Apparmor denies access to amdgpu binaries in default profile under Linux Mint 21.3

[digitalextremist]

On Linux Mint 21.3 with a fresh install, this was spamming my dmesg output:

[44447.432146] audit: type=1400 audit(1720107505.023:8854): apparmor="DENIED" operation="file_mmap" class="file" profile="/usr/bin/redshift" name="/opt/amdgpu/lib/x86_64-linux-gnu/libdrm.so.2.4.0" pid=70637 comm="redshift" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0

Saw thousands of this line, with seemingly several a second sometimes.

Needed to add this to the profile for usr.bin.redshift beyond the defaults:

  /opt/amdgpu/lib/x86_64-linux-gnu/* rm,

Not entirely sure this is the best idea, but seemed natural for an application affecting video output to have access to that.

Will be monitoring the effects. All ears if anyone has comments as to why/why-not, or if log suppression is better than permission.

[Cwpute]

Hi, i seem to have the same problem on Mint with Reshift not starting, can you explain where you changed this parameter ? I'm not used to doing such things, or if i should even do them 👀

[Cwpute]

Apparently it's a problem with Apparmor denied access to the config file, but there being no config file to begin with.
Solutions are proposed there: #820