Running from Snap: apparmor="DENIED" operation="ptrace" profile="snap.htop.htop"

[wellington1993]

I'm using htop from snap package model.

I have that problems visualized from dmesg:

apparmor="DENIED" operation="open" profile="snap.htop.htop" name="/proc/10657/task/10676/cmdline" pid=31317 comm="htop" requested_mask="r" denied_mask="r" fsuid=0 ouid=
apparmor="DENIED" operation="open" profile="snap.htop.htop" name="/proc/30670/cmdline" pid=31317 comm="htop" requested_mask="r" denied_mask="r" fsuid=0 ouid=1000
apparmor="DENIED" operation="open" profile="snap.htop.htop" name="/proc/31500/net/psched" pid=31500 comm="htop" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
apparmor="DENIED" operation="ptrace" profile="snap.htop.htop" pid=31500 comm="htop" requested_mask="read" denied_mask="read" peer="libvirtd"
apparmor="DENIED" operation="open" profile="snap.htop.htop" name="/proc/tty/drivers" pid=31500 comm="htop" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

and others...

I thinks some info not appearing too. How to solve this?

Thanks!

[maxiberta]

Just checking: did you enable the extra permissions, as described in snap info htop and in the snap store homepage?

Once installed, this snap needs manually connecting to some plugs:

sudo snap connect htop:mount-observe
sudo snap connect htop:process-control
sudo snap connect htop:system-observe
sudo snap connect htop:network-control  # DELAYACCT support (optional)

[wellington1993]

@maxiberta Thanks... I didn't installed from snap store page. I will try again.

[wellington1993]

@maxiberta The same problem after to the snap connect steps.

[maxiberta]

@wellington1993 What distro are you running? Please check snap version. Which snap version, on which channel (stable, beta, edge)? Please check snap list htop. Can you confirm snap connections htop prints exactly this?

$ snap connections htop
Interface        Plug                  Slot              Notes
mount-observe    htop:mount-observe    :mount-observe    manual
network-control  htop:network-control  :network-control  manual
process-control  htop:process-control  :process-control  manual
system-observe   htop:system-observe   :system-observe   manual

Can you reproduce on a different machine?

As a temporary workaround, you could re-install the snap with --devmode (but note it'll leave the snap unconfined/unsandboxed). Can check confinement with snap list htop, on the Notes column.

If there's an issue with snap confinement (apparmor, etc) on your specific environment, then I'd suggest you check/ask at https://forum.snapcraft.io/.

[wellington1993]

Hi,

➜ ~ git:(master) ✗ snap version

snap    2.42.4+git1579.c9f48be~ubuntu16.04.1
snapd   2.42.4+git1579.c9f48be~ubuntu16.04.1
series  16
ubuntu  19.10
kernel  5.3.12-xanmod8
host    amd64 

You are the publisher @maxiberta : ➜ ~ git:(master) ✗ snap list htop

Name  Version     Rev   Tracking  Publisher  Notes
htop  3.0.0beta5  1191  edge      maxiberta  -

➜ ~ git:(master) ✗ snap connections htop

Interface        Plug                  Slot              Notes
mount-observe    htop:mount-observe    :mount-observe    manual
network-control  htop:network-control  :network-control  manual
process-control  htop:process-control  :process-control  manual
system-observe   htop:system-observe   :system-observe   manual

Can you reproduce on a different machine?

I will try in different machine.

Thanks

[wellington1993]

Hi @maxiberta

Devmode appears to be solvel the problem: ➜ ~ git:(master) ✗ sudo snap refresh htop --edge --devmode

I can't see journalctl entries anymore. In this case, what is my next steps to report the problem?

Thanks!

[maxiberta]

Glad it worked! (But note --devmode is just a workaround that removes all the benefits of app confinement).

We've not been able to reproduce the issue, and haven't heard of it from any other user so far. So, I believe it might be an issue with your particular setup. In which case, I'd recommend to ask at https://forum.snapcraft.io/ where the snap sandboxing experts can help you.

[wellington1993]

Thanks! I will contact snapcraft forum.

[maxiberta]

Today I learned a couple of snapd commands for internals debugging:

$ snap debug confinement
strict

$ snap debug sandbox-features
apparmor:             kernel:caps kernel:dbus kernel:domain kernel:file kernel:mount kernel:namespaces kernel:network kernel:network_v8 kernel:policy kernel:ptrace kernel:query kernel:rlimit kernel:signal parser:unsafe policy:default support-level:full
confinement-options:  classic devmode strict
dbus:                 mediated-bus-access
kmod:                 mediated-modprobe
mount:                freezer-cgroup-v1 layouts mount-namespace per-snap-persistency per-snap-profiles per-snap-updates per-snap-user-profiles stale-base-invalidation
seccomp:              bpf-actlog bpf-argument-filtering kernel:allow kernel:errno kernel:kill_process kernel:kill_thread kernel:log kernel:trace kernel:trap kernel:user_notif
udev:                 device-cgroup-v1 tagging