Permission denied error when running apps installed as snap packages - Ubuntu 17.04

Question

I get Permission denied error when running a snap application, where my home directory is mounted on an nfs mount point that does not allow root-write. This is not an unusual configuration, so I consider this a bug.

The error message:

cannot create user data directory: /home/tcumming/snap/vlc/4: Permission denied

Also had the same problem with ubuntu 16.

Some more info as requested:

Using the ubuntu, "Ubuntu Software" I install a snap application (for example, vlc). When I attempt to run it (from the command line), I get the, "Permission denied" message above.

I had just reinstalled Ubuntu on the machine, so there has been no messing around with the OS. I did preserve my uid:gid so I could mount my prior nfs share.

This is not a problem with the mount point, or nfs. Our mount point is not root-writeable for security reasons.

I guess the question is, should I file a bug report? What are my next steps?

I am going to guess if you file a bug report it will be marked invalid as it is a configuration problem with nfs and the mount point and not a bug but you can try. — Panther, Jun 29 '17 at 21:02
Could you please add a little more detail? What exactly did you do, what did you want to achieve and what happened instead? Did you encounter any warning or error messages? Please reproduce them in their entirety in your question. You can select, copy and paste terminal content and most dialogue messages in Ubuntu. (see How do I ask a good question?) — David Foerster, Jun 30 '17 at 06:23

score 28 · Answer 1 · edited Sep 03 '21 at 17:21

28

I ran into this because my home directory is symlinked from /home/$USER to another mount point. I fixed it with the suggestion from when /home is somewhere else, snaps don't work.

In short, you need to add your non-standard home directory to apparmor's HOMEDIRS variable:

$ sudo dpkg-reconfigure apparmor

or: create a file in /etc/apparmor.d/tunables/home.d/ that points to your home directory's mount point:

@{HOMEDIRS}+=/mnt/hdd/.home/

Then, just for good measure, you should delete apparmor's cache and reboot:

$ sudo rm -f /etc/apparmor.d/cache/* /var/cache/apparmor/snap.*
$ sudo reboot

edited Sep 03 '21 at 17:21

Greenonline

2,081

answered Jul 08 '19 at 22:33

Jonathan Perry-Houts

531

2

Also works for non-standard home locations (w/o symlinks) like /home/DOMAIN/user – Anton Zaviyalov Feb 18 '20 at 07:33
4

didn't work for me... – polynomial_donut Mar 29 '20 at 22:32
2

Worked for me only after rebooting. I used the first option and wrote the two directories separated by space, e.g. /home/carlos /mnt/data – Carlos Pinzón Jul 09 '22 at 18:57
this worked for Ubuntu 20.04.6 LTS x86_64 too, all the sanp packages were not running. after this process, the saved data was removed, i guess because i removed the cached. but I will reconfigure again, so thank you so much @Jonathan – Rakibul Haq May 18 '23 at 15:59

score 23 · Answer 2 · answered Apr 30 '18 at 11:25

23

Same happens in Ubuntu 18.04.

If the user home directory is not under the /home (or /) mount, it not possible to work with snap. My HOMEDIR was on another local SSD disk, but since it was not mounted under /home, every package installed by snap was failing.

Since Canonical is moving to support snap, you will have to loose this kind of nice things, such as HOMEDIRs on other file systems, mounted by NFS, etc.

Maybe snap will be more flexible inthe future, but it is not a priority: https://forum.snapcraft.io/t/how-can-i-use-snap-when-i-dont-use-home-user/3352/6

The workaround right now is to remove snap and install things from *.tar.gz or from *.deb packages.

answered Apr 30 '18 at 11:25

estibordo

1,294

36

So far snap = worst idea ever. Too soon :-p – akahunahi May 12 '18 at 00:48
4

This is really sad and close to a showstopper, especially for huge deployments where $HOME resides on NFS or CIFS shares mounted via autofs-ldap. – Sebastian Stark Jun 09 '18 at 13:33
2

"Since Canonical is moving to support snap, you will have to loose this kind of nice things, such as HOMEDIRs on other file systems, mounted by NFS, etc."
I don't think canonical is going to convince people running Ubuntu in commercial/business environments to stop using centralised network mounted home directories in favor of local ones just so they can use "snap packages"...
– Dean Jul 30 '18 at 12:43
1

SSD/HD PCs are all too common nowadays. Many (but not all!) of my /snap/bin/ commands would fail with the misleading "permission denied" error with the input files and the problem could not be resolved by messing with file permissions but by removing the /snap/ package and re-installing them with apt! (Ubuntu 18.04) – SYK Oct 10 '18 at 04:58
2

This question, or its cause, is totally underrated in my book. It can't be low priority that things don't work for a major part of the userbase. – SeveQ Nov 23 '18 at 08:50
I am here Sep 2020, after installing the youtube-dl snap on Ubuntu Budgie 20.04. The youtube-dl .deb was out of date to start with and snap still refuses to write on the data directory (not under /home) I worked around this with a function for now, but I will change to a virtualenv and pip install with a regular update on the first sign of further problems (or revert to Solus which has an up-to-date youtube-dl package). – Anthon Sep 18 '20 at 08:31

score 10 · Answer 3 · edited Aug 31 '21 at 05:05

10

You can set the permissions of the Snap Application from the Software Store.

