[Bug 2098930] Re: openvpn profile doesn't allow access to files on home dir

2025-03-13 Thread John Johansen
@paride: RE: aa-notify aa-notify does not require the desktop-security-center snap. The desktop-security-center snap is required for permissions prompting which is a different feature, that is only available to snaps atm*. aa-notify is after the fact updating of the profile similar to using aa- l

[Bug 2098930] Re: openvpn profile doesn't allow access to files on home dir

2025-03-07 Thread John Johansen
atm It looks that way, there certainly should be some though comment #4's @{HOME}/.cert/nm-openvpn/* r, seems reasonable. We will have to look into others -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to gnome-control-center in Ubun

[Bug 2098930] Re: openvpn profile doesn't allow access to files on home dir

2025-03-07 Thread John Johansen
@aleasto, no they aren't desktop applications. That doesn't mean access to keys in a users directory can't be routed to the affected user as a permission request (at least in a desktop environment). Nor does it mean that the gui interface for network manager, can't act as at a privilege layer for

Re: [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-12-15 Thread John Johansen
On 11/16/24 06:42, Sam wrote: > I was wondering about the threats being mitigated by disabling > unprivileged userns like this. After some searching, I was able to find > this rationale: https://discourse.ubuntu.com/t/spec-unprivileged-user- > namespace-restrictions-via-apparmor-in-ubuntu-23-10/376

Re: [Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-12-15 Thread John Johansen
On 12/14/24 01:29, hifron wrote: > Electron apps could be made without sandbox usage - this could be setup > as compile options or electron settings, but it is not so good idea... > maybe temporarily as in between maybe, maybe not... > > but todays there is reality that prompting-client could be i

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-10-24 Thread John Johansen
@xmedeko The handling of spaces has nothing to do with the user namespace restriction that this bug, and the upstream git hub issue are tracking. can you attach any additional information. kernel logs etc. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, whi

[Bug 1795649] Re: evince from snap doesn't save position in pdf document

2024-09-10 Thread John Johansen
@Mingun: in https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1969896 you reported this is still affecting Ubuntu 24.04.1 Can you provide log entries with the denials you are encountering? sudo dmesg | grep DENIED Also you reported $ LANG=C sudo apparmor_parser -R /etc/apparmor.d/usr.b

[Bug 1969896] Re: Evince Document Viewer(42.0) does not remember last page in 22.04 and opens in a tiny window when launched

2024-09-10 Thread John Johansen
*** This bug is a duplicate of bug 1795649 *** https://bugs.launchpad.net/bugs/1795649 @Mingun: I have replied in https://bugs.launchpad.net/evince/+bug/1795649 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to evince in Ubuntu. htt

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-08-30 Thread John Johansen
An updated aa-notify that can prompt the user to create a profile is available in oracular, and for noble via https://launchpad.net/~apparmor-dev/+archive/ubuntu/apparmor-backports. The plan is to get more testing on it and then SRU to noble. it can be install via sudo apt install apparmor-notif

[Bug 2051574] Re: gnome-shell-portal-helper crashed with SIGTRAP in waitUntilSyncedOrDie() from WebKit::XDGDBusProxy::launch() ["bwrap: setting up uid map: Permission denied" ; "Failed to fully launch

2024-07-19 Thread John Johansen
@jamesh: for the profile please give it a short non-path based name, and option for local additions abi , include profile gnome-shell-portal-helper /usr/libexec/gnome-shell-portal-helper flags=(default_allow) { userns, # Site-specific additions and overrides. See local

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-06-29 Thread John Johansen
A profile for bwrap is in the 4.0.1 SRU -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to cra

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-06-29 Thread John Johansen
A profile for bwrap is in the 4.0.1 SRU -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to cra

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-06-29 Thread John Johansen
A profile for bwrap is in the 4.0.1 SRU ** Changed in: bubblewrap (Ubuntu) Status: Triaged => Fix Committed -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: Ap

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-05-23 Thread John Johansen
@mhalano: can you check your logs for apparmor denial messages? sudo dmesg | grep DENIED or journalctl -g apparmor -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title:

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-05-14 Thread John Johansen
Yes for the appimages that are affected they should be reported upstream. There are some things that upstream can do to make appimages work under the restriction, ideally they would do it dynamically based on whether the user namespace is available than just based on distro which is the quick fix s

