Public bug reported:

This issue is only about the loupe snap. We don't have a problem with
loupe or glycin as .deb's.

We are blocked from updating the Loupe snap past version 46. Loupe is
GNOME's new image viewer app and it relies on glycin for loading images
(basically a next generation gdk-pixbuf). glycin uses bubblewrap for
sandboxing. Loupe 46 uses glycin 1.0, Loupe 47 uses glycin 1.1 and Loupe
48 uses glycin 1.2.

Beginning with glycin 1.1, the glycin developers removed the option to
disable the bubblewrap sandbox.

Therefore, as a first step, it would be nice to be able to build loupe
46 without setting -Ddisable-glycin-sandbox=true

When I tried running loupe built like this, the app opened but I was
unable to open a .jpg. Screenshot of the error message attached.

Journal error
============
kernel: audit: type=1400 audit: apparmor="DENIED" operation="open" class="file" 
profile="snap.loupe.loupe" name="/proc/sys/kernel/overflowuid" comm="bwrap" 
requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Other info
==========
Ubuntu 25.04 has /etc/apparmod.d/loupe to bypass userns restrictions

References
==========
- https://github.com/ubuntu/loupe (the Snap build instructions
- https://gitlab.gnome.org/GNOME/glycin/-/commit/983f60f93 where upstream 
disabled the option to bypass the bubblewrap sandbox
- https://gitlab.gnome.org/GNOME/glycin/-/issues/129 where upstream is 
uninterested in bring back the option if Snap is the only one that needs it

** Affects: apparmor (Ubuntu)
     Importance: Undecided
         Status: New

** Attachment added: "loupe-snap-bwrap-error.png"
   
https://bugs.launchpad.net/bugs/2109369/+attachment/5874231/+files/loupe-snap-bwrap-error.png

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2109369

Title:
  Difficulty with loupe snap with bubblewrap

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2109369/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to