I'm currently running Ubuntu 18.04.1 and have gnome-calculator 3.30.1 installed. I'm pretty sure that's the one that came bundled with 18.04.

Every time I launch gnome-calculator the following message is logged in /var/log/kern.log by apparmor:

kernel: [10238.459543]
audit: type=1400
audit(1547652310.229:29638):
apparmor="DENIED"
operation="open"
profile="snap.gnome-calculator.gnome-calculator"
name="/home/me/Documents/"
pid=10260
comm="head"
requested_mask="r"
denied_mask="r"
fsuid=1000
ouid=1000

Seven additional, identical messages are logged, with the only difference being the directory that gnome-calculator is attempting to access:

name="/home/me/Desktop/"
name="/home/me/Downloads/"
name="/home/me/Music/"
name="/home/me/Pictures/"
name="/home/me/Videos/"
name="/home/me/Public/"
name="/home/me/Templates/"

My interpretation of the above is that gnome-calculator is attempting to scan the contents of my home directory and AppArmor is preventing it from doing so.

If that's the case, why is gnome-calculator scanning my home directory?

Is anyone else seeing the same log messages? Is gnome-calculator 3.30.1 infected by malware? Should I be concerned?

7

1 Answer

No worries, it seems quite normal.

I installed gnome-calculator as a snap. When starting it from the command line, nothing special happens but when I start it via the GUI (Activities → Search → Calculator) then I see the same messages as you do in kern.log about scanning my $HOME.

I again uninstalled the snap and installed the apt package instead with the following commands:

# switch from snap to apt:
sudo snap remove gnome-calculator
sudo apt install gnome-calculator

and the messages do no longer appear.

Plus, I can start gnome-calculator by a special key on my keyboard and it opens far quicker, but that's another cup of tea (see this related and interesting post).

(Btw, I also replaced the snap version of gnome-system-monitor with the apt version because the snap version lists all the snap filesystems while the apt version only lists the "regular" ones. I see no point in listing dozens of those squashfs filesystems which are all 100 % full. It just messes up the display.)

0

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password Submit

Post as a guest

Post Your Answer Discard

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy