Public bug reported:
AppArmor on 6.17.0-23-generic denies read ("receive") on established TCP sockets
for snap profiles allowing "network inet stream" (works on 6.8.0-146-generic)
Summary
On Ubuntu 24.04 with kernel 6.17.0-23-generic, Chromium-based snaps (chromium,
slack,
whatsie) cannot use the network: every HTTPS request fails with
ERR_ACCESS_DENIED
(net_error -10, SSL handshake failed). The firefox snap is unaffected. Booting
the same
system on 6.8.0-146-generic fixes it, with no change to profiles, snaps or
userspace.
Environment
- Ubuntu 24.04, kernel 6.17.0-23-generic (6.17.0-23.23~24.04.1);
6.17.0-14-generic installed, untested
- apparmor/libapparmor1 4.0.1really4.0.1-0ubuntu0.24.04.8
- snapd 2.77.1 (snap), 2.76.3+ubuntu24.04 (deb)
- chromium 154.0.8037.57 (rev 3548), slack 4.52.171 (262), whatsie 6.1.1 (217)
- kernel.apparmor_restrict_unprivileged_userns = 1
Kernel log (addresses redacted)
audit: type=1400 apparmor="DENIED" operation="file_perm" class="net"
profile="snap.chromium.chromium" comm="Chrome_ChildIOT" family="inet"
sock_type="stream"
protocol=6 requested="receive" denied="receive"
Same with profile="snap.whatsie.whatsie" comm="NetworkService". Connections are
established (local and remote addresses are set); only receive is denied. No
denials for
create/connect/send.
What was checked
1. snap connections: "network" interface connected for chromium and whatsie.
2. apparmor_parser -p: chromium, firefox and whatsie profiles contain the same
expanded
rules (network inet/inet6 stream/dgram); no "deny network".
3. apparmor_parser -r and -r -T on snap.chromium.chromium: no change.
4. apparmor_parser -r -C (complain mode): chromium works.
5. Same profiles, same snapd, same snaps on 6.8.0-146-generic, enforce mode:
all work.
=> kernel-dependent.
Speculation (not verified)
All denials have operation="file_perm". Chromium may read sockets with read()
while
Firefox uses recv(), which would explain why only Chromium-based apps are
affected.
Reproduce: boot 6.17.0-23-generic, run "snap run chromium https://example.org";.
Expected: page loads, as on 6.8.0-146-generic.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.17.0-23-generic 6.17.0-23.23~24.04.1
ProcVersionSignature: Ubuntu 6.17.0-23.23~24.04.1-generic 6.17.13
Uname: Linux 6.17.0-23-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: cohen-tanugi 5382 F.... wireplumber
/dev/snd/controlC1: cohen-tanugi 5382 F.... wireplumber
/dev/snd/seq: cohen-tanugi 5379 F.... pipewire
CRDA: N/A
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Tue Oct 6 21:55:08 2026
InstallationDate: Installed on 2024-12-11 (665 days ago)
InstallationMedia: Ubuntu 24.04.1 LTS "Noble Numbat" - Release amd64
(20240827.1)
MachineType: Dell Inc. Precision 7680
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.17.0-23-generic
root=/dev/mapper/ubuntu--vg-ubuntu--lv ro quiet splash
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
vt.handoff=7
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No
PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
linux-restricted-modules-6.17.0-23-generic N/A
linux-backports-modules-6.17.0-23-generic N/A
linux-firmware 20240318.git3b128b60.0ubuntu3.1
SourcePackage: linux-hwe-6.17
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 05/25/2026
dmi.bios.release: 1.30
dmi.bios.vendor: Dell Inc.
dmi.bios.version: 1.30.0
dmi.board.name: 05R4R4
dmi.board.vendor: Dell Inc.
dmi.board.version: A01
dmi.chassis.type: 10
dmi.chassis.vendor: Dell Inc.
dmi.ec.firmware.release: 1.23
dmi.modalias:
dmi:bvnDellInc.:bvr1.30.0:bd05/25/2026:br1.30:efr1.23:svnDellInc.:pnPrecision7680:pvr:rvnDellInc.:rn05R4R4:rvrA01:cvnDellInc.:ct10:cvr:sku0C41:
dmi.product.family: Precision
dmi.product.name: Precision 7680
dmi.product.sku: 0C41
dmi.sys.vendor: Dell Inc.
** Affects: linux-hwe-6.17 (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2169750
Title:
AppArmor on 6.17.0-23-generic denies read ("receive") on established
TCP sockets
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-hwe-6.17/+bug/2169750/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
