AppArmor warning

[unquietwiki]

Apr 23 15:01:55 SERVERNAME kernel: [ 3779.701436] audit: type=1400 audit(1524520915.033:85): apparmor="DENIED" operation="open" profile="snap.jenkins.jenkins" name="/lib64/" pid=1251 comm="java" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Apr 23 15:01:55 SERVERNAME kernel: [ 3779.710683] audit: type=1400 audit(1524520915.045:86): apparmor="DENIED" operation="open" profile="snap.jenkins.jenkins" name="/proc/1251/mounts" pid=1251 comm="java" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Apr 23 15:01:55 SERVERNAME kernel: [ 3779.711275] audit: type=1400 audit(1524520915.045:87): apparmor="DENIED" operation="open" profile="snap.jenkins.jenkins" name="/etc/pam.d/sshd" pid=1251 comm="java" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Apr 23 15:01:55 SERVERNAME kernel: [ 3779.711280] audit: type=1400 audit(1524520915.045:88): apparmor="DENIED" operation="open" profile="snap.jenkins.jenkins" name="/etc/pam.d/other" pid=1251 comm="java" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Apr 23 15:02:22 SERVERNAME kernel: [ 3807.427852] audit: type=1400 audit(1524520942.761:89): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/nmbd" pid=2044 comm="apparmor_parser"
Apr 23 15:02:22 SERVERNAME kernel: [ 3807.544842] audit: type=1400 audit(1524520942.877:90): apparmor="STATUS" operation="profile_replace" profile="unconfined" name="/usr/sbin/smbd" pid=2048 comm="apparmor_parser"

https://github.com/snapcore/snapd/wiki/Snap-Execution-Environment has some guidance on this; but might have to do with #5 ?

[kz6fittycent]

@unquietwiki if you're still using the Jenkins snap, do you mind confirming that the latest release for Jenkins resolved this issue? I know this may no longer be valid, but I'm just ensuring that we circled back w/ you on this.

[unquietwiki]

Hey @kz6fittycent , thanks for checking back. I'm not (trying to) use the snap anymore; and I wonder if things would be different now on a newer version of Ubuntu. If you want my help testing it again, I can fire up a VM.

[kz6fittycent]

If you're willing to do that just to do a sanity check against the latest version, it'd be much appreciated!

[unquietwiki]

@kz6fittycent Okay, so fired up an Ubuntu 22.04.3 VM, and installed the snap with the "--classic" option per its request. Appears to run just fine now. Let me know if you want me to do any other tests.

[kz6fittycent]

Thanks @unquietwiki!! I think this will suffice and we'll go ahead and close this issue as resolved.

Maybe the snap will find its way back into your workflow :)

[unquietwiki]

@kz6fittycent no problem, and yeah I will consider it for future workflows!