Tool for debugging snap confinement policy violations
Snap developers can use this tool to help them debug and fix policy violations.
Each snap runs confined inside its own sandbox. The policy of each sandbox describes what the application is allowed to do. When an application tries to do something that is not allowed, the system logs a policy violation.
This snap
- watches syslog for such policy violations,
- shows them in a human readable format,
- and makes recommendations for how to solve them.
Run the following command to start watching policy violations.
sudo snappy-debug
If you have dropped messages, try the following command instead.
sudo journalctl --output=short --follow --all | sudo snappy-debug
Note: these commands only show policy violations that happen after you run them. So first run one of these commands and then run the snap that you want to debug.
See snappy-debug --help
for more information about this tool.