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-05-13 Thread John Johansen
The AppArmor profile covers the packaged version and the standard privileged install location. You are correct that it does not cover running firefox from an unprivileged user writable location like $HOME. For unprivileged user writable locations like $HOME/bin/ the user has to deliberately make a

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-05-09 Thread John Johansen
@jorge-lavila: technically possible yes. I want to be careful with what I promise here, as the user experience is not my area. With that said we are currently looking at using aa-notify as a bridge to improve the user experience. We would install it with a filter to only fire a notification for th

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-05-09 Thread John Johansen
@zgraft: I have added a tor item, a profile will land in an update. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions caus

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-05-09 Thread John Johansen
@jorge-lavila, Its not a theoretical case, they have been used by multiple exploits every year (including this one) since landing in the kernel. Ubuntu is not the only ones looking at restricting them. SELinux has also picked up the ability but they haven't really rolled it out in policy, there ar

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-30 Thread John Johansen
For the thunderbird issue I have created https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2064363 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-30 Thread John Johansen
@u-dal: the problem with firefox (it has a snap profile and is allowed access to user namespaces) is different than with chrome (no profile loaded), but still might be apparmor related. Can you look in dmesg for apparmor denials ``` sudo dmesg | grep DENIED ``` -- You received this bug notifi

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-30 Thread John Johansen
@u-dal: are you running in a live cd environment? Something odd is happening on your system, with some profiles loaded and systemctl reporting ConditionPathExists=!/rofs/etc/apparmor.d -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-29 Thread John Johansen
@u-dal: This sounds like the apparmor policy is not being loaded can you please provide the output of ``` sudo aa-status ``` and ``` sudo systemctl status apparmor ``` -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubun

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-27 Thread John Johansen
Balena Etcher 1.18 dpkg won't install on 24.04 due to dependency issues, 1.19.16 installs fine and runs, but in a degraded sandbox mode. So adding a profile for it would be beneficial The appimage version of Belena Etcher unfortunately fails to run. We can not provide a default profile for the ap

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-27 Thread John Johansen
The Wike fix is coming in the next SRU. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to cra

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-03 Thread John Johansen
@arraybolt3: Answer to your question. bwrap requires capabilities within the user namespace. unshare is a little more forgiving in that what it requires depends on the options passed but most of the options also require capabilities within the user namespace. The potential solution I mention is co

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-03 Thread John Johansen
@arraybolt3 is correct. Both unshare and bwrap will not get a unconfined profile, as that allows for an arbitrary by-pass of the restriction. There is a potential solution in the works that will allow for bwrap and unshare to function as long as the child task does not require permissions but at th

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-04-01 Thread John Johansen
We have an update of the firefox profile coming that supports the /opt/firefox/firefox location used as the default install for the firefox downloaded directly from mozilla.org If you are running firefox out of your home directory, that will not be directly supported and you will need to chose to

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-29 Thread John Johansen
@coeur-noir: Are you installing firefox to /opt/ as recommended or using it local in your user account? as for bwarp, maybe it is known to be problematic. It is allowed to run and to create a user namespace but it is denied all capabilities within the namespace. Can you run sudo dmesg | grep

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-18 Thread John Johansen
@ajg-charlbury: no apparmor beta3 has not landed in proposed yet, we are working on the upload now. firefox separately have added a bug fix that will detect when the user namespace/capabilities are denied and fallback without crashing but it disables the full sandbox. the apparmor-beta3 fix should

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-17 Thread John Johansen
@ajg-charlbury: yes, firefox we are well aware of the problem, the firefox profile has been tweaked for beta3 (landing this week) so that it should work with the new deb. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubunt

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@arraybolt3: qutebrowser should be fixed in beta3 ** Changed in: qutebrowser (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: qmapshack (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: notepadqq (Ubuntu) Assignee: (unas

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: qmapshack should be fixed in beta3 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: I have been able to verify that privacybrowser is not working. However it is not due to the apparmor user namespace restrictions. I get the following segfault out of dmesg [ 1591.466016] privacybrowser[7743]: segfault at 8 ip 70bb4dd11ccc sp 7ffd5c6587e0 error 4 in libQt5Core.so.