The following steps are tested on Ubuntu 20.04 LTS:

Open Software
Select the Installed tab. A list of installed software will appear.
Select the snap package which needs elevated permissions.
On the detailed view, click the 'Permissions' button.
Click on the toggle next to 'Read/write files on removable storage devices'.

This method works for mounted harddisks.

References:

edited Aug 31 '21 at 05:05

severecci

103

answered Jan 13 '19 at 04:30

Fabian de Boer

101

1

Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Kevin Bowen Jan 13 '19 at 05:07

score 6 · Answer 4 · answered Aug 23 '17 at 08:58

Snap apps are confined to a sandbox by default, for security. If you want snap applications to be able to read/write data in your home directory, you should install them in classic mode. Try:

rclone install --classic vlc

This should work for you.

If application sandboxing is a concern, then you might want to look into firejail.

Felipe Oliveira · Answer 5 · 2022-12-14T22:32:28.043

4

We use domain with realm, so our path home is not /home, instead /home/MYDOMAINCOMPANY/. I fixed by editing /etc/apparmor.d/tunables/home.d/ubuntu with that line: @{HOMEDIRS}+=/home/MYDOMAINCOMPANY/

After save, just restart some services: systemctl restart apparmor.service snapd.apparmor.service snapd.service snapd.socket

edited Dec 14 '22 at 22:32

answered Dec 14 '22 at 22:31

Felipe Oliveira

41

works in 22.04. – Jeyan Jul 18 '23 at 08:38

score 1 · Answer 6 · answered Jun 16 '21 at 17:44

apparmor workaround did not work for me. What worked was these steps for my current home directory "/opt/stack"...

mkdir -p /home/stack
edit /etc/fstab with "/opt/stack /home/stack none defaults,bind 0 0"
mount -a

"mount -a" tells if there are any issues with fstab entries. No need to reboot after making changes to fstab.

score 0 · Answer 7 · answered Jul 09 '20 at 23:19

I ended up on this AskUbuntu page after getting "Permission denied" (accessing /media) error when trying to open the *.srt file of a movie stored on a USB stick. Unusually, I didn't find a really simple answer here, but then I found this on the Github Subsync page...

sudo snap connect subsync:removable-media

So if I end up here again with the same basic problem I'll be able to figure out for myself how to replace subsync there with [other snap-installed package with same problem].

I don't know if there are any alternatives to removable-media that might also be useful. But if anyone else does know, here would be a good place to put that information - for me, and perhaps others.

Vasya Pupkin · Answer 8 · 2021-09-01T19:36:46.060

All non-privileged users were getting this error with all snaps on Ubuntu 20.04. Adding users to group adm fixed the problem. But that's definitely not a solution. Any ideas why snap apps require that?

Update:

Looks like it was related to my setup. I have the following permissions for /home:

drwxr-x--x 13 root         adm          4096 Sep  1 14:12 /home

And this is permissions for example user home directory:

drwxr-xr-x  7 kubetraining kubetraining 4096 Sep  1 16:39 /home/kubetraining

Apparently, snap tries to list /home, fails, and errors out. But it really shouldn't try to list anything in /home, so it looks like a bug to me.

score 0 · Answer 9 · answered Jan 09 '22 at 21:26

I experienced the same problem on 20.04 trying to get the github cli (gh) installed via snap to clone a repo over ssh. In the Ubuntu Software entry for gh, I needed to enable ssh-keys: allows reading ssh user configuration and keys. There is also the option to Access files in your home folder.

score 0 · Answer 10 · answered Sep 06 '23 at 03:55

0

/tmp was a symlink. Making /tmp not a symlink fixed it for me.

answered Sep 06 '23 at 03:55

bbrendon

131

Could you expand on your answer please? – Will Sep 07 '23 at 21:28
@Will Hi Will. Reading this thread made me think that anything symlink related could break snap. So I dug around and found /tmp was. In my setup it was easy to convert from symlink to actual directory. – bbrendon Sep 08 '23 at 19:42

score 0 · Answer 11 · answered Oct 27 '23 at 10:13

I just wanted to comment on Fabian de Boer's answer, but I do not have enough reputation.

His solution solved my problem where OpenSCAD did not open files on another drive. So there could be this 'Permission denied' problem not only with home directory being elsewhere, but also the working directory being elsewhere.

Anyway the mentioned solution works.

Permission denied error when running apps installed as snap packages - Ubuntu 17.04

11 Answers11

Linked