apparmor denials reported for encrypted HOME

This bug was fixed in the package ubuntu-core-launcher - 1.0.29

---------------
ubuntu-core-launcher (1.0.29) yakkety; urgency=medium

  * debian/usr.bin.ubuntu-core-launcher: add workaround rules for ecryptfs
    until the upcoming kernel fix lands everywhere (LP: #1574556)

 -- Jamie Strandboge <email address hidden> Tue, 10 May 2016 12:10:35 -0500

This was fixed in yakkety-- not sure why it wasn't auto-closed.

ubuntu-core-launcher (1.0.29) yakkety; urgency=medium

  * debian/usr.bin.ubuntu-core-launcher: add workaround rules for ecryptfs
    until the upcoming kernel fix lands everywhere (LP: #1574556)

But are we backporting fixes to Xenial?

@Mark,

Yes, that is why I left the Xenial task open. I wanted to bundle this with another bug fix that will be ready soon.

I'm not sure if it's the same bug, but I'm going to comment here.

I'm using an encrypted home folder.
Snapd was working fine for me until recently. Running any snap now fails with the error:

    failed to create user data directory. errmsg: Permission denied

And these three lines are appended to the journal/syslog:

    Jun 13 21:42:32 bruno-laptop audit[7747]: AVC apparmor="DENIED" operation="open" profile="/usr/bin/ubuntu-core-launcher" name="/home/.ecryptfs/bruno/.Private/" pid=7747 comm="ubuntu-core-lau" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
    Jun 13 21:42:32 bruno-laptop kernel: audit: type=1400 audit(1465850552.422:64): apparmor="DENIED" operation="open" profile="/usr/bin/ubuntu-core-launcher" name="/home/.ecryptfs/bruno/.Private/" pid=7747 comm="ubuntu-core-lau" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
    Jun 13 21:42:32 bruno-laptop kernel: ecryptfs_dir_open: Error attempting to initialize the lower file for the dentry with name [/]; rc = [-13]

As I said, it was working fine.
I don't know if this issue appeared in an update or due to something I did (no idea what it could be).
The issue doesn't seem to be specific to snapd, since my custom AppArmor profiles for other stuff were also affected.

I checked the changes done to ubuntu-core-launcher's AppArmor profile in Yakketty, and they almost work for me. The ".Private" folders themselves also needed read access.
I.e.:

    # Workaround https://launchpad.net/bugs/359338 until upstream handles
    # stacked filesystems generally.
    # encrypted ~/.Private and old-style encrypted $HOME
    owner @{HOME}/.Private/ r,
    owner @{HOME}/.Private/** mrixwlk,
    # new-style encrypted $HOME
    owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
    owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,

Forgot to say that I'm using 16.04.

I'm having the same problem as Bruno when trying to launch any snap with an encrypted home partition.

"failed to create user data directory. errmsg: Permission denied"

I've opened a separate bug report for snaps failing with "failed to create user data directory. errmsg: Permission denied". https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1592696

Okay, so as a workaround to this problem, you need to override your $HOME environment variable. Try this:

kirkland@x250:~⟫ sudo /snap/bin/docker run hello-world
failed to create user data directory. errmsg: Permission denied

kirkland@x250:~⟫ sudo HOME= /snap/bin/docker run -it ubuntu bash
root@cb0a9845a6fe:/#

This is fixed in xenial-updates