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: pageedit should be fixed in beta3 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: notepadqq should be fixed in beta3 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
@kc2bez: there are no updated deb packages in the ppa for kiwix. the kiwix appimage worked for me. kiwix flatpak worked for me. I am not sure what you were seeing. But I we are going to need more information. ** Changed in: kiwix (Ubuntu) Status: Confirmed => Incomplete -- You received

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
hi @vvaleryan-24, I have been able to replicate the crash you are seeing but it is not do to the user namespace restriction. The restrictions logging does not happen, and I can put it in an unconfined profile and it still doesn't help. From dmesg I find the following segfault [79854.520976] gpk-a

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
this will be fixed in Beta ** Changed in: kchmviewer (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: rssguard (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) ** Changed in: supercollider (Ubuntu) Assignee: (unassigned) => John

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
sorry this won't be fixed in Beta3 that note was for goldendict ** Changed in: gnome-packagekit (Ubuntu) Assignee: John Johansen (jjohansen) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp i

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
Will be fixed in Beta3 ** Changed in: goldendict-webengine (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
we will be fixed in Beta3 ** Changed in: gnome-packagekit (Ubuntu) Assignee: (unassigned) => John Johansen (jjohansen) -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
I have tested gnome-packagekit and it never trigger unprivileged user namespace mediation. Can you please provide more information on how you triggered it. ** Changed in: gnome-packagekit (Ubuntu) Status: Confirmed => Incomplete -- You received this bug notification because you are a memb

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
** Changed in: loupe (Ubuntu) Assignee: (unassigned) => Georgia Garcia (georgiag) ** Changed in: geary (Ubuntu) Assignee: (unassigned) => Georgia Garcia (georgiag) ** Changed in: firefox (Ubuntu) Assignee: (unassigned) => Georgia Garcia (georgiag) -- You received this bug notific

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-16 Thread John Johansen
supercollider will work on current noble. Since it is using QTWebEngine it has a graceful fallback when capabilities within the user namespace are denied. supercollider will have a profile and be fixed in Beta3, so it doesn't even have to do the fallback. -- You received this bug notification be

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
I have tried freecad and unprivileged user namespace restrictions are not the problem. freecad snap works, freecad ppa does not have a noble build yet but the mantic build can be made to work. freecad daily appimage: works freecad appimage: stable fails with mesa or qt errors depending on how/wher

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
@sudipmuk loupe should be fixed in Beta3 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to cr

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
@eeickmeyer geary should be fixed in Beta3 -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions cause many applications to

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-15 Thread John Johansen
@guyster, @eldmannen+launchpad, @valeryan-24 Firefox dailies now have a work around, by detecting and disabling the user namespace. The proper fix that should allow firefox to still use the user namespace for its sandbox will land in Beta3, landing early next week. -- You received this bug notif

[Bug 2047256] Re: Ubuntu 24.04 Some image thumbnails no longer displayed

2024-03-15 Thread John Johansen
** Changed in: nautilus (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to nautilus in Ubuntu. https://bugs.launchpad.net/bugs/2047256 Title: Ubuntu 24.04 Some image thumbnails no longe

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-14 Thread John Johansen
@valeryan-24 ModuleNotFoundError: No module named 'imp'" says that your Gpodder issue is not related to this bug. You are missing a dependency the 'imp' module. If Gpodder is packaged it will need to add that as part of its install dependencies. -- You received this bug notification because you a

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-14 Thread John Johansen
** Changed in: steam (Ubuntu) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictio

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-06 Thread John Johansen
@scarlet I think it is fair to mark these as Fixed released as they are part of apparmor-alpha4 that is in noble. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppA

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-06 Thread John Johansen
This is part of the apparmor alpha4 release in noble ** Changed in: plasma-desktop (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-03-06 Thread John Johansen
This is part of the alpha4 release in noble ** Changed in: kdeplasma-addons (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-15 Thread John Johansen
** Changed in: steam (Ubuntu) Status: Confirmed => Fix Committed -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user namespace creation restrictions

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-14 Thread John Johansen
So appimages are interesting. They don't all need a profile. I have run several that are not using user namespaces, or only need to be able to create the user namespace and don't need capabilities so the default unpriviled_userns profile works for them. It is applications that need privileges with

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-13 Thread John Johansen
Erich, yes the archive version is based on the ppa, with a couple small fixes in the packaging. The ppa is going to get updated based the new archive version + a few more patches. Do you have some higher priority electron apps that you can point us at. We will look into the Visual Studo and Eleme

