Ubuntu 25.10 fusermount3 apparmor profile breaks AppImages

[stendler-mlpa]

Description

Background

While there is no official himmelblau build for 25.10 yet, this might likely occur with the next LTS as well.

Ubuntu 25.10 seems to have enabled an apparmor profile for fusermount3 which also caused issues upstream.

Issue

When using himmelblau, fusermount3 actions also receive apparmor denials for himmelblau related paths.

This is most apparent when running an AppImage (like the ones provided for o365), anything flatpak (especially with --user), or anything using xdg-document-portal, which all seem to utilise fusermount3 internally.

Workaround / possible fix

Similar to the changes for unix-chpwd, local apparmor adjustments alleviate the issues:

# File: /etc/apparmor.d/local/fusermount3
/etc/himmelblau/himmelblau.conf r,
/var/cache/private/himmelblaud/himmelblau.conf r,
/var/cache/nss-himmelblau/cache.db rk,
@{run}/himmelblaud/socket wr,

Steps to Reproduce

1. Run himmelblau on ubuntu 25.10
2. journalctl --follow
3. try to open an o365 app and observe apparmor denials in the journal

Relevant log output

kernel: audit: type=1400 audit(1769427257.800:352): apparmor="DENIED" operation="open" class="file" profile="fusermount3" name="/etc/himmelblau/himmelblau.conf" pid=9622 comm="fusermount" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
systemd[3658]: app-gnome-o365\x2doutlook-5763.scope: Consumed 18.112s CPU time, 941.5M memory peak.
o365-outlook.desktop[9624]: /home/user/.local/share/teams-for-linux
systemd[3658]: Started app-gnome-o365\x2doutlook-9624.scope - Application launched by gnome-shell.
o365-outlook.desktop[9624]: [teams-wrapper] AppArmor blocks userns and no setuid helper found; adding --no-sandbox (reduced security).
kernel: audit: type=1400 audit(1769427264.509:354): apparmor="DENIED" operation="open" class="file" profile="fusermount3" name="/etc/himmelblau/himmelblau.conf" pid=9656 comm="fusermount" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
o365-outlook.desktop[9657]: fusermount: could not determine username
kernel: audit: type=1400 audit(1769427264.511:355): apparmor="DENIED" operation="open" class="file" profile="fusermount3" name="/etc/himmelblau/himmelblau.conf" pid=9657 comm="fusermount" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
o365-outlook.desktop[9655]: Cannot mount AppImage, please check your FUSE setup.
o365-outlook.desktop[9655]: You might still be able to extract the contents of this AppImage
o365-outlook.desktop[9655]: if you run it with the --appimage-extract option.
o365-outlook.desktop[9655]: See https://github.com/AppImage/AppImageKit/wiki/FUSE
o365-outlook.desktop[9655]: for more information
o365-outlook.desktop[9624]: open dir error: No such file or directory

