Snap on Debian testing (buster) cannot install some snaps because of apparmor

snapd
1

I’m using Debian testing (buster) with kernel 4.14.0. Apparmor is enabled. When I try to install LXD with snap install lxd I get the following error in the configuration phase:

error: cannot perform the following tasks:
- Run configure hook of "lxd" snap if present (run hook "configure": 
-----
cannot bind-mount the mount namespace file /proc/28221/ns/mnt -> lxd.mnt: Permission denied
support process for mount namespace capture exited abnormally
-----)

Looking, at /var/log/messages, one sees warnings such as the following:

kernel: [27974.800683] audit: type=1400 audit(1515524232.129:114): apparmor="DENIED" operation="ptrace" profile="/usr/lib/snapd/snap-confine" pid=28648 comm="snap-confine" requested_mask="trace" denied_mask="trace" peer="/usr/lib/snapd/snap-confine"

The version of snapd is 2.27.6.

The install worked at one point when buster had a 4.13 kernel. I don’t know which version of snapd was active at that time.

I cannot find a dedicated bug tracker for snapd, which is why I am reporting this issue on the forum. I found similar but not identical issues here and here.

2

The problem may be with the snap-confine apparmor profile. If I disable it with

cd /etc/apparmor.d/disable/
ln -s /etc/apparmor.d/usr.lib.snapd.snap-confine.real
apparmor_parser -R /etc/apparmor.d/usr.lib.snapd.snap-confine.real
service snapd restart

then snap install lxd finishes without errors.

However, obviously it would be prefarable not to disable the snap-confine apparmor profile…