On 6/16/26 23:11, Pavol Poláčik via AppArmor wrote:
Dear developer of AppArmor
Can you please verify if this is also a related bug from AppArmor?
<https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/2156939>
Updating snap applications is impossible if the home directory is
encrypted using fscrypt via systemd-homed
there is insufficient info to say whether this is a bug, incomplete policy
or something else. From the bug we can see a few denials in the logs
jun 18 23:37:36 uzivatel kernel: audit: type=1400 audit(1781818656.471:217): apparmor="DENIED" operation="capable"
class="cap" profile="fusermount3" pid=2018 comm="fusermount3" capability=1 capname="dac_override"
jun 18 23:37:36 uzivatel kernel: audit: type=1400 audit(1781818656.471:218): apparmor="DENIED" operation="capable"
class="cap" profile="fusermount3" pid=2018 comm="fusermount3" capability=7 capname="setuid"
jun 18 23:37:36 uzivatel kernel: audit: type=1400 audit(1781818656.472:219): apparmor="DENIED" operation="capable"
class="cap" profile="fusermount3" pid=2040 comm="fusermount3" capability=7 capname="setuid"
it is possible that these are related in some way, but afaik fusermount3
isn't used by fscrypt
This bug of systemd-homed or AppArmor exist only if is encrypted home
folder with systemd-homed too
<https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/2150642>
the fusermount3 denials here make sense. But there needs to be more
investigation to understand what is going on.
Thanks
With regards Pavol Polacik