output observed for `flatpak update`

# output observed for `flatpak update`
dbus-daemon[2645]: [system] Activating via systemd: service name='org.freedesktop.Flatpak.SystemHelper' unit='flatpak-system-helper.service' requested by ':1.154' (uid=xxx pid=8863 comm="flatpak update" label="flatpak (unconfined)")
systemd[1]: Starting flatpak-system-helper.service - flatpak system helper...
dbus-daemon[2645]: [system] Successfully activated service 'org.freedesktop.Flatpak.SystemHelper'
systemd[1]: Started flatpak-system-helper.service - flatpak system helper.
kernel: audit: type=1400 audit(1769421684.411:290): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="fusermount3" name="run/himmelblaud/socket" pid=8884 comm="fusermount3" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=65072
kernel: audit: type=1400 audit(1769421684.412:291): apparmor="DENIED" operation="capable" class="cap" profile="fusermount3" pid=8884 comm="fusermount3" capability=1 capname="dac_override"
kernel: audit: type=1400 audit(1769421684.412:292): apparmor="DENIED" operation="capable" class="cap" profile="fusermount3" pid=8884 comm="fusermount3" capability=7 capname="setuid"
kernel: audit: type=1400 audit(1769421684.412:293): apparmor="DENIED" operation="capable" class="cap" profile="fusermount3" pid=8885 comm="fusermount3" capability=7 capname="setuid"
flatpak[8863]: libostree pull from 'flathub' for runtime/org.freedesktop.Platform.GL.default/x86_64/25.08 complete
 security: GPG: summary+commit 
 security: SIGN: disabled http: TLS
 delta: parts: 6 loose: 3
 transfer: secs: 2 size: 38.3 MB
flatpak[8863]: /var/tmp/flatpak-cache-XQDIJ3/org.freedesktop.Platform.GL.default-I3EIJ3/repo-Ek18Ti: Pulled runtime/org.freedesktop.Platform.GL.default/x86_64/25.08 from flathub
kernel: audit: type=1400 audit(1769421686.911:294): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="fusermount3" name="run/himmelblaud/socket" pid=8897 comm="fusermount3" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=65072
kernel: audit: type=1400 audit(1769421686.912:295): apparmor="DENIED" operation="capable" class="cap" profile="fusermount3" pid=8897 comm="fusermount3" capability=1 capname="dac_override"
kernel: audit: type=1400 audit(1769421686.912:296): apparmor="DENIED" operation="capable" class="cap" profile="fusermount3" pid=8897 comm="fusermount3" capability=7 capname="setuid"
kernel: audit: type=1400 audit(1769421686.912:297): apparmor="DENIED" operation="capable" class="cap" profile="fusermount3" pid=8898 comm="fusermount3" capability=7 capname="setuid"
systemd[1]: var-tmp-flatpak\x2dcache\x2dXQDIJ3-org.freedesktop.Platform.GL.default\x2dI3EIJ3.mount: Deactivated successfully.
kernel: audit: type=1400 audit(1769421686.975:298): apparmor="DENIED" operation="connect" class="file" info="Failed name lookup - disconnected path" error=-13 profile="fusermount3" name="run/himmelblaud/socket" pid=8903 comm="fusermount3" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=65072
kernel: audit: type=1400 audit(1769421686.975:299): apparmor="DENIED" operation="capable" class="cap" profile="fusermount3" pid=8903 comm="fusermount3" capability=1 capname="dac_override"

Version

2.3.2-ubuntu24.04 amd64

Code of Conduct

• I agree to follow this project's Code of Conduct

---

💡 Help Make It Happen!

Want to see this issue resolved faster? Fund its implementation through our Backer's program, where you choose which issues get priority!

For US tax exempt donations:

Your support helps drive Himmelblau’s evolution!

[bash-bandicoot]

We can add an AppArmor profile during installation, but IMO we should stop using the unofficial teams-for-linux package (we use it as a launcher for all other o365 apps) and just move to PWAs created with Chrome policies.
I admit, we will lose some features (system tray, for example), but we will gain much more.

[stendler-mlpa]

Regardless how the o365 apps are packaged, any AppImages or Flatpaks would be impacted without the AppArmor adjustments. imo, the profile would be needed for many users anyway.

[bash-bandicoot]

Agree, but this should not be managed by Himmelblau packages/repo.

[stendler-mlpa]

hmm, since the string himmelblau is part of each of these AppArmor rules, were else should that be managed?

[iLikeToCode]

@stendler-mlpa does that apparmor file you posted above work with himmelblau? I'm happy to add it in and david is happy for me to add ubuntu 25.10 as a build target.

[stendler-mlpa]

@iLikeToCode Yes, it works for me with that on my machine so far. I'm no expert in AppArmor, though. I simply noted the DENIED entries from the auth.log and added them until it worked for my use cases.

Edit: I avoided manipulating the /etc/apparmor.d/fusermount3 which is provided by the distribution. It specifically loads the ones in /etc/apparmor.d/local/fusermount3 (note the /local/).
There may be other ways to do this like adding an abstraction (/etc/apparmor.d/abstractions) with those himmelblau-related rules, that can be referenced in other (local) profiles. That could avoid adding these rules repeatedly for different app profiles or having to change multiple ones in case a new rules needs to be added.

[iLikeToCode]

@stendler-mlpa we already do this for another apparmor rule with unix-chkpwd (the /local/), so I just used the same idea, just a deb asset, and added 25.10 support. Tested and working, waiting for merge.