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-08 Thread John Johansen
One more addition, the current state of how unconfined deals with unprivileged user namespaces is a temporary limitation. The afore mentioned improvement will allow for more customization at the policy level. The current fixed behavior will be the default. -- You received this bug notification be

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-08 Thread John Johansen
So the answer is it depends on how they are using unprivileged user namespaces and how they react to them being denied, not every application needs to patched separately. Generally speaking gnome has been better tested than KDE had because gnome being the Ubuntu default saw a lot more opt in testi

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-02-02 Thread John Johansen
We have found that allowing the user namespace creation, and then denying capabilities is in general handled much better by KDE. The the case of the plasmashell and the browswer widget denying the creation of the user namespace would cause a crash with a SIGTRAP backtrace, where allowing the creati

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2024-01-22 Thread John Johansen
Sorry for the delay on this, we had some bugs to chase down. The following PPA has an update to how user namespace mediation is being handled. For the unconfined case there are two options 1. If the unprivileged_userns profile does not exist, unprivileged user namespace creation is denied as befor

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-28 Thread John Johansen
kdeplasma should be a fairly easy fix without prompting. I'll work on a profile for it and its add-ons -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to devhelp in Ubuntu. https://bugs.launchpad.net/bugs/2046844 Title: AppArmor user n

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-26 Thread John Johansen
There is another improvement coming before prompt that may (it will depend on the sandbox) also take care of many of the browser sandbox issues, as well as a few other uses of unprivileged user namespaces. On user namespace creation we will be able to transition the profile to a new profile with a

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-21 Thread John Johansen
Agreed we can't ask for a user to create a profile for every application, apparmor profiles can be shared, and having a generic profile that can be opted into makes sense. We are working towards it, this is just the first iteration. One of the things we are working on is abstracting what the curren

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-20 Thread John Johansen
Unfortunately it has to be a privileged operation, otherwise any application could set the attribute and then have access to user namespaces. The problem with unprivileged user namespaces is that it makes privileged interfaces available to the user in ways that they weren't designed for, leading to

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-20 Thread John Johansen
RE: security.apparmor attribute attachment not working Sorry for the current version of apparmor in Ubuntu requires a path attachment as well, you need to change the profile to (caveat untested so I may have made another mistake too) profile falkon /** xattrs=(security.apparmor=falkon) flags=(unc

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-19 Thread John Johansen
It does work for AppImages, but it is weird in that they don't have an install location, so that has to be adjusted for where they are placed on the system, or we have to set a security xattr on the executable at the time it is chmoded to +x Admittedly orcaslicer doesn't use unprivileged user name

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-19 Thread John Johansen
Yes it is known that Electron based apps are broken by this, it is unfortunate but there is no getting around it if we are going to tighten security around unprivileged user namespaces. As for apps that we don't specifically support (Electron or otherwise), we are still adding profiles for as many

[Bug 2046844] Re: AppArmor user namespace creation restrictions cause many applications to crash with SIGTRAP

2023-12-19 Thread John Johansen
Hey Aaron, yes there are many packages that now require an apparmor profile. There is a shortcut, in between profile that can be used atm so that a full profile doesn't need to be developed to get applications that require unprivileged user namespaces working. I will get a patch together to add the

[Bug 1794064] Re: Clicking a hyperlink in a PDF fails to open it if the default browser is a snap

2022-05-10 Thread John Johansen
@georgiag we could move the abstraction include to "include if exists" to take care of the depends. Generally speaking evince shouldn't depend on apparmor, but of course make use of it if it is available. -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which

[Bug 1794064] Re: Clicking a hyperlink in a PDF fails to open it if the default browser is a snap

2021-10-10 Thread John Johansen
I pulled the evince source and there does not appear to be any direct support for portals, and sandbox support is an untasked item on their roadmap. However it still may be possible via the gnome libs, or via dlopen. Those routes would need to be further investigated. -- You received this bug not

[Bug 987578] Re: Evince is not allowed to use exo-open

2020-09-08 Thread John Johansen
can you look in dmesg or kern.log for the actual apparmor denial? > I have absolutely no idea what "ixr" allow r (read) permission allow ix == on eXecute inherit the current profile an exec permission can specify different options that should be taken, inherit the current profile, transition to

