Ubuntu 22.04升级中断后Snap应用（如Firefox）无法启动，snap-confine权限异常问题求助

我在执行apt upgrade的时候系统突然崩溃了，重启后再次尝试升级时收到提示：dpkg被中断，必须手动运行sudo dpkg --configure -a来修复问题。我按提示执行后，在配置snapd环节遇到了AppArmor配置文件的选择——系统提示我当前的配置文件已被修改，询问是否要替换成维护者版本，我选择了保留自己的版本（输入N）。

完成配置后，我发现最近升级过的Snap应用（比如Firefox）在系统重启后无法从桌面启动了。不过如果手动执行以下命令：

sudo apparmor_parser -r /etc/apparmor.d/*snap-confine*

就能正常启动这些应用，但重启系统后问题又会重复出现。

我已经尝试了以下所有方法，但都没能彻底解决问题：

• 启用并启动AppArmor和snapd.apparmor服务：

  sudo systemctl enable --now apparmor.service
  sudo systemctl enable --now snapd.apparmor.service
  

• 重启并启用snapd服务：

  sudo service start snapd
  sudo systemctl enable snapd.service
  sudo systemctl enable --now snapd.service
  

• 执行Snap刷新：

  sudo snap refresh
  

• 重新安装AppArmor：

  sudo apt reinstall --purge apparmor
  

• 替换snap-confine的AppArmor配置文件并重启AppArmor：

  sudo cp /var/lib/snapd/apparmor/profiles/snap-confine.snapd.21184 /etc/apparmor.d/usr.lib.snapd.snap-confine.real
  sudo systemctl restart apparmor
  

• 启动snapd.apparmor服务并重新启用snapd：

  sudo service snapd.apparmor start
  sudo systemctl enable snapd.service
  sudo systemctl start snapd.service
  service snapd.apparmor start
  

• 彻底卸载并重新安装snapd：

  sudo dpkg -P snapd
  sudo apt install snapd
  

从系统日志里我找到了关键的错误提示：

Mar 28 19:43:40 ... ... firefox_firefox.desktop[...]: snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
Mar 28 19:43:40 ... ... firefox_firefox.desktop[...]: Please make sure that the snapd.apparmor service is enabled and started.

目前的服务状态如下：

$ systemctl status snapd.service
● snapd.service - Snap Daemon
     Loaded: loaded (/lib/systemd/system/snapd.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2024-03-29 09:00:28 CET; 1h 8min ago
TriggeredBy: ● snapd.socket
   Main PID: ... (snapd)
      Tasks: 9 (limit: 4519)
     Memory: 21.4M
        CPU: 2.140s
     CGroup: /system.slice/snapd.service
             └─... /usr/lib/snapd/snapd

$ systemctl status apparmor.service
● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
     Active: active (exited) since Fri 2024-03-29 08:59:45 CET; 1h 10min ago
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/
   Main PID: ... (code=exited, status=0/SUCCESS)
        CPU: 182ms

Snap和AppArmor的版本信息：

$ snap version
snap    2.61.3+22.04
snapd   2.61.3+22.04
series  16
ubuntu  22.04
kernel  6.5.0-26-generic

$ dpkg -l
ii  apparmor                                   3.0.4-2ubuntu2.3                        amd64        user-space parser utility for AppArmor
ii  apparmor-profiles                          3.0.4-2ubuntu2.3                        all          experimental profiles for AppArmor security policies
ii  apparmor-utils                             3.0.4-2ubuntu2.3                        all          utilities for controlling AppArmor

测试结果：

$ sudo snap refresh firefox
snap "firefox" has no updates available

$ firefox
snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks
Please make sure that the snapd.apparmor service is enabled and started.

补充说明：之前我对AppArmor做过自定义修改，限制了PDF阅读器的网络访问和指定目录权限，执行过这些操作：

$ sudo aa-status
$ sudo apt install apparmor-profiles apparmor-utils
$ sudo aa-enforce /etc/apparmor.d/*

想请教大家，还有什么办法能彻底解决这个问题，让我重启系统后就能直接启动Firefox这类Snap应用？

备注：内容来源于stack exchange，提问作者Philipp M