** Description changed: + [SRU + 2.77.1](https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/2158102) + + [ Impact ] + + Browsers and other apps read /proc/self/smaps_rollup for memory stats. The + default snap AppArmor profile denied that, producing high-rate kernel audit + spam (hundreds–thousands of lines per hour for Chromium). Downstream snaps + should not each patch this out. + + 2.77 allows reading @{PROC}/@{pid}/smaps_rollup in the default AppArmor + template. NEWS: "allow reading of /proc/self/smaps_rollup". + + [ Test Plan ] + + On Ubuntu with a desktop snap that used to spam (chromium, brave, etc.): + + 1. Before the update (or with an old snapd), run the snap and: + journalctl -k -b --grep='smaps_rollup' | grep DENIED | tail + Expect AppArmor DENIED open of .../smaps_rollup for snap.<name>.<app>. + + 2. Install snapd 2.77 from -proposed, restart the snap (or reboot), wait until + security profiles are regenerated. Confirm: + grep -n smaps_rollup /var/lib/snapd/apparmor/profiles/snap.<snap>.<app> + shows a read rule for smaps_rollup. + + 3. Use the snap as usual (open Chromium, browse a bit). Re-check: + journalctl -k --since '5 minutes ago' --grep='smaps_rollup' + Expect no new DENIED lines for that path. + + 4. Sanity: the snap still starts and works (page load, no confinement + crash). + + [ Where problems could occur ] + + - Allowing smaps_rollup leaks aggregate per-process memory stats to the snap. + That is considered low sensitivity (same as other /proc/self summary files) + but is a confinement widening. + - A too-broad rule (e.g. other pids' smaps) would be a real sandbox hole; the + intended rule is the snap's own pid. Testers should not see DENIED for + smaps_rollup, and should not see new allow rules for other processes' smaps. + - Profile regeneration failure would leave old denials in the journal after + upgrade. + + [ Other Info ] + + Chromium also shipped an app-side workaround; this snapd change is the + system-wide fix for all snaps. Included in snapd 2.77 SRU. + + --- original --- + As of the latest version of the chromium snap, logspam of the following form has started appearing: May 13 12:31:09 work kernel: audit: type=1400 audit(1747103468.999:15955): apparmor="DENIED" operation="open" class="file" profile="snap.chromium.chromium" name="/proc/26352/smaps_rollup" pid=26352 comm="MemoryInfra" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 My machine is clocking nearly 900 log entries per hour when chromium is open. This message did not appear before yesterday when I upgraded the snap: [paulgear@work ~]$ journalctl --since -2d | grep -c chromium.*smaps_rollup 7264 - [paulgear@work ~]$ journalctl --since -32d | grep -c chromium.*smaps_rollup + [paulgear@work ~]$ journalctl --since -32d | grep -c chromium.*smaps_rollup 7264 - Other diagnostic info: [paulgear@work ~]$ uname -a; type -a chromium Linux work 6.11.0-25-generic #25~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 17:20:50 UTC 2 x86_64 x86_64 x86_64 GNU/Linux chromium is /snap/bin/chromium chromium is /snap/bin/chromium [paulgear@work ~]$ snap info chromium; snap connections chromium name: chromium summary: Chromium web browser, open-source version of Chrome publisher: Canonical✓ store-url: https://snapcraft.io/chromium contact: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bugs?field.tag=snap license: unset description: | - An open-source browser project that aims to build a safer, faster, and more - stable way for all Internet users to experience the web. + An open-source browser project that aims to build a safer, faster, and more + stable way for all Internet users to experience the web. commands: - - chromium.chromedriver - - chromium + - chromium.chromedriver + - chromium services: - chromium.daemon: simple, disabled, inactive + chromium.daemon: simple, disabled, inactive snap-id: XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R tracking: latest/stable refresh-date: 4 days ago, at 18:50 AEST channels: - latest/stable: 136.0.7103.92 2025-05-09 (3125) 188MB - - latest/candidate: 136.0.7103.92 2025-05-07 (3125) 188MB - - latest/beta: 137.0.7151.6 2025-05-08 (3129) 191MB - - latest/edge: 138.0.7166.2 2025-05-09 (3131) 185MB - + latest/stable: 136.0.7103.92 2025-05-09 (3125) 188MB - + latest/candidate: 136.0.7103.92 2025-05-07 (3125) 188MB - + latest/beta: 137.0.7151.6 2025-05-08 (3129) 191MB - + latest/edge: 138.0.7166.2 2025-05-09 (3131) 185MB - installed: 136.0.7103.92 (3125) 188MB - Interface Plug Slot Notes audio-playback chromium:audio-playback :audio-playback - audio-record chromium:audio-record :audio-record - bluez chromium:bluez :bluez - browser-support chromium:browser-sandbox :browser-support - camera chromium:camera :camera - content[gnome-42-2204] chromium:gnome-42-2204 gnome-42-2204:gnome-42-2204 - content[gtk-3-themes] chromium:gtk-3-themes gtk-common-themes:gtk-3-themes - content[icon-themes] chromium:icon-themes gtk-common-themes:icon-themes - content chromium:install-cups-runtime-dependency - - content[sound-themes] chromium:sound-themes gtk-common-themes:sound-themes - cups chromium:cups cups:cups - desktop chromium:desktop :desktop - desktop-legacy chromium:desktop-legacy :desktop-legacy - gsettings chromium:gsettings :gsettings - hardware-observe chromium:hardware-observe :hardware-observe - hidraw chromium:hidraw - - home chromium:home :home - joystick chromium:joystick :joystick - mount-observe chromium:mount-observe - - mpris - chromium:mpris - network chromium:network :network - network-bind chromium:network-bind :network-bind - network-manager chromium:network-manager - - opengl chromium:opengl :opengl - password-manager-service chromium:password-manager-service - - pcscd chromium:pcscd - - personal-files chromium:chromium-config :personal-files - personal-files chromium:dot-local-share-applications :personal-files - personal-files chromium:dot-local-share-icons :personal-files - pulseaudio chromium:pulseaudio - - raw-usb chromium:raw-usb - - removable-media chromium:removable-media :removable-media - screen-inhibit-control chromium:screen-inhibit-control :screen-inhibit-control - system-files chromium:etc-chromium-browser-policies :system-files - system-packages-doc chromium:system-packages-doc :system-packages-doc - u2f-devices chromium:u2f-devices :u2f-devices - unity7 chromium:unity7 :unity7 - upower-observe chromium:upower-observe :upower-observe - wayland chromium:wayland :wayland - x11 chromium:x11 :x11 - [paulgear@work ~]$ snap changes; grep ' install ' /var/log/dpkg.log ID Status Spawn Ready Summary 1222 Done yesterday at 10:32 AEST yesterday at 10:32 AEST Refresh all snaps: no updates [paulgear@work ~]$ lsb_release -rd No LSB modules are available. Description: Ubuntu 24.04.2 LTS Release: 24.04
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2110510 Title: New AppArmor logspam under snap v136.0.7103.92 To manage notifications about this bug go to: https://bugs.launchpad.net/snapd/+bug/2110510/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