[Bug 862149] Re: gdm does not respect gnome power management settings

2011-09-29 Thread John Johansen
-- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to gdm in Ubuntu. https://bugs.launchpad.net/bugs/862149 Title: gdm does not respect gnome power management settings To manage notifications about this bug go to: https://bugs.launchpad.n

[Bug 862149] [NEW] gdm does not respect gnome power management settings

2011-09-29 Thread John Johansen
Public bug reported: Set gdm as the session manager When logged in go to system settings -> power -> suspend when inactive/when plugged in to - Don't suspend Logout, and let the machine idle at gdm, machine will suspend after 30 minutes This can be real frustrating when trying to remote in to th

[Bug 800800] Re: Unity launcher doesn't allow nautilus new nautilus window when file transfer is only left

2011-07-04 Thread Simon Schmidt Johansen
*** This bug is a duplicate of bug 784804 *** https://bugs.launchpad.net/bugs/784804 How about a Ctrl + Left Click function, to open a new window? -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to nautilus in Ubuntu. https://bugs.la

[Bug 439448] Re: visual corruption affecting several panel applets

2010-09-14 Thread Dag Jarle Johansen
g about it. still with regards and greatings, Dag-jarle Johansen -- visual corruption affecting several panel applets https://bugs.launchpad.net/bugs/439448 You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is a bug assignee. -- desktop-bugs mailing list de

[Bug 439448] Re: visual corruption affecting several panel applets

2010-09-14 Thread Dag Jarle Johansen
(and that is annoing, because I have to start anew 10 times aday - testing apps with win, wine and VM). To the writer "Mal" - it also seems to me as possible temporary solution, but still I am not quite satisfied - too many apps, and for that I would need a 4.th panel. Thanks and regards,

[Bug 569818] Re: massive memory leak, evolution-data-server

2010-09-13 Thread Johansen
yep, same here 2.28.3 on lucid. 528Mb after a week or so. -- massive memory leak, evolution-data-server https://bugs.launchpad.net/bugs/569818 You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to evolution-data-server in ubuntu. -- desktop-

[Bug 93847] Re: Excessive CPU usage by Gnome System Monitor

2010-03-22 Thread Johansen
Forget the graph for a second, just scroll the processes tab up and down quickly, that will surly max out any processor. -- Excessive CPU usage by Gnome System Monitor https://bugs.launchpad.net/bugs/93847 You received this bug notification because you are a member of Ubuntu Desktop Bugs, which

[Bug 477843] Re: USB transfer is very slow on Ubuntu 9.10

2010-02-20 Thread Johansen
*** This bug is a duplicate of bug 197762 *** https://bugs.launchpad.net/bugs/197762 For what its worth, this bug seems to be limited by the processor speed, maxing out one core at 100% Each machine is different, but my results correlate strongly with overclock. can we get n core support for

[Bug 477843] Re: USB transfer is very slow on Ubuntu 9.10

2010-02-20 Thread Johansen
*** This bug is a duplicate of bug 197762 *** https://bugs.launchpad.net/bugs/197762 For what its worth, this bug seems to be limited by the processor speed, maxing out one core at 100% Each machine is different, but my results correlate strongly with overclock. can we get n core support for

[Bug 284658] Re: Compose sequence for aring changed after upgrade

2009-10-12 Thread Baard Johansen
This seems to have been fixed in Karmic. Closing the issue as fixed. ** Changed in: gtk+2.0 (Ubuntu) Status: Invalid => Fix Released -- Compose sequence for aring changed after upgrade https://bugs.launchpad.net/bugs/284658 You received this bug notification because you are a member of Ub

[Bug 335148] Re: gnome-power-manager crashed when pressing the "show battery" button

2009-07-05 Thread Baard Johansen
No, I've not seen this problem in a while. Consider this fixed. ** Changed in: gnome-power-manager (Ubuntu) Status: Incomplete => Invalid -- gnome-power-manager crashed when pressing the "show battery" button https://bugs.launchpad.net/bugs/335148 You received this bug notification becaus

[Bug 209109] Re: bemused plugin in totem-plugins not working

2009-04-30 Thread Hasse Hagen Johansen
Yes. The bug is stille present. As far as I remember it was quite an easy fix last time. The .totem-plugin file is missing from totem-plugins. Only the libbemused.so file i distirbuted. The .totem- plugin fil eis needed for Totem to use the .so file - as far as I remember it is a bug in debian/rule

