snapd

Configure hook in tried snap with ecryptfs: permission denied

Bug #1637596 reported by Kyle Fazzari
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
snapd
Triaged
High
Unassigned

Bug Description

I have a snap that, when installed, has a configure hook that runs. However, that same hook does not run when the snap is being tried as opposed to installed:

    $ sudo snap set snapctl-hooks foo=bar
    error: cannot perform the following tasks:
    - Run configure hook for snapctl-hooks (cannot snap-exec: unable to read hooks directory: open /snap/snapctl-hooks/x1/meta/hooks: permission denied)

Note that I have an encrypted home directory. In syslog I see this:

audit: type=1400 audit(1477673355.022:268): apparmor="DENIED" operation="open" profile="snap.snapctl-hooks.hook.configure" name="/home/.ecryptfs/kyrofa/.Private/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqkJlBFyivegA--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXXtzRh82OVjVmaBO0JsdHlqK7iEk--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqkJlBFyivegA--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXXtzRhhrBZUIEB0brHV1omVyCU.k--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqkJlBFyivegA--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXRhhrBA.pAGc4OcPwbPu1IZnkngk--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqkJlBFyivegA.Wak--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXXtzRhU.DKB3vJS4NnysPO9.RZ1U--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXtzRhCckA-2z2BEUruD7rA-mb0U--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXXtzRhx3Aaudit: type=1400 audit(1477673355.022:269): apparmor="DENIED" operation="open" profile="snap.snapctl-hooks.hook.configure" name="/home/.ecryptfs/kyrofa/.Private/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqkJlBFyivegA--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXXtzRh82OVjVmaBO0JsdHlqK7iEk--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqkJlBFyivegA--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXXtzRhhrBZUIEB0brHV1omVyCU.k--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqkJlBFyivegA--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yIEB0rBA.pAGc4OcPwbPIEB0nkngk--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXfzRq3GXkhDoVeoqA7UZTr7.Wak--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXXtzRhU.DKB3vJSIEB0sPO9.EQj2--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-3yXXtzRhCckA-2z2BEUruD7rA-mb0U--/ECRYPTFS_FNEK_ENCRYPTED.FBaOD17IzZ9EsEQj239cjqBho2j-7yXOcEQj23A<3>[95595.029439] ecryptfs_dir_open: Error attempting to initialize the lower file for the dentry with name [hooks]; rc = [-13]

Zygmunt Krynicki (zyga)
Changed in snappy:
assignee: nobody → Zygmunt Krynicki (zyga)
Kyle Fazzari (kyrofa)
affects: snappy → snapd
Revision history for this message
Zygmunt Krynicki (zyga) wrote :

This bug is being fixed here: https://github.com/snapcore/snapd/pull/2837

Changed in snapd:
status: New → Incomplete
status: Incomplete → In Progress
Revision history for this message
Kyle Fazzari (kyrofa) wrote :

The linked PR was closed: this is no longer in progress. Would be nice to see a fix for it.

Changed in snapd:
status: In Progress → Confirmed
Michael Vogt (mvo)
Changed in snapd:
importance: Undecided → High
status: Confirmed → Triaged
Revision history for this message
Zygmunt Krynicki (zyga) wrote :

Given that we now have improvements to the general machinery of apparmor profiles for specific situations (e.g. the NFS work) we could look at attempting another fix for encrypted home partition.

One more issue that we had last time is that the state does not currently store flags (e.g. try) per revision very well so we may need to be more open if _any_ snap is in try mode. This will need a security review.

Changed in snapd:
assignee: Zygmunt Krynicki (zyga) → nobody
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.