snap.maas.supervisor DENIED

I'm not sure that this is a snapd bug, it depends on why MAAS is trying to access /dev/sda

Could you paste the output of `snap connections maas`?

I've just noticed similar messages on a MAAS server:

"kernel: [8227300.867247] audit: type=1400 audit(1653363233.557:970746): apparmor="DENIED" operation="open" profile="snap.maas.supervisor" name="/dev/vda" pid=1645448 comm="amd64" requested_mask="r" denied_mask="r" fsuid=0 ouid=0"

"vda" is the root (and only) disk on this particular machine.

We're also seeing this for "/etc/gss/mech.d/":
jsimpso@maas:~$ grep 'apparmor="DENIED"' /var/log/syslog | cut -d ' ' -f 12,13 | sort | uniq
profile="snap.maas.supervisor" name="/dev/vda"
profile="snap.maas.supervisor" name="/etc/gss/mech.d/"

Here's the output of "snap connections maas" as previously requested:
Interface Plug Slot Notes
avahi-observe maas:avahi-observe :avahi-observe -
content[maas-cli] maas:maas-cli maas-cli:maas-cli -
content maas:test-db-socket - -
hardware-observe maas:hardware-observe :hardware-observe -
home maas:home :home -
kernel-module-observe maas:kernel-module-observe :kernel-module-observe -
mount-observe maas:mount-observe :mount-observe -
network maas:network :network -
network-bind maas:network-bind :network-bind -
network-control maas:network-control :network-control -
network-observe maas:network-observe :network-observe -
system-observe maas:system-observe :system-observe -
time-control maas:time-control :time-control -

The /dev/vda error is quite strange, as MAAS should be allowed to access block devices.

For other paths, it could be that apps used inside the maas snap (e.g. nginx, wget, ...) try to access default paths for configs, which are not allowed as they're outside of the snap. This is usually harmless as MAAS has its own configs.

Do you see any wrong behavior in MAAS that could be related to the error?

[Expired for MAAS because there has been no activity for 60 days.]

[Expired for snapd because there has been no activity for 60 days.]

Hi,

I'm not seeing any wrong behaviour in MAAS, but the log spamming is quite bad :
https://pastebin.ubuntu.com/p/jwT9cHy2TT/

$ snap connections maas
Interface Plug Slot Notes
avahi-observe maas:avahi-observe :avahi-observe -
content[maas-cli] maas:maas-cli maas-cli:maas-cli -
content maas:test-db-socket - -
hardware-observe maas:hardware-observe :hardware-observe -
home maas:home :home -
kernel-module-observe maas:kernel-module-observe :kernel-module-observe -
mount-observe maas:mount-observe :mount-observe -
network maas:network :network -
network-bind maas:network-bind :network-bind -
network-control maas:network-control :network-control -
network-observe maas:network-observe :network-observe -
system-observe maas:system-observe :system-observe -
time-control maas:time-control :time-control -

Hi there, can you please provide what version of MAAS you are using and what version of Ubuntu the machine running the snap is using?

Sure ! MAAS snap 3.1.0-10901-g.f1f8f1505, Ubuntu 20.04, kernel 5.4.0-120-generic

MAAS attempts retrieving information that is not available from inside of a snap. This leads to snapd log spam. MAAS should not attempt retrieving such information.

I am running MAAS 3.3.4/3.3.5 and also do see these in the logs.