[Bug 209109] Re: bemused plugin in totem-plugins not working

2008-12-30 Thread Hasse Hagen Johansen
Hi. It is still a problem. Long time I looked at it, but as I remember I got it working. I think it is a missing file which is not copied when the debian/rules file is run. All the other plugins have .totem-plugin file which I believe describes the plugin to totem, and that is why it doesn't turn

[Bug 284658] Re: Compose sequence for aring changed after upgrade

2008-10-16 Thread Baard Johansen
A workaround would be to replace the Gnome hard coding with XIM by following the how-to under https://help.ubuntu.com/community/ComposeKey and then add the following to lines to your .XCompose file: : "Å" Aring # LATIN CAPITAL LETTER A WITH RING ABOVE

[Bug 284658] [NEW] Compose sequence for aring changed after upgrade

2008-10-16 Thread Baard Johansen
Public bug reported: After upgrading from Hardy 8.04.1 to current Intrepid the compose-key sequence for aring has changed. Previously a+a worked, but now the sequence is o+a. According to this wiki-page, the sequence should be a+a: https://help.ubuntu.com/community/GtkComposeTable ** Affects: gt

[Bug 250501] [NEW] gnome-terminal crashed with SIGSEGV in ?? () from /lib/libc.so.6

2008-07-21 Thread Arnt Richard Johansen
Public bug reported: Binary package hint: gnome-terminal Description:Ubuntu 7.04 Release:7.04 gnome-terminal: Installed: 2.18.0-0ubuntu1 Candidate: 2.18.0-0ubuntu1 Version table: *** 2.18.0-0ubuntu1 0 500 http://no.archive.ubuntu.com feisty/main Packages 100 /v

[Bug 209109] Re: bemused plugin in totem-plugins not working

2008-03-30 Thread Hasse Hagen Johansen
It is not an upstream issue. I think it is a problem with the debian/rules file in the source package which doesn't copy the totem plugin description file named bemused.totem-plugin. The .so file i distributed in the ubuntu package so it _is_ a bug that the bemused .totem-plugin file isn't in the b

[Bug 209109] Re: bemused plugin in totem-plugins not working

2008-03-30 Thread Hasse Hagen Johansen
** Changed in: totem (Ubuntu) Status: Invalid => New -- bemused plugin in totem-plugins not working https://bugs.launchpad.net/bugs/209109 You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is a bug assignee. -- desktop-bugs mailing list desktop-bug

[Bug 209109] Re: bemused plugin in totem-plugins not working

2008-03-30 Thread Hasse Hagen Johansen
As far as I see it is part of totem-plugins and not totem-plugins-extra [EMAIL PROTECTED]:~$ dpkg -L totem-plugins|grep 'totem/plugins' /usr/lib/totem/plugins /usr/lib/totem/plugins/media-player-keys /usr/lib/totem/plugins/media-player-keys/media-player-keys.totem-plugin /usr/lib/totem/plugins/med

[Bug 209109] [NEW] bemused plugin in totem-plugins not working

2008-03-30 Thread Hasse Hagen Johansen
Public bug reported: Binary package hint: totem-plugins I cannot get the bemused plugin to work..I have tried recompiling from the source package, but no success. The plugin doesn't appear in totem (Edit->Plugins). I don't get any relevant debugging output when running totem --debug from a termin

[Bug 72679] Re: When locking screen with shotcut keys ctrl-alt-l, ctrl & alt i "sticking" when unlocking screen

2007-04-18 Thread Hasse Hagen Johansen
I am using Ubunt 6.10 with the latest updates. I have just tried. It actually seems only to be a problem when using beryl(and I don't believe that is supported actually) so maybe this can just be closed or checked against feisty? -- When locking screen with shotcut keys ctrl-alt-l,ctrl & alt i "s

[Bug 28939] logout applet is a not-so-good idea

2006-01-18 Thread Sverre Johansen
Public bug report changed: https://launchpad.net/malone/bugs/28939 Comment: I really miss the applet from the default GNOME configuration (Screenshot: http://primates.ximian.com/~federico/misc/default- desktop.png ), the window chooser applet. The applet shows all the available programs, in all w