Making the Ubuntu Snap Store work with Automatic Proxy on 20.04?

Asked by Fotis Gimian

Hey there guys, I really struggled to report this as a bug. Alt+F2 in the Ubuntu Store would show a huge dialog about how the crashed program uses third-party libraries.

The problem is extremely simple to reproduce:

1. Install a Ubuntu 20.04 Beta
2. Browse to Settings / Network / Network Proxy and set to Automatic
3. Open the Ubuntu Store and notice that images fail to load

This appears to be AppArmor related as per the errors in the logs I see:

Apr 05 10:39:25 fotsies-ubuntu-vm dbus-daemon[1618]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/gtk/GLib/PACRunner" interface="org.gtk.GLib.PACRunner" member="Lookup" mask="send" name=":1.124" pid=2323 label="snap.snap-store.ubuntu-software" peer_pid=2530 peer_label="unconfined"
Apr 05 10:39:25 fotsies-ubuntu-vm dbus-daemon[1618]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/gtk/GLib/PACRunner" interface="org.gtk.GLib.PACRunner" member="Lookup" mask="send" name=":1.124" pid=2323 label="snap.snap-store.ubuntu-software" peer_pid=2530 peer_label="unconfined"
Apr 05 10:39:25 fotsies-ubuntu-vm dbus-daemon[1618]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/gtk/GLib/PACRunner" interface="org.gtk.GLib.PACRunner" member="Lookup" mask="send" name=":1.124" pid=2323 label="snap.snap-store.ubuntu-software" peer_pid=2530 peer_label="unconfined"
Apr 05 10:39:25 fotsies-ubuntu-vm dbus-daemon[1618]: apparmor="DENIED" operation="dbus_method_call" bus="session" path="/org/gtk/GLib/PACRunner" interface="org.gtk.GLib.PACRunner" member="Lookup" mask="send" name=":1.124" pid=2323 label="snap.snap-store.ubuntu-software" peer_pid=2530 peer_label="unconfined"
...
Apr 05 10:39:37 fotsies-ubuntu-vm snap-store[2323]: Result of screenshot downloading attempt with status code '7': GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.123" (uid=1000 pid=2323 comm="/snap/snap-store/336/usr/bin/snap-store " label="snap.snap-store.ubuntu-software (enforce)") interface="org.gtk.GLib.PACRunner" member="Lookup" error name="(unset)" requested_reply="0" destination=":1.124" (uid=1000 pid=2530 comm="/usr/libexec/glib-pacrunner " label="unconfined")
Apr 05 10:39:37 fotsies-ubuntu-vm snap-store[2323]: Result of screenshot downloading attempt with status code '7': GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.123" (uid=1000 pid=2323 comm="/snap/snap-store/336/usr/bin/snap-store " label="snap.snap-store.ubuntu-software (enforce)") interface="org.gtk.GLib.PACRunner" member="Lookup" error name="(unset)" requested_reply="0" destination=":1.124" (uid=1000 pid=2530 comm="/usr/libexec/glib-pacrunner " label="unconfined")
Apr 05 10:39:37 fotsies-ubuntu-vm snap-store[2323]: not handling error invalid-format for action refine: server returned no data
Apr 05 10:39:37 fotsies-ubuntu-vm snap-store[2323]: not handling error failed for action refine: Invalid string value converting to GVariant

However, I do also see a huge amount more AppArmor DENIES for this particular process.

I've attempted to set the AppArmor profile for the snap store to complain, but simply don't know how:

root@fotsies-ubuntu-vm:~# aa-status
apparmor module is loaded.
30 profiles are loaded.
30 profiles are in enforce mode.
   /snap/core/8935/usr/lib/snapd/snap-confine
   /snap/core/8935/usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/bin/evince
   /usr/bin/evince-previewer
   /usr/bin/evince-previewer//sanitized_helper
   /usr/bin/evince-thumbnailer
   /usr/bin/evince//sanitized_helper
   /usr/bin/man
   /usr/lib/NetworkManager/nm-dhcp-client.action
   /usr/lib/NetworkManager/nm-dhcp-helper
   /usr/lib/connman/scripts/dhclient-script
   /usr/lib/cups/backend/cups-pdf
   /usr/lib/snapd/snap-confine
   /usr/lib/snapd/snap-confine//mount-namespace-capture-helper
   /usr/sbin/cups-browsed
   /usr/sbin/cupsd
   /usr/sbin/cupsd//third_party
   /usr/sbin/tcpdump
   /{,usr/}sbin/dhclient
   ippusbxd
   lsb_release
   man_filter
   man_groff
   nvidia_modprobe
   nvidia_modprobe//kmod
   snap-update-ns.core
   snap-update-ns.snap-store
   snap.core.hook.configure
   snap.snap-store.snap-store
   snap.snap-store.ubuntu-software
0 profiles are in complain mode.
3 processes have profiles defined.
3 processes are in enforce mode.
   /usr/sbin/cups-browsed (971)
   /usr/sbin/cupsd (834)
   /snap/snap-store/336/usr/bin/snap-store (2323) snap.snap-store.ubuntu-software
0 processes are in complain mode.
0 processes are unconfined but have a profile defined.
root@fotsies-ubuntu-vm:~# ps -ef | grep -i snap
root 877 1 0 10:38 ? 00:00:01 /usr/lib/snapd/snapd
fots 2323 1872 2 10:39 ? 00:00:05 /snap/snap-store/336/usr/bin/snap-store
root 4157 3125 0 10:43 pts/0 00:00:00 grep --color=auto -i snap
root@fotsies-ubuntu-vm:~# aa-complain /snap/snap-store/336/usr/bin/snap-store
Profile for /snap/snap-store/336/usr/bin/snap-store not found, skipping

Any help is greatly appreciated
Fotis

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Solved by:
actionparsnip
Solved:
Last query:
Last reply:
Revision history for this message
Best actionparsnip (andrew-woodhead666) said :
#1

You can report a bug using:

ubuntu-bug snap

Feel free to change 'snap' to a different package if you think it's a better option.

Revision history for this message
Fotis Gimian (fgimian) said :
#2

Thanks actionparsnip, that solved my question.