channels:
stable: 3.0.1-4-g14a4897 (190) 189MB -
candidate: 3.0.2 (277) 192MB -
beta: 3.0.2-51-gfb3a5ca (333) 198MB -
edge: 4.0.0-dev-2848-g0836477 (332) 197MB -
thresh@coal ~ $ snap info --verbose core
name: core
summary: snapd runtime environment
publisher: canonical
contact: snappy-canonical-storeaccount@canonical.com
license: unknown
description: |
The core runtime environment for snapd
notes:
private: false
confinement: strict
devmode: false
jailmode: false
trymode: false
enabled: true
broken: false
ignore-validation: false
type: core
snap-id: 99T7MUlRhtI3U0QFgl5mXXESAiSwt776
tracking: stable
refreshed: 2018-04-29T21:29:48+03:00
installed: 16-2.32.6 (4571) 90MB
channels:
stable: 16-2.32.6 (4571) 90MB -
candidate: 16-2.32.8 (4650) 90MB -
beta: 16-2.32.8 (4650) 90MB -
edge: 16-2.32.8+git720.9dc7b89 (4677) 90MB -
thresh@coal ~ $
thresh@coal ~ $ cat /var/lib/snapd/apparmor/profiles/snap.vlc.vlc
#include <tunables/global>
@{SNAP_NAME}="vlc"
@{SNAP_REVISION}="333"
@{PROFILE_DBUS}="snap_2evlc_2evlc"
@{INSTALL_DIR}="/snap"
profile "snap.vlc.vlc" (attach_disconnected) {
# set file rules so that exec() inherits our profile unless there is
# already a profile for it (eg, snap-confine)
/ rwkl,
/** rwlkm,
/** pix,
capability,
change_profile,
dbus,
network,
mount,
remount,
umount,
pivot_root,
ptrace,
signal,
unix,
}
@jdstrand @zyga-snapd it looks like we need to tweak something for qt5?
1 Like
No, 'l’ink is already allowed for these paths.
This looks like Qt 5.10 + linkat denials = broken KDE snaps . Please respond in that thread with the output of ‘snap version’.
@thresh responded in the other thread with:
"As requested:
$ snap version
snap 2.32.6
snapd 2.32.6
series 16
debian
kernel 4.16.0-1-amd64
This is on debian testing."
@thresh , what is the output of:
$ snap debug confinement
There you go:
thresh@coal ~ $ snap debug confinement
partial
@zyga-snapd - something seems wrong here, the system reports partial confinement but @thresh is seeing apparmor denials on Debian looking as if the system is in strict confinement.
@thresh - can you paste the output of cat /var/lib/snapd/apparmor/profiles/snap.vlc.vlc?
thresh
May 18, 2018, 2:22pm
11
Here you go:
thresh@coal ~ $ cat /var/lib/snapd/apparmor/profiles/snap.vlc.vlc
#include <tunables/global>
@{SNAP_NAME}="vlc"
@{SNAP_REVISION}="337"
@{PROFILE_DBUS}="snap_2evlc_2evlc"
@{INSTALL_DIR}="/snap"
profile "snap.vlc.vlc" (attach_disconnected) {
# set file rules so that exec() inherits our profile unless there is
# already a profile for it (eg, snap-confine)
/ rwkl,
/** rwlkm,
/** pix,
capability,
change_profile,
dbus,
network,
mount,
remount,
umount,
pivot_root,
ptrace,
signal,
unix,
}
@zyga-snapd - hmm, snapd seems to be doing the right thing. Maybe this is an upstream kernel issue.
From IRC from thresh:
$ snap info vlc
name: vlc
summary: The ultimate media player
publisher: videolan
contact: https://www.videolan.org/support/
license: unknown
description: |
VLC is the VideoLAN project's media player.
Completely open source and privacy-friendly, it plays every multimedia file and streams.
It notably plays MKV, MP4, MPEG, MPEG-2, MPEG-4, DivX, MOV, WMV, QuickTime, WebM, FLAC, MP3,
Ogg/Vorbis files, BluRays, DVDs, VCDs, podcasts, and multimedia streams from various network sources.
It supports subtitles, closed captions and is translated in numerous languages.
commands:
- vlc
snap-id: RT9mcUhVsRYrDLG8qnvGiy26NKvv6Qkd
tracking: beta
refreshed: 2018-05-18T09:14:27+03:00
installed: 3.0.2-185-g2ee8bd6 (337) 198MB -
channels:
stable: 3.0.1-4-g14a4897 (190) 189MB -
candidate: 3.0.2 (277) 192MB -
beta: 3.0.2-185-g2ee8bd6 (337) 198MB -
edge: 4.0.0-dev-2905-gff840c5 (336) 192MB -
FYI, I installed Debian testing from netinst, then used tasksel to install the KDE desktop environment, then installed the vlc snap from the beta channel and can reproduce this on vlc ‘Quit’:
May 18 10:47:13 debian-testing-amd64 audit[2568]: AVC apparmor="DENIED" operation="link" info="Failed name lookup - deleted entry" error=-2 profile="snap.vlc.vlc" name="/home/jamie/snap/vlc/337/.config/vlc/#18120" pid=2568 comm="vlc" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000
May 18 10:47:13 debian-testing-amd64 kernel: audit: type=1400 audit(1526658433.250:103): apparmor="DENIED" operation="link" info="Failed name lookup - deleted entry" error=-2 profile="snap.vlc.vlc" name="/home/jamie/snap/vlc/337/.config/vlc/#18120" pid=2568 comm="vlc" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000
May 18 10:47:13 debian-testing-amd64 kernel: audit: type=1400 audit(1526658433.250:104): apparmor="DENIED" operation="link" profile="snap.vlc.vlc" name="/home/jamie/snap/vlc/337/.config/vlc/vlc-qt-interface.conf" pid=2568 comm="vlc" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000 target="/home/jamie/snap/vlc/337/.config/vlc/#18120"
May 18 10:47:13 debian-testing-amd64 audit[2568]: AVC apparmor="DENIED" operation="link" profile="snap.vlc.vlc" name="/home/jamie/snap/vlc/337/.config/vlc/vlc-qt-interface.conf" pid=2568 comm="vlc" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000 target="/home/jamie/snap/vlc/337/.config/vlc/#18120"
