AppArmor Breaking Flatpak Updates without Error

[RayJW]

AppArmor seems to be causing issues, with Flatpak installs/updates. Weirdly enough, I don't see any logs related whatsoever. Neither in journalctl nor in aa-log. It must be AppArmor related, though, since sudo aa-teardown gets rid of the error.

❯ flatpak update
Looking for updates…

        ID                                    Branch           Op          Remote           Download
 1. [✗] com.heroicgameslauncher.hgl           stable           u           flathub          1.0 kB / 215.6 MB

Error: While pulling app/com.heroicgameslauncher.hgl/x86_64/stable from remote flathub: Unable to write detached metadata: linkat: No such file or directory
Updates complete.

❯ sudo aa-log -R -s

After restarting apparmor.service things still work fine, but a reboot breaks them again, so probably not all profiles get fully reloaded without a reboot, which would kinda make sense I guess.

I am running both a fully updated AppArmor from the Arch repos and apparmor.d-git from the AUR.

[roddhjav]

Can you also provide the result of sudo aa-log -R

[RayJW]

Can you also provide the result of sudo aa-log -R

Those are the results, there is absolutely nothing except a new line. That's why I'm confused :/

[roddhjav]

ok, that was to be sure: in some configuration systemd does not collect auditd. aa-log -R reads logs from audit.log files, not journalctl, and could have given different results.

I have just tested it. I found no issues on my side. Are you sure the problem is because of the apparmor profiles?

[RayJW]

I have just tested it. I found no issues on my side. Are you sure the problem is because of the apparmor profiles?

I'm not really sure, there is no way I found for now to tell for sure. The only thing I know is I set up AppArmor according to the Arch Wiki, installed apparmor.d from the AUR and now after every reboot Flatpak can't do anything, unless I run aa-teardown.

This is the output for flatpak update -v --ostree-verbose.

Updating 4/4…
F: flatpak_dir_pull: Using commit ba10c8449b13c9580116b856e0bf1d2b0aad0efdb9836829a26da1811892584b for pull of ref app/org.tenacityaudio.Tenacity/x86_64/stable from remote flathub
F: Preparing transaction in repository 0x56401e7eaf80
F: Pushing lock non-blocking with timeout 300
F: Push lock: state=unlocked, depth=0
F: Locking repo shared
F: Reusing tmpdir staging-0dad615b-fe50-4746-bf07-b1925c637a9d-NjuaVJ
F: starting fetch of delta index delta-indexes/uh/DIRJsTyVgBFrhW4L8dKwqtDv25g2gpom2hgRiSWEs.index
Updating 4/4…                        0%  0 bytes/s
F: starting fetch of delta superblock deltas/2Z/5JYBc8py43bCt9x4fpbnlnhBrKVf9mSlEOfhpjO+0-uhDIRJsTyVgBFrhW4L8dKwqtDv25g2gpom2hgRiSWEs/superblock
F: _ostree_fetcher_should_retry_request: error: unset, n_retries_remaining: 5
F: Adding GPG keyring data from flathub.trustedkeys.gpg to verifier
F: GnuPG >= 2.1.17, skipping gpg-agent cleanup in /tmp/ostree-gpg-8MS74B
F: _ostree_fetcher_should_retry_request: error: 196:1 Unable to write detached metadata: linkat: No such file or directory, n_retries_remaining: 5
F: Request caught error: Unable to write detached metadata: linkat: No such file or directory
F: pull: idle, exiting mainloop
F: Aborting transaction in repository 0x56401e7eaf80
F: Popping lock non-blocking with timeout 300
F: Pop lock: state=shared, depth=1
F: Unlocking repo
Error: While pulling app/org.tenacityaudio.Tenacity/x86_64/stable from remote flathub: Unable to write detached metadata: linkat: No such file or directory
Updates complete.