microk8s: snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks

@a1exus you can also fix it with

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*

According to the conversation in [Ubuntu Forum], this particular answer, fixed my problem.

So, just install apparmor if don’t have it already, and then enable it by: systemctl enable --now apparmor.service

Note: For some reasons, it asks for password multiple times. In my case, 5 times!! Don’t give up! 😃

1. Check if snap core is not broken $ snap list
2. Update the following package A. apparmor $ sudo apt-get install apparmor

Now everything will work

sudo systemctl enable --now apparmor.service

fixed the issue for me. Asked for password once 👅

The same error occurs if apparmor service stopped or disabled.

@a1exus you can also fix it with

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*

@dxas90 after running this I got cannot change profile for the next exec call: No such file or directory trying to up docker containers.

According to the conversation in [Ubuntu Forum], this particular answer, fixed my problem.

So, just install apparmor if don’t have it already, and then enable it by: systemctl enable --now apparmor.service

Note: For some reasons, it asks for password multiple times. In my case, 5 times!! Don’t give up! 😃

fixed my problem thanks ^_^

@a1exus you can also fix it with

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*

@dxas90 after running this I got cannot change profile for the next exec call: No such file or directory trying to up docker containers.

sudo apt install apparmor-utils apparmor-profiles
sudo apparmor_parser --add /var/lib/snapd/apparmor/profiles/snap.mirok8s.*
sudo systemctl enable --now apparmor.service
sudo systemctl enable --now snapd.apparmor.service

Yep, that did it. Open /lib/apparmor/rc.apparmor.functions and look for the line ADDITIONAL_PROFILE_DIR= and paste your snapd profile directory into that line. For me, the profile directory was /var/lib/snapd/apparmor/profiles/.

Had same issue too after dist-upgrade today (all snaps didn’t started), reinstalling apparmor and snapd did not helped…

After running “sudo apparmor_parser…” suggested here there was another error (exact same like @HassanAmed posted). And after some digging deeper got working snaps with sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/* It turns out that you should do this every time after reboot… and because of that i’ve found what caused all trouble:

○ snapd.apparmor.service - Load AppArmor profiles managed internally by snapd Loaded: loaded (/lib/systemd/system/snapd.apparmor.service; disabled; vendor preset: disabled) Active: inactive (dead)

So finally systemctl enable --now snapd.apparmor.service fixed this for good. Hope this helps somebody.

Note: I think that if sudo apparmor_parser -r /etc/apparmor.d/*snap-confine* helps to fix your issue than reinstalling could fix this with high chances

@a1exus you can also fix it with

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*

This works for me, but I have to do it after every reboot

kali

The minimum number of files needed to have their definitions replaced (at least on Kali) is:

# Generic
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-update-ns.*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine.snapd.14066

# Example For Discord
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-update-ns.discord
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.discord.discord
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine.snapd.14066

The real question is, how do I get it to stay fixed across reboots and how do I do this without requiring root privileges?

i have the same issue. basically all snap apps doesn’t work

1. check if snapd is running service snapd force-reload or systemctl restart snapd apparmor is fine. no changes and also tried the profile changing, and this happened WARNING: cgroup v2 is not fully supported yet, proceeding with partial confinement cannot change profile for the next exec call: No such file or directory snap-update-ns failed with code 1
2. i try to install some apps on snap. and it works fine
3. apt remove snapd|apt install snapd is not my option i have limited screentime online every bytes is gold
4. i’ve been hovering around on some forums. and most of them were Kali, Fedora, Linux Mint basically distributions that doesn’t have snapcraft pre-installed like pop_os, manjaro, ubuntu
5. i’ve mentioned that i installed another package from snap, and it was ‘bombsquad’… it works fine but has some casual hiccups like audio errors…

Solved it with sudo snap refresh