Ubuntu i.de 2.3.7

hey guys, everytime i restart my computer i need to open a terminal and do

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

in order to even open the ide.

not convenient at all, secondly im having difficulties with getting anything to upload to the board, which is a nano i have laying around (the only board i have access too right now and has been functional in the past)

when selecting board i get “/dev/ttyUSB0 Serial Port (usb) (if i unplug and replug the board in, this option dissapears and reappears so its my nano, however the “ok” button to select it is greyed out.

edit: okay i got the board to connect to the ide, just had to select nano from the list then it would pick up the connected nano.

however i am now getting

OS error: cannot open port /dev/ttyUSB0: permission denied
error: unable to open port /dev/ttyUSB0 for programmer arduino

See here about dialout group
https://support.arduino.cc/hc/en-us/articles/360016495679-Fix-port-access-on-Linux

hi jim, thanks on my other thread.

ive been through all of that and it hasnt helped.

im in the dialout group which is currently used as root, i added the root user to it as well as my typical user profile. so thats done

the problem im having is needing to run the first command everytime i reboot. i think making that permenant is the first step

Hi @secretreeve

This happens when Ubuntu's AppArmor security software blocks the Arduino IDE application from starting.

There is some valuable discussion on this subject here:

In that thread, multiple solutions are described by an Arduino community member:

Create AppArmor Policy

https://github.com/arduino/arduino-ide/issues/2429#:~:text=file)%2C%20you%20can-,create%20an%20AppArmor%20profile,-with%20a%20configuration

You can also create a new AppArmor profile for the Arduino IDE (that allows a non-root user to use the sandboxing in a specific application). If you copy the AppImage file to /usr/local/bin/arduino (this is the new name of the AppImage file), you can create an AppArmor profile with a configuration file, for example, in /etc/apparmor.d/usr.local.bin.arduino, containing:

abi <abi/4.0>,
include <tunables/global>
profile arduino /usr/local/bin/arduino flags=(unconfined) {
  userns,
  include if exists <local/arduino>
}

and reloading all AppArmor profiles with:

sudo service apparmor reload

Now you can run the Arduino IDE without the sandboxing error.

I have verified that the AppArmor policy approach does fix the problem.

Unfortunately since I am not knowledgeable in this area and the AppArmor documentation is absolutely horrendous. For this reason, despite my best efforts, I was not able to effectively analyze the policy provided by the community member. So I can't officially endorse the installation of that policy. However, I don't have any reason to believe it is flawed or dangerous, and I am using it on my own Ubuntu machine.

Start IDE With --no-sandbox Flag

https://github.com/arduino/arduino-ide/issues/2429#:~:text=run%20the%20Arduino%20IDE%20with%20the%20--no-sandbox%20option

You could also run the Arduino IDE with the --no-sandbox option, but that is, in my opinion, a potentially very bad idea.

There is more information on the use of the flag here:

https://www.electronjs.org/docs/latest/tutorial/sandbox#disabling-chromiums-sandbox-testing-only

You can also disable Chromium's sandbox entirely with the --no-sandbox CLI flag, which will disable the sandbox for all processes (including utility processes). We highly recommend that you only use this flag for testing purposes, and never in production.

(Arduino IDE 2.x is built on the open source Electron application framework, and inherits the --no-sandbox flag from the framework)

do i need to create this file as i do not have one?

if so, i have my arduino-ide_2.3.7_Linux_64bit.AppImage located in /home/chris/Arduino directory, so it would need to look like this right?

abi <abi/4.0>,
include <tunables/global>
profile arduino /home/chris/Arduino/arduino-ide_2.3.7_Linux_64bit.AppImage flags=(unconfined) {
userns,
include if exists <local/arduino>
}

Yes, you need to create it. This is the procedure I use to do that:

  1. Open a command line terminal.

  2. Type the following command in the terminal:

    ARDUINO_IDE_EXECUTABLE_PATH="<path>"
    
  3. Replace the <path> placeholder in the command with the path of the Arduino IDE executable on your computer's hard drive.

    • If you are using the AppImage, the path must be that of the .AppImage file.
    • If you are using the ZIP package, the path must be that of the arduino-ide file that is inside the folder you extracted from the ZIP archive.
  4. Press the Enter key.

