Snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks

Question

I have been using snap for some time but after a recent upgrade, I get this error when I try opening any application

Snap-confine has elevated permissions and is not confined but should be.
Refusing to continue to avoid permission escalation attacks

I have tried various fixes but it keeps getting worse. Any idea on what I should do?

I also tried sudo apt purge snapd snap-confine && sudo apt install -y snapd but when I try opening pycharm-community, it doesn't do anything.

Don't try using this command: `sudo apt purge snapd snap-confine` That will uninstall a lot of applications and that's not what you normally want. — Esteban Camargo, Feb 21 '22 at 14:34

score 64 · Answer 1 · answered Feb 10 '22 at 12:42

64

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*

Fixes it. No restart required.

answered Feb 10 '22 at 12:42

Diego V

6,189
7
40
45

After power failure i can't start slack, vscode. This advice was helpfull for me. Ubuntu 21.10 – Sergio Belevskij Feb 16 '22 at 09:15
1

**It doesn't work for me**, now it says *"cannot change profile for the next exec call: No such file or directory"*. I did previously due to another error `apparmor_parser -r /etc/apparmor.d/*snap-confine*` `apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*` now with this asnwer it's still broken. keep on search – Rodrigo May 28 '22 at 15:36
This is working for me but temporarily. After reboot, the same problem pursues, and I have to run these commands again. Is there a permanent solution ? – null Aug 18 '22 at 07:24
1

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine* was enough for me! – Kjeld Flarup Aug 29 '22 at 05:46

score 23 · Answer 2 · edited Nov 23 '21 at 00:50

23

This worked for me

service snapd.apparmor start

(It needs the root.)

edited Nov 23 '21 at 00:50

Jeremy Caney

7,102
69
48
77

answered Nov 22 '21 at 19:54

pasha5

331
1
2

I tried that but every after I restart my system the error reoccurs. – ROOT-X17 Nov 23 '21 at 22:12
2

@ROOT-X17 `sudo systemctl start snapd.apparmor` should mark this service to auto-start – SukiCZ Feb 28 '22 at 12:05
This one perfectly worked on me. Thank you – eyup.tatar Jun 20 '22 at 15:57

Yilmaz · Answer 3 · 2022-12-10T02:24:34.487

From https://apparmor.net/

AppArmor (app-armor) is an effective and easy-to-use Linux application security system. AppArmor proactively protects the operating system and applications from external or internal threats, even zero-day attacks, by enforcing good behavior and preventing both known and unknown application flaws from being exploited.

    # start the appormor system
    sudo systemctl start apparmor 
    # parse and reload all apparmor profiles of installed snap applications 
    sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/*

Pavlikooo · Accepted Answer · 2021-11-28T07:39:49.807

11

systemctl enable --now apparmor.service    
systemctl enable --now snapd.apparmor.service

from here

edited Nov 28 '21 at 07:39

answered Nov 28 '21 at 07:32

Pavlikooo

176
1
5

you need to add **sudo** before both commands if you are not authorized user. – Harun Cetin Jul 12 '23 at 07:39

score 4 · Answer 5 · edited Aug 01 '22 at 03:58

4

This is what worked for me on Kali Linux:

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*
systemctl enable --now snapd.apparmor.service

edited Aug 01 '22 at 03:58

Jeremy Caney

7,102
69
48
77

answered Jul 28 '22 at 09:34

Bright Musanya

41
4

Worked on my Xubuntu 22.04, too. I tried the other approaches below but they didn't help. – Till Kolditz Oct 21 '22 at 14:00
This worked for me (Ubuntu 22.04.2 LTS). – Harun Cetin Jul 12 '23 at 07:32

score 2 · Answer 6 · edited Mar 18 '23 at 11:14

2

This command helped me fix docker-compose:

sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/*

You can check if docker-compose works by using command:

docker-compose version

edited Mar 18 '23 at 11:14

Tyler2P

2,324
26
22
31

answered Mar 13 '23 at 11:48

ayushaks

21
2

score 1 · Answer 7 · answered Feb 28 '22 at 00:37

In my case it was caused by a bad AppArmor profile being present and loaded in complain (or enforce?) mode in

/etc/apparmor.d/usr.bin.snap

This apparently lead to snap not being able to determine the number of the snap and therefor caused a bad profile to be added to AppArmor.

"aa-status" outputed lines such as:

/usr/bin/snap//null-/usr/lib/snapd/snap-confine

for being in enforce mode

I moved that file (/etc/apparmor.d/usr.bin.snap) to my home directory, ran "sudo aa-remove-unknown" and "sudo systemctl restart apparmor" after which everything was back to normal.

However I don't know the origins of /etc/apparmor.d/usr.bin.snap so keep in mind that there might be something wrong with the system.

score 1 · Answer 8 · answered Mar 31 '22 at 23:29

1

I had the same problem when using snap to run scrcpy. I tried this suggestion first and it worked:

sudo snap refresh

(This suggestion found at https://github.com/canonical/microk8s/issues/249)

answered Mar 31 '22 at 23:29

django

11
1

score 0 · Answer 9 · answered Jun 17 '22 at 13:25

0

This command also worked in my case :-

$ sudo service snapd.apparmor start
$ whatsdesk

Thank you.

answered Jun 17 '22 at 13:25

Akash Kumar

29
1
1
8

score 0 · Answer 10 · answered Jul 25 '22 at 13:45

0

What is really works is pavlikoo's answer

But in some cases, it also would be better to execute first:

sudo systemctl enable snapd

And don't forget to add sudo to pavlikoo's commands if you don't have special permissions.

answered Jul 25 '22 at 13:45

Николай

73
1
5

score 0 · Answer 11 · answered Nov 20 '22 at 23:33

Indeed AppArmor was not running. Some other bug in AppArmor will disable the whole snap! This has to be fixed before AppArmor can start.

Nov 21 00:24:40 kfc-XPS-15-9560 apparmor.systemd[201673]: AppArmor parser error for /etc/apparmor.d/usr.bin.tcpdump in profile /etc/apparmor.d/usr.bin.tcpdump at line 64: Could not open 'local/usr.sbin.tcpdump'

score 0 · Answer 12 · answered Dec 02 '22 at 12:40

For me after executing

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*
sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap-confine*

i got an error of:

missing profile snap.docker.compose.
Please make sure that the snapd.apparmor service is enabled and started

It was fixed with

sudo apparmor_parser -r /var/lib/snapd/apparmor/profiles/snap.docker.compose

following this askubuntu thread: https://askubuntu.com/questions/1248349/docker-compose-denied-by-apparmor-outside-of-home-how-to-fix

score 0 · Answer 13 · answered Jun 13 '23 at 14:33

0

sudo systemctl enable snapd.service   
sudo systemctl start snapd.service
service snapd.apparmor start

answered Jun 13 '23 at 14:33

Igor Pomelnikov

21
1

1

You should add explanation. – Super Kai - Kazuya Ito Jun 14 '23 at 06:04

Snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks

13 Answers13

Linked