After spending some time poking around @popey’s system, the issue is DBus/SELinux.
When the user does snap install foo, snapd will ask polkit if used user is authorized. This happens over DBus. The request is captured here:
‣ Type=method_call Endian=l Flags=0 Version=1 Priority=0 Cookie=20
Sender=:1.139 Destination=org.freedesktop.PolicyKit1 Path=/org/freedesktop/PolicyKit1/Authority Interface=org.freedesktop.PolicyKit1.Authority Member=CheckAuthorization
UniqueName=:1.139
MESSAGE "(sa{sv})sa{ss}us" {
STRUCT "sa{sv}" {
STRING "unix-process";
ARRAY "{sv}" {
DICT_ENTRY "sv" {
STRING "start-time";
VARIANT "t" {
UINT64 1262675;
};
};
DICT_ENTRY "sv" {
STRING "pid";
VARIANT "u" {
UINT32 8488;
};
};
};
};
STRING "io.snapcraft.snapd.manage";
ARRAY "{ss}" {
};
UINT32 1;
STRING "";
};
However, the reply is blocked by DBus daemon and a message is sent back from dbus-daemon to polkitd:
‣ Type=error Endian=l Flags=1 Version=1 Priority=0 Cookie=341 ReplyCookie=384
Sender=org.freedesktop.DBus Destination=:1.332
ErrorName=org.freedesktop.DBus.Error.AccessDenied ErrorMessage="An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_return", sender=":1.332" (uid=997 pid=7025 comm="/usr/lib$
polkit-1/polkitd --no-debug " label="system_u:system_r:policykit_t:s0") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.139" (uid=0 pid=3047 comm="/usr/libexec/snapd/snapd " label="system_u:sy$
tem_r:snappy_t:s0")"
MESSAGE "s" {
STRING "An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_return", sender=":1.332" (uid=997 pid=7025 comm="/usr/lib/polkit-1/polkitd --no-debug " label="system_u:sy$
tem_r:policykit_t:s0") interface="(unset)" member="(unset)" error name="(unset)" requested_reply="0" destination=":1.139" (uid=0 pid=3047 comm="/usr/libexec/snapd/snapd " label="system_u:system_r:snappy_t:s0")";
};
While this happens, the snap process is waiting for snapd, but the latter is blocked waiting for polkit to respond which will never happen.
Since the error message is sent only over DBus to polkitd it’s not really logged elsewhere. Also it does not appear in audit log, since the policy is applied by DBus.
On Monday, I’ll dig in and see if anything can be done with DBus policy files.
@jamesh i’m open to any suggestions you might have.
