Public bug reported:
Summary
Nautilus cannot generate file thumbnails on a fresh Ubuntu 24.04
installation.
The issue is caused by AppArmor restricting unprivileged user
namespaces, which prevents bubblewrap (bwrap) from creating the sandbox
environment required by the thumbnail generation process.
Disabling the AppArmor user namespace restriction fixes the issue
immediately.
Environment
- OS: Ubuntu 24.04 LTS (Noble Numbat)
- Desktop: GNOME
- Nautilus version: 46.4
- Architecture: amd64
- Kernel:
Linux 7.0.0-28-generic #28~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC
- bubblewrap:
bubblewrap 0.9.0-1ubuntu0.1
- AppArmor:
4.0.1really4.0.1-0ubuntu0.24.04.7
Steps to reproduce
1. Install a fresh Ubuntu 24.04 system.
2. Open Nautilus.
3. Navigate to a directory containing images/videos.
4. Enable thumbnail display.
5. Thumbnails are not generated.
Expected behavior
Nautilus should generate thumbnails normally on a default Ubuntu desktop
installation.
Actual behavior
Nautilus fails to generate thumbnails.
The kernel log shows bubblewrap failing due to AppArmor restrictions:
apparmor="DENIED"
profile="unprivileged_userns"
comm="bwrap"
capname="setpcap"
apparmor="DENIED"
profile="unprivileged_userns"
name="proc/<pid>/uid_map"
requested_mask="wr"
Running bubblewrap manually reproduces the problem:
$ bwrap --ro-bind / / true
bwrap: setting up uid map: Permission denied
Additional investigation
The following checks were performed:
User namespaces are enabled:
$ cat /proc/sys/kernel/unprivileged_userns_clone
1
User namespace limit is sufficient:
$ sysctl user.max_user_namespaces
user.max_user_namespaces = 115486
Subuid/subgid configuration exists:
$ cat /etc/subuid
nfl-jiancx:100000:65536
$ cat /etc/subgid
nfl-jiancx:100000:65536
Disabling AppArmor user namespace restriction fixes the issue:
$ sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
After this change:
$ unshare --user --map-root-user id
uid=0(root) gid=0(root)
$ bwrap --unshare-user --uid 0 --gid 0 true
works correctly.
Nautilus thumbnails immediately start working again.
Possible cause
Ubuntu 24.04 enables:
kernel.apparmor_restrict_unprivileged_userns=1
by default.
This appears to prevent bubblewrap from creating the user namespace
required by GNOME thumbnail generation.
Suggested fix
Possible solutions:
1. Allow bubblewrap thumbnail sandbox usage under the AppArmor policy.
or
2. Adjust the Ubuntu default AppArmor/user namespace policy so GNOME
desktop components depending on bubblewrap continue to work.
A fresh Ubuntu desktop installation should not require users to manually
disable AppArmor restrictions or set SUID on /usr/bin/bwrap to get
Nautilus thumbnails working.
** Affects: nautilus (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162114
Title:
Nautilus thumbnails fail to generate on Ubuntu 24.04 due to AppArmor
restricting bubblewrap user namespaces
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/2162114/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