  5. Copy and paste the following command into the terminal:

    APPARMOR_POLICY_PATH="/etc/apparmor.d/arduino-ide" \
    && \
    printf \
    '# AppArmor policy for Arduino IDE'
    # Source: https://github.com/arduino/arduino-ide/issues/2429#issuecomment-2099775010
    # See: https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference
    
    abi <abi/4.0>,
    
    @{ARDUINO_IDE_EXECUTABLE_PATH}="'"$ARDUINO_IDE_EXECUTABLE_PATH"'"
    
    include <tunables/global>
    
    # Re: `flags=(unconfined)`, see:
    # - https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference#profile-flags
    # - https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#special-unconfined-profiles-and-user-namespace-mediation
    profile "@{ARDUINO_IDE_EXECUTABLE_PATH}" flags=(unconfined) {
      # See:
      # https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#allowing-user-namespaces-creation-in-policy
      userns,
    }
    ' | \
      sudo \
        tee \
          "$APPARMOR_POLICY_PATH" \
    && \
    sudo \
      apparmor_parser \
        --replace \
        "$APPARMOR_POLICY_PATH"
    
  6. Press the Enter key.

there is what i got

is@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ ^[[200~APPARMOR_POLICY_PATH="/etc/apparmor.d/arduino-ide" \
> && \
> printf \
> '# AppArmor policy for Arduino IDE'
bash: APPARMOR_POLICY_PATH=/etc/apparmor.d/arduino-ide: No such file or directory
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ # Source: https://github.com/arduino/arduino-ide/issues/2429#issuecomment-2099775010
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ # See: https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ 
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ abi <abi/4.0>,
bash: ,: Permission denied
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ 
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ @{ARDUINO_IDE_EXECUTABLE_PATH}="'"$ARDUINO_IDE_EXECUTABLE_PATH"'"
bash: @{ARDUINO_IDE_EXECUTABLE_PATH}='/home/chris/Arduino/arduino-ide_2.3.7_Linux_64bit.AppImage: No such file or directory
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ 
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ include <tunables/global>
bash: syntax error near unexpected token `newline'
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ 
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ # Re: `flags=(unconfined)`, see:
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ # - https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference#profile-flags
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ # - https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#special-unconfined-profiles-and-user-namespace-mediation
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ profile "@{ARDUINO_IDE_EXECUTABLE_PATH}" flags=(unconfined) {
bash: syntax error near unexpected token `('
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$   # See:
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$   # https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#allowing-user-namespaces-creation-in-policy
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$   userns,
userns,: command not found
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ }
bash: syntax error near unexpected token `}'
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ ' | \
>   sudo \
>     tee \
>       "$APPARMOR_POLICY_PATH" \
> && \
> sudo \
>   apparmor_parser \
>     --replace \
>     "$APPARMOR_POLICY_PATH"
> ~

Sorry about that. Stray quote. Run this command instead:

APPARMOR_POLICY_PATH="/etc/apparmor.d/arduino-ide" \
&& \
printf \
'# AppArmor policy for Arduino IDE
# Source: https://github.com/arduino/arduino-ide/issues/2429#issuecomment-2099775010
# See: https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference

abi <abi/4.0>,

@{ARDUINO_IDE_EXECUTABLE_PATH}="'"$ARDUINO_IDE_EXECUTABLE_PATH"'"

include <tunables/global>

# Re: `flags=(unconfined)`, see:
# - https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference#profile-flags
# - https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#special-unconfined-profiles-and-user-namespace-mediation
profile "@{ARDUINO_IDE_EXECUTABLE_PATH}" flags=(unconfined) {
  # See:
  # https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#allowing-user-namespaces-creation-in-policy
  userns,
}
' | \
  sudo \
    tee \
      "$APPARMOR_POLICY_PATH" \
&& \
sudo \
  apparmor_parser \
    --replace \
    "$APPARMOR_POLICY_PATH"

frustrating development, ive been summoned away on a family matter. i will check back asap, try anything suggested and report back on it as soon as i can. thought i had better let you know as your being kind enough to help.

ok i ran that and

# AppArmor policy for Arduino IDE
# Source: https://github.com/arduino/arduino-ide/issues/2429#issuecomment-2099775010
# See: https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference

abi <abi/4.0>,

@{ARDUINO_IDE_EXECUTABLE_PATH}="/home/chris/Arduino/arduino-ide_2.3.7_Linux_64bit.AppImage
sudo ARDUINO_IDE_EXECUTABLE_PATH=/home/chris/Arduino/arduino-ide_2.3.7_Linux_64bit.AppImage"

include <tunables/global>

# Re: `flags=(unconfined)`, see:
# - https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference#profile-flags
# - https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#special-unconfined-profiles-and-user-namespace-mediation
profile "@{ARDUINO_IDE_EXECUTABLE_PATH}" flags=(unconfined) {
  # See:
  # https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#allowing-user-namespaces-creation-in-policy
  userns,
}
chris@chris-Lenovo-MIIX-320-10ICR:/etc/apparmor.d$ 

did i need to change anything considering where the arduino appaimage is located is different to that in the github

i reloaded the policies as mentioned in the earlier post. i have rebooted as well and it still requires the sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

to load the ide

so i ran that command again, the sysctl etc, opened ide now i have a programmer not responding not in sunc resp=0x00 error, unable to open port /dev/ttyUSB0 for programmer arduino.

stiff frustrating that i have to run that same command every reboot to even open the ide though

You did something wrong at step 2 in my instructions. This part of the file should look like:

@{ARDUINO_IDE_EXECUTABLE_PATH}="/home/chris/Arduino/arduino-ide_2.3.7_Linux_64bit.AppImage"

Please try performing the instructions from post #6 again. Make sure to use the corrected command from post #8 at step 5. Doing that that will overwrite the current incorrect policy file and hopefully fix the problem.

chris@chris-Lenovo-MIIX-320-10ICR:~/Arduino$ ARDUINO_IDE_EXECUTABLE_PATH="/home/chris/Arduino/arduino-ide_2.3.7_Linux_64bit_appImage
> APPARMOR_POLICY_PATH="/etc/apparmor.d/arduino-ide" \
&& \
printf \
'# AppArmor policy for Arduino IDE
# Source: https://github.com/arduino/arduino-ide/issues/2429#issuecomment-2099775010
# See: https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference

abi <abi/4.0>,

@{ARDUINO_IDE_EXECUTABLE_PATH}="'"$ARDUINO_IDE_EXECUTABLE_PATH"'"

include <tunables/global>

# Re: `flags=(unconfined)`, see:
# - https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference#profile-flags
# - https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#special-unconfined-profiles-and-user-namespace-mediation
profile "@{ARDUINO_IDE_EXECUTABLE_PATH}" flags=(unconfined) {
  # See:
  # https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#allowing-user-namespaces-creation-in-policy
    "$APPARMOR_POLICY_PATH"H" \
>

theres the output. terminal ihas ended with > cursor

You removed the closing quote at the end of this command.

Press Ctrl+C to cancel the command and then try following the instructions once again.

hows this look?

# AppArmor policy for Arduino IDE
# Source: https://github.com/arduino/arduino-ide/issues/2429#issuecomment-2099775010
# See: https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference

abi <abi/4.0>,

@{ARDUINO_IDE_EXECUTABLE_PATH}="/home/chris/Arduino/arduino-ide_2.3.7_Linux_64bit_Appimage"

include <tunables/global>

# Re: `flags=(unconfined)`, see:
# - https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference#profile-flags
# - https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#special-unconfined-profiles-and-user-namespace-mediation
profile "@{ARDUINO_IDE_EXECUTABLE_PATH}" flags=(unconfined) {
  # See:
  # https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction#allowing-user-namespaces-creation-in-policy
  userns,
}

also, thanks for bearing with me lol

It looks perfect. Are you able to start Arduino IDE now without first running the sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 command?

i will need to reboot, do i need to run the command to sudo service apparmor reload before rebooting?

No. You have already done everything necessary to configure AppArmor to allow Arduino IDE to run. Just reboot and then try to start Arduino IDE.

okay, i'll report back in a few