Some node-exporter graphs have no data due to snap confinement - AppArmor denials

[nobuto-m]

Bug Description

To Reproduce

With MAAS provider, deploy the grafana-agent charm onto another charm, and relate it to COS.

Environment

$ snap info grafana-agent
...
services:
  grafana-agent: simple, enabled, active
snap-id:      T1u01xKcraA4IpWHpIGNU2nAOom9qG7i
tracking:     latest/edge
refresh-date: today at 11:55 UTC
channels:
  latest/stable:    0.34.3 2023-07-19 (13) 264MB -
  latest/candidate: 0.34.3 2023-07-19 (13) 264MB -
  latest/beta:      0.34.3 2023-07-19 (13) 264MB -
  latest/edge:      0.35.4 2023-08-15 (16) 282MB -
installed:          0.35.4            (16) 282MB -

Relevant log output

Oct 26 12:11:57 up-snail kernel: audit: type=1400 audit(1698322317.541:1674): apparmor="DENIED" operation="open" profile="snap.grafana-agent.grafana-agent" name="/proc/spl/kstat/zfs/" pid=104040 comm="agent" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Oct 26 12:11:57 up-snail kernel: audit: type=1400 audit(1698322317.541:1675): apparmor="DENIED" operation="open" profile="snap.grafana-agent.grafana-agent" name="/sys/fs/btrfs/" pid=104040 comm="agent" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Oct 26 12:11:57 up-snail kernel: audit: type=1107 audit(1698322317.545:1676): pid=1053 uid=102 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/login1" interface="org.freedesktop.login1.Manager" member="ListSeats" mask="send" name="org.freedesktop.login1" pid=104040 label="snap.grafana-agent.grafana-agent" peer_pid=1064 peer_label="unconfined"
Oct 26 12:11:57 up-snail kernel: audit: type=1107 audit(1698322317.549:1677): pid=1053 uid=102 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.DBus.Properties" member="Get" mask="send" name="org.freedesktop.systemd1" pid=104040 label="snap.grafana-agent.grafana-agent" peer_pid=1 peer_label="unconfined"
Oct 26 12:11:57 up-snail kernel: audit: type=1107 audit(1698322317.549:1678): pid=1053 uid=102 auid=4294967295 ses=4294967295 subj=unconfined msg='apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/systemd1" interface="org.freedesktop.systemd1.Manager" member="ListUnits" mask="send" name="org.freedesktop.systemd1" pid=104040 label="snap.grafana-agent.grafana-agent" peer_pid=1 peer_label="unconfined"
Oct 26 12:11:57 up-snail kernel: audit: type=1400 audit(1698322317.593:1679): apparmor="DENIED" operation="open" profile="snap.grafana-agent.grafana-agent" name="/proc/sys/kernel/threads-max" pid=104040 comm="agent" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Additional context

No response

[nobuto-m]

By running the binary outside of the confined context (calling /snap/grafana-agent/16/agent -config.expand-env -config.file /etc/grafana-agent.yaml on the host without snapd), I got the following working just for testing:

• Processes State
• PIDs Number and Limit

• Systemd Sockets
• Systemd Units States

[cbartz]

We have the same problem. The logs are full of permission denied errors: https://pastebin.canonical.com/p/tg6vNpDP6K/

[cbartz]

A user mentioned ( https://chat.charmhub.io/charmhub/pl/mwhz1e1c37rdpbbfbzd19bqi3c ) that reverting to stable/latest fixed the issue. @sed-i @Abuelodelanada any ideas ?

[phvalguima]

Hi @cbartz, I am still seeing these DENIED in both cases. However, the issue I had (i.e. missing info that I needed for my use case) is not happening in latest/stable. I don't think the info that was missing, in my specific case, was due to the DENIEDs thou