[snap] unable to read /proc/pressure/{cpu,io,memory}

Bug #2017011 reported by Simon Déziel
20
This bug affects 4 people
Affects Status Importance Assigned to Milestone
chromium-browser (Ubuntu)
Triaged
Low
Unassigned

Bug Description

During normal operation, chromium wants to read /proc/pressure/{cpu,io,memory} but is denied by the Apparmor policy:

$ journalctl -b0 -k --grep 'chromium.chromium' | grep -F 'name="/proc/pressure/'
Apr 19 10:40:27 sdeziel-lemur kernel: audit: type=1400 audit(1681915227.726:817): apparmor="DENIED" operation="open" class="file" profile="snap.chromium.chromium" name="/proc/pressure/cpu" pid=395005 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Apr 19 10:40:27 sdeziel-lemur kernel: audit: type=1400 audit(1681915227.726:818): apparmor="DENIED" operation="open" class="file" profile="snap.chromium.chromium" name="/proc/pressure/io" pid=395005 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Apr 19 10:40:27 sdeziel-lemur kernel: audit: type=1400 audit(1681915227.726:819): apparmor="DENIED" operation="open" class="file" profile="snap.chromium.chromium" name="/proc/pressure/memory" pid=395005 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0

Note that simply starting the browser doesn't prompt it try and read those files, you need to do something more involving like watching Youtube for example.

Additional information:

$ snap list chromium core20
Name Version Rev Tracking Publisher Notes
chromium 112.0.5615.49 2424 latest/stable canonical✓ -
core20 20230308 1852 latest/stable canonical✓ base

$ lsb_release -rd
Description: Ubuntu 22.04.2 LTS
Release: 22.04

$ uname -a
Linux sdeziel-lemur 5.19.0-40-generic #41~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 31 16:00:14 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Changed in chromium-browser (Ubuntu):
status: New → Triaged
importance: Undecided → Low
tags: added: focal
tags: added: jammy
tags: added: log-noise
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.