I’ve been using network namespaces (ns) for a while. In my work I start different Chromium browsers in different namespaces for network purposes. This scheme was working in Ubuntu 19.04 until I upgraded OS to 20.04. For now I receive strange permission denied error.
cannot execute snapd tool snap-update-ns: Permission denied
I’ve tried to get logs from the journalctl $journalctl |grep audit|tail which gave me a result:
apr 07 17:54:03 my-book audit[121676]: AVC apparmor="DENIED" operation="exec" profile="/snap/core/10958/usr/lib/snapd/snap-confine" name="/snap/core/10958/usr/lib/snapd/snap-update-ns" pid=121676 comm="snap-confine" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
arp 07 17:54:03 my-book kernel: audit: type=1400 audit(1617807243.895:331): apparmor="DENIED" operation="exec" profile="/snap/core/10958/usr/lib/snapd/snap-confine" name="/snap/core/10958/usr/lib/snapd/snap-update-ns" pid=121676 comm="snap-confine" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
Seems something changed in apparmor snapd rules for Ubuntu. But I have no idea where to dig into. Nothing that can address to “x” mask inside an apparmor rules file /etc/apparmor.d/usr.lib.snapd.snap-confine.real