1
Diagnostic step 1
Inspect denials with 'journalctl -k' and 'journalctl -e' and copy the exact AppArmor denial lines (include executable path, requested syscall, and device path) for diagnosis.
FULL AI ANALYSIS
Snap app denied access to /dev/video0 by AppArmor after kernel update on Ubuntu 22.04
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
AppArmor is blocking the snap from opening the camera device, even though the camera interface appears connected. The snap confinement relies on interface plugs and kernel AppArmor policies; a kernel or snapd change can alter how device nodes or labels are matched, causing previously working snaps to receive DENIED. The fact native apps can open the device and the snap works in devmode indicates the hardware and udev permissions are fine and the problem is confinement policy or interface mapping.
Possible causes
snapd or kernel update changed how the 'camera' interface is enforced, causing snap claims to be ignored or misrouted.
75%Snap was confined against a different device node (by by-id path) and the kernel now presents the device under a different path.
20%AppArmor profile for the snap no longer matches the device node path (e.g., device symlink path changed after udev/driver changes).
15%Content interface or store assertion used by the snap is missing an explicit device access rule due to a packaging regression.
10%Suggested fixes
2
Diagnostic step 2
Run 'snap connections <snap-name>' and confirm 'camera' shows as connected; if it does not, run 'sudo snap connect <snap-name>:camera' and re-test (this is reversible).
3
Diagnostic step 3
Use 'aa-status' to confirm AppArmor is enabled and look up the profile name shown in the DENIED messages; temporarily set that profile to complain mode with 'sudo aa-complain <profile>' to test whether AppArmor is the blocker (reversible, but do not leave in complain mode in production).
4
Diagnostic step 4
Check /dev entries and symlinks: 'ls -l /dev/video*' and compare the path in the denial to the actual device node; add a persistent udev rule to create a stable symlink if path differences are observed.
5
Diagnostic step 5
If running the snap in devmode fixes the issue, file a bug with snapd including the journal/AppArmor denials and kernel version; attach captures from 'snap connections', 'aa-status', and the denial lines. As a temporary alternative, use a non-snap package (apt/flatpak) that uses the portal system (flatpak) for camera access. Escalate to the distribution/snapd maintainers with the denial logs and kernel version if the above diagnostics show a policy mismatch that you cannot safely override.