"snap-confine is packaged without necessary permissions and cannot continue"

snapd
1

Hello,

I am running opensuse Tunbleweed and switched to AppArmor to prepare for Snap (https://en.opensuse.org/SDB:AppArmor).

Then I have installed Snap (https://en.opensuse.org/Snap) and finally “hello-world”.

Here is the error I get with “hello-world” (and other Snaps):

$ snap-confine is packaged without necessary permissions and cannot continue $ required permitted capability cap_dac_override not found in current capabilities: $ cap_wake_alarm=i: Argument list too long

Searching for this issue I find only messages on “‘Snap-confine Has Elevated Permissions and Is Not Confined’“, but not my error above.

Any idea?

2

Hi,

Thanks for reporting. Are you running this in a container, or something may be preventing capabilities from being applied, e.g. system wide systemd NoNewPrivileges set in /etc/systemd/systemd-system.conf?

In any case, you should first check that the file capabilities on snap-confine are set correctly. You can run the following command to confirm that:

$ getcap /usr/libexec/snapd/snap-confine
/usr/libexec/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p

The file permissions are applied automatically when you install the snapd package using zypper. It’s not impossible that something may have gone wrong, in which case you can try using the permctl tool to inspect (note I have intentionally stripped all file capabilities to demonstrate the error):

$ permctl --examine /usr/libexec/snapd/snap-confine /etc/permissions.d/snapd
Checking permissions and ownerships - using the permissions files
        /etc/permissions.d/snapd
/usr/libexec/snapd/snap-confine: should be root:root 0755 "cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p". (missing capabilities)

and to restore the values appropriate for a given security profile:

$ permctl --set --examine /usr/libexec/snapd/snap-confine /etc/permissions.d/snapd

At which point you can run permctl --examine or getcap again to confirm that permissions are set.

Note, if you switched your security configuration to paranoid level (via /etc/sysconfig/security), the profile for snap-confine specifically removes all file capabilities. This is intentional.

3

Many thanks, the issue i soled now!

4

Thanks, that explains the symptom. For anyone hitting this on Tumbleweed, checking /etc/sysconfig/security and whether paranoid mode is enabled seems like the key first step; changing that policy just to make a snap run would be a system-wide trade-off. I’d also compare the installed snapd/snap-confine package versions and attach the relevant AppArmor audit lines before changing anything. The distinction between missing file capabilities and a broken package is easy to miss.

5

Hello Helen,

the issue appears to be caused by the fact, that /usr was not owned by root:root, but by my own user. I have changed ownership of /usr to root:root and finally “permctl –set” ran through.

Regards

1 Like