From 0e58e3d7fb35ac898cc07fd461f878786851dd09 Mon Sep 17 00:00:00 2001 From: Ryan Lee Date: Mon, 18 Aug 2025 12:06:29 -0700 Subject: [PATCH] profiles: add /run/snapd.socket rule for curl This ideally is a temporary fix because we do not want to allow all users of curl to be able to access the snapd socket. However, this will work for now until we can mediate the accesses better. Fixes: LP: #2120669 Signed-off-by: Ryan Lee --- profiles/apparmor.d/curl | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/profiles/apparmor.d/curl b/profiles/apparmor.d/curl index cbee547fe..db63bd4db 100644 --- a/profiles/apparmor.d/curl +++ b/profiles/apparmor.d/curl @@ -42,6 +42,10 @@ profile curl /usr/bin/curl { network inet6 stream, network inet6 dgram, + # Allow access to the snap socket until we can revisit it with delegation + # or profile refactoring + file rw @{run}/snapd.socket, + # Site-specific additions and overrides. See local/README for details. include if exists }