When combining AppArmor and bwrap (both 100% permissive), one gets libGL error
messages (see below) when starting /usr/bin/okular. As long as one starts okular
only with one of those two, there are not libGL errors at all.
(1) bwrap without AppArmor => OK
When starting Okular in a permissive bwrap environment (without any
AppArmor configuration), everything works well:
bwrap --dev-bind / / /usr/bin/okular
=> no libGL error
(2) AppArmor without bwrap => OK
When putting a maximal permissive AppArmor configuration
in place (being in complain mode - nothing should be blocked at all)
abi <abi/3.0>,
include <tunables/global>
/usr/bin/okular flags=(complain) {
include <abstractions/base>
capability, network, mount, remount, umount, pivot_root, ptrace, signal, dbus, unix, file,
}
then okular starts without any error message:
/usr/bin/okular
=> no libGL error
(3) AppArmor + bwrap => libGL error
But when combining those two (both in 100% permissive
mode - for AppArmor configuration see (2)),
bwrap --dev-bind / / /usr/bin/okular
then I see the following error message:
libGL error: MESA-LOADER: failed to retrieve device information
libGL error: Version 4 or later of flush extension not found
libGL error: failed to load driver: i915
Can anyone help me with that? A bug?
Many thanks.
System details:
Tumbleweed 20210524
okular-21.04.1-1.2.x86_64
bubblewrap-0.4.1-1.6.x86_64
apparmor-parser-3.0.1-7.1.x86_64
PS: I think somewhere I saw a comment that bubblewrap does
not support opengl. Nevertheless (1) seems to work (as does
glxgears, glxinfo, etc. with bubblewrap). Though somehow the
combination of AppArmor and bwrap (both permissive)
seems to break opengl (or parts of it).