I’ve been using snaps on Gentoo by using JamesB192’s overlay on github. I wrote a little blog post about it when I first set it up on my system and it worked well.
A while ago it stopped working and I didn’t have time to look into it and I’ve now setup a new laptop and hit the same issue. I’m hoping someone here has a better understanding of apparmor and snaps can help me troubleshoot what’s missing on my system:
Main error:
snap run chromium
snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
$ snap version
snap {2.36.1}
snapd {2.36.1}
series 16
gentoo -
kernel 4.20.6-gentoo
$ sudo aa-status
apparmor module is loaded.
54 profiles are loaded.
53 profiles are in enforce mode.
/snap/core/6350/usr/lib/snapd/snap-confine
/snap/core/6350/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
snap-update-ns.chromium
snap-update-ns.core
snap-update-ns.powershell
snap.chromium.chromium
snap.core.hook.configure
syslog-ng
syslogd
traceroute
1 profiles are in complain mode.
snap.powershell.powershell
0 processes have profiles defined.
0 processes are in enforce mode.
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
PS, I chopped some of the output from the above command (additional irrelevant apparmor profiles)
$ cat /usr/src/linux/.config|grep APPARMOR
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
CONFIG_SECURITY_APPARMOR_HASH=y
CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
# CONFIG_SECURITY_APPARMOR_DEBUG is not set
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
$ cat /boot/grub/grub.cfg|grep apparmor|head -1
linux /boot/vmlinuz-4.20.6-gentoo root=/dev/nvme0n1p6 ro init=/lib/systemd/systemd apparmor=1 security=apparmor quiet
Also the output of journalctl -g apparmor can be found here
Please let me know if you notice anything out on my configuration or other information that might help.
Many thanks
