AppArmor mountinfo permission denied error with snap

[pahowart]

Hi, I tried the SNAP install on a fresh Ubuntu 24.04 build using a Proxmox VM. The installation completes, but Ellacore fails to start due to Apparmour issues. I don't normally use SNAP, is there a specific Kernel version that it requires?

Here is the log.

ellacore@allacore:$ uname -r
sudo dmesg | grep -i 'apparmor.*DENIED' | tail
6.8.0-136-generic
[10634.629404] audit: type=1400 audit(1785122224.868:128): apparmor="DENIED" operation="mount" class="mount" info="failed mntpnt match" error=-13 profile="snap-update-ns.ella-core" name="/boot/" pid=2294 comm="snap-update-ns" srcname="/var/lib/snapd/hostfs/boot/" flags="rw, bind"
[12345.994290] audit: type=1400 audit(1785123936.310:129): apparmor="DENIED" operation="capable" class="cap" profile="snap.ella-core.cored" pid=3061 comm="core" capability=24 capname="sys_resource"
[12346.404191] audit: type=1400 audit(1785123936.719:130): apparmor="DENIED" operation="capable" class="cap" profile="snap.ella-core.cored" pid=3100 comm="core" capability=24 capname="sys_resource"
[12347.438639] audit: type=1400 audit(1785123937.754:131): apparmor="DENIED" operation="capable" class="cap" profile="snap.ella-core.cored" pid=3180 comm="core" capability=24 capname="sys_resource"
[12347.942502] audit: type=1400 audit(1785123938.258:132): apparmor="DENIED" operation="capable" class="cap" profile="snap.ella-core.cored" pid=3219 comm="core" capability=24 capname="sys_resource"
ellacore@allacore:$ uname -r
6.8.0-136-generic

[gruyaume]

Hello @pahowart ,

Thanks for reaching out.

Have you followed the installation instructions? The snap is strictly confined and you will need to connect it to the appropriate interfaces:

sudo snap install ella-core
sudo snap connect ella-core:network-control
sudo snap connect ella-core:process-control
sudo snap connect ella-core:system-observe
sudo snap connect ella-core:firewall-control

If it still fails, can you provide the logs:

sudo snap logs ella-core.cored

[pahowart]

Thanks for the reply. Yes I followed the installation instructions line by line including setting up the N2, N3 and N6 interfaces in the configuration file.

Here is the requested log.

ellacore@allacore:~$ sudo snap logs ella-core.cored
2026-07-27T03:48:07Z ella-core.cored[3821]: {"level":"info","ts":"2026-07-27T03:48:07.493Z","caller":"api/api.go:176","msg":"API server started","component":"API","scheme":"https","address":"0.0.0.0:5002"}
2026-07-27T03:48:07Z ella-core.cored[3821]: {"level":"error","ts":"2026-07-27T03:48:07.499Z","caller":"ebpf/objects.go:170","msg":"failed to load eBPF program","component":"UPF","error":"assign values: field UpfDownlinkFunc: program upf_downlink_func: map downlink_statistics: load BTF: detect support for Map BTF (Var/Datasec): detect support for BTF: apply token attributes: get token: get bpffs mounts: open mountinfo: open /proc/self/mountinfo: permission denied"}
2026-07-27T03:48:07Z ella-core.cored[3821]: {"level":"error","ts":"2026-07-27T03:48:07.499Z","caller":"ebpf/objects.go:117","msg":"failed to load N3/N6 program","component":"UPF","error":"assign values: field UpfDownlinkFunc: program upf_downlink_func: map downlink_statistics: load BTF: detect support for Map BTF (Var/Datasec): detect support for BTF: apply token attributes: get token: get bpffs mounts: open mountinfo: open /proc/self/mountinfo: permission denied"}
2026-07-27T03:48:07Z ella-core.cored[3821]: {"level":"fatal","ts":"2026-07-27T03:48:07.499Z","caller":"upf/upf.go:111","msg":"Loading bpf objects failed","component":"UPF","error":"assign values: field UpfDownlinkFunc: program upf_downlink_func: map downlink_statistics: load BTF: detect support for Map BTF (Var/Datasec): detect support for BTF: apply token attributes: get token: get bpffs mounts: open mountinfo: open /proc/self/mountinfo: permission denied"}
2026-07-27T03:48:07Z systemd[1]: snap.ella-core.cored.service: Main process exited, code=exited, status=1/FAILURE
2026-07-27T03:48:07Z systemd[1]: snap.ella-core.cored.service: Failed with result 'exit-code'.
2026-07-27T03:48:07Z systemd[1]: snap.ella-core.cored.service: Scheduled restart job, restart counter is at 5.
2026-07-27T03:48:07Z systemd[1]: snap.ella-core.cored.service: Start request repeated too quickly.
2026-07-27T03:48:07Z systemd[1]: snap.ella-core.cored.service: Failed with result 'exit-code'.
2026-07-27T03:48:07Z systemd[1]: Failed to start snap.ella-core.cored.service - Service for snap application ella-core.cored.

[gruyaume]

Hello @pahowart , thanks for the logs.

We reproduced your issue and found the root cause.

There was a recent change in the ebpf golang library Ella Core uses (see https://github.com/cilium/ebpf/releases/tag/v0.22.0) to integrate with the kernel eBPF environment. The lib now reads /proc/self/mountinfo to enumerate bpffs mounts, so it can create BPF objects with only CAP_BPF instead of full privileges. The snap is strictly confined and can only access directories and perform actions it is explicitely allowed to. Reading from mountinfo was not one of these already allowed actions.

I just released Ella Core v1.15.0, its snap now includes the mount-observe plug, which enables the snap to read mount table information.

From your broken v1.14 deployment, you can run the following:

sudo snap refresh ella-core --channel=1.15/stable
sudo snap connect ella-core:mount-observe
sudo snap restart ella-core.cored

If you start from scratch, the installation instructions have also been updated to include the new connection.

[pahowart]

Thanks for investigating. I ended up building from source to move forward with testing. I will do a fresh install using the SNAP package later this week and confirm that it was successful.