desktop: AppArmor policy error accessing password manager
This is a duplicate of https://github.com/desktop/desktop/issues/5606, as requested here.
Description
Can’t login to GitHub using the snap version of GitHub Desktop.
Version
$ snap info github-desktop name: github-desktop summary: Extend your GitHub workflow beyond your browser with GitHub Desktop publisher: Snapcrafters contact: https://github.com/snapcrafters/github-desktop/issues license: unset description: | Extend your GitHub workflow beyond your browser with our Desktop, completely redesigned with Electron. Get a unified cross-platform experience that's completely open source and ready to customize. commands: - github-desktop snap-id: vxuDrMy9vuqIU5Abf2MQOowf2e09tcm9 tracking: edge refresh-date: today at 15:50 EDT channels: stable: – candidate: – beta: – edge: 1.3.4 (31) 140MB - installed: 1.3.4 (31) 140MB -* Operating system:$ neofetch --off nato@HelionUbuntu ----------------- OS: Ubuntu 18.04.1 LTS x86_64 Kernel: 4.15.0-34-generic Uptime: 4 hours, 44 mins Packages: 2148 Shell: bash 4.4.19 Resolution: 1920x1080 DE: GNOME 3.28.3 WM: GNOME Shell WM Theme: Adwaita Theme: Adwaita-dark [GTK2/3] Icons: Ubuntu-mono-dark [GTK2/3] Terminal: gnome-terminal CPU: Intel i5-3570K (4) @ 4.100GHz GPU: NVIDIA GeForce GTX 660 Ti Memory: 6003MiB / 7922MiBSteps to Reproduce
1. `sudo snap install github-desktop --edge` 2. Open GitHub Desktop. It takes a while the first time. 3. LoginExpected Behavior
The login completes successfully.
Actual Behavior
The login fails with the following message :
An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.291" (uid=1000 pid=22162 comm="/snap/github-desktop/31/opt/GitHubDesktop/desktop " label="snap.github-desktop.github-desktop (enforce)") interface="org.freedesktop.Secret.Service" member="OpenSession" error name="(unset)" requested_reply="0" destination=":1.20" (uid=1000 pid=1732 comm="/usr/bin/gnome-keyring-daemon --daemonize --login " label="unconfined").Additional Information
I believe it’s because of an undeclared capability in the app. It should be as simple as modifying the
package.jsonfile by adding an interface.Logs
… and I noticed I reported at the wrong place. There’s already snapcrafters/github-desktop#9.
Edit
Solution :
sudo snap connect github-desktop:password-manager-service
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Comments: 16 (6 by maintainers)

With the help of the Snapcraft team, I’ve now been able to publicize the app again on the Snapcraft store now the enclosures are migrated. It is recommended to install the
betachannel currently if you are working from a fresh install.For existing installs the
edgechannel will remain using thestrictenclosure for the moment, and refreshing to the latest version there will ask you to install thebetachannel, which is using theclassicenclosure and requires a manual upgrade:@bb441db It works!
Can you try running the following command and see if that fixes it? (assuming desktop is the snap’s name.)
See: https://forum.snapcraft.io/t/nextcloud-client-snap-app-armor-issue/4366/4
If this fixes it, we should add this to the snap.
For the moment I’m going to leave this open to address these three things:
write some notes in the install guide for Snap to indicate the#93connectstep is important here@ipkpjersi I believe this is something that’s a security measure we’ve encountered - this document suggests that the permission we had for
password-manager-serviceis not auto-connect, which means the user likely needs to connect the app to be able to read/write credentials.This worked on my machine with the latest build:
sudo snap connect github-desktop:password-manager-service- I was able to sign in fine after that.The previous Snap version had the “classic” confinement (which meant it wasn’t confined at all) so I’m not surprised it was much better. Releasing packages with this setting required approval from Snapcraft to do, and isn’t something they encourage. This version now uses the “strict” confinement, which is important for many reasons, but I suspect we’ll have some more tweaks to the config to get it working smoothly.
It’s not clear to me how to correlate errors like this to the right interfaces/plugs, so any pointers from those more experienced with Snap packaging would be greatly appreciated. cc @flexiondotorg
I can deploy to the Edge channel pretty in about an hour, and that’s what I’ve been working towards over the last few weeks in my spare time. The hold up has been around getting permissions to publish to the existing package in the store (this wasn’t started by me) but it was enabled in the last 24 hours.
Looks like I regressed this with the newest Snap on the store (
1.5.0-linux5)See https://github.com/shiftkey/desktop/issues/68
Should be fixed in a newer release, I don’t think it’s in the snapcraft repos yet.