<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Apparmor on [BLOG].rdiez.es</title><link>https://blog.rdiez.es/en/tags/apparmor/</link><description>Recent content in Apparmor on [BLOG].rdiez.es</description><generator>Hugo -- gohugo.io</generator><language>en-us</language><lastBuildDate>Tue, 02 Jun 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://blog.rdiez.es/en/tags/apparmor/index.xml" rel="self" type="application/rss+xml"/><item><title>Thumbnails are not generating in Ubuntu 24.04 LTS</title><link>https://blog.rdiez.es/en/p/thumbnails-are-not-generating-in-ubuntu-24.04-lts/</link><pubDate>Tue, 02 Jun 2026 00:00:00 +0000</pubDate><guid>https://blog.rdiez.es/en/p/thumbnails-are-not-generating-in-ubuntu-24.04-lts/</guid><description>&lt;img src="https://blog.rdiez.es/p/las-miniaturas-thumbnails-no-se-generan-en-ubuntu-24.04-lts/ubuntu-thumbnails-fix.png" alt="Featured image of post Thumbnails are not generating in Ubuntu 24.04 LTS" /&gt;&lt;p&gt;One of the most annoying bugs you can encounter after a system update is that &lt;strong&gt;image thumbnails stop generating&lt;/strong&gt;, showing a generic icon instead. If you take a look at your hidden folders, you&amp;rsquo;ll see that all these failed thumbnails end up stored in the &lt;code&gt;~/.cache/thumbnails/fail&lt;/code&gt; path.&lt;/p&gt;
&lt;p&gt;This time, we are going to fix this problem at its root by creating a secure &lt;strong&gt;AppArmor&lt;/strong&gt; profile for Nautilus, allowing the system to render your previews again without compromising your security.&lt;/p&gt;
&lt;h2 id="why-does-this-happen"&gt;Why does this happen?
&lt;/h2&gt;&lt;p&gt;The culprit behind this behavior is a new restrictive security policy in Ubuntu 24.04 related to unprivileged user namespaces.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Nautilus&lt;/strong&gt; (the GNOME file manager) uses an isolation tool called &lt;code&gt;bubblewrap&lt;/code&gt; under the hood. Its job is to create a secure environment (sandbox) to open and process images. This way, if a file were corrupted or contained malicious code, it wouldn&amp;rsquo;t be able to infect your system.&lt;/p&gt;
&lt;p&gt;The problem arises because AppArmor&amp;rsquo;s strict policies block &lt;code&gt;bubblewrap&lt;/code&gt; from functioning. Since the sandbox cannot run, Nautilus fails silently and sends all thumbnails straight to the error folder (&lt;code&gt;fail&lt;/code&gt;).&lt;/p&gt;
&lt;h2 id="solution-create-the-apparmor-profile-for-nautilus"&gt;Solution: Create the AppArmor profile for Nautilus
&lt;/h2&gt;&lt;p&gt;Although drastic methods exist, such as disabling this restriction globally across the entire kernel, &lt;strong&gt;it is not recommended&lt;/strong&gt;. The ideal approach is a surgical solution: telling AppArmor to specifically trust Nautilus.&lt;/p&gt;
&lt;h3 id="create-the-configuration-file"&gt;Create the configuration file
&lt;/h3&gt;&lt;p&gt;Open a terminal and run the following command to create a new AppArmor profile using the native &lt;code&gt;nano&lt;/code&gt; text editor:&lt;/p&gt;
&lt;div class="highlight"&gt;&lt;div class="chroma"&gt;
&lt;table class="lntable"&gt;&lt;tr&gt;&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code&gt;&lt;span class="lnt"&gt;1
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code class="language-bash" data-lang="bash"&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;sudo nano /etc/apparmor.d/nautilus
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;p&gt;Inside the empty file, paste the necessary rules to grant the required permission:&lt;/p&gt;
&lt;div class="highlight"&gt;&lt;div class="chroma"&gt;
&lt;table class="lntable"&gt;&lt;tr&gt;&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code&gt;&lt;span class="lnt"&gt;1
&lt;/span&gt;&lt;span class="lnt"&gt;2
&lt;/span&gt;&lt;span class="lnt"&gt;3
&lt;/span&gt;&lt;span class="lnt"&gt;4
&lt;/span&gt;&lt;span class="lnt"&gt;5
&lt;/span&gt;&lt;span class="lnt"&gt;6
&lt;/span&gt;&lt;span class="lnt"&gt;7
&lt;/span&gt;&lt;span class="lnt"&gt;8
&lt;/span&gt;&lt;span class="lnt"&gt;9
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code class="language-bash" data-lang="bash"&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;abi &amp;lt;abi/4.0&amp;gt;,
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;include &amp;lt;tunables/global&amp;gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;profile nautilus /usr/bin/nautilus &lt;span class="nv"&gt;flags&lt;/span&gt;&lt;span class="o"&gt;=(&lt;/span&gt;unconfined&lt;span class="o"&gt;)&lt;/span&gt; &lt;span class="o"&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt; userns,
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt; &lt;span class="c1"&gt;# Site-specific additions and overrides. See local/README for details.&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt; include &lt;span class="k"&gt;if&lt;/span&gt; exists &amp;lt;local/nautilus&amp;gt;
&lt;/span&gt;&lt;/span&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;&lt;span class="o"&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;p&gt;To save the changes in nano, press the key combination &lt;code&gt;Ctrl + O&lt;/code&gt;, hit &lt;code&gt;Enter&lt;/code&gt; to confirm the name, and finally exit with &lt;code&gt;Ctrl + X&lt;/code&gt;.&lt;/p&gt;
&lt;h3 id="load-the-new-profile-into-the-system"&gt;Load the new profile into the system
&lt;/h3&gt;&lt;p&gt;To make Ubuntu apply the new rules immediately without needing a reboot, run the following command in the terminal:&lt;/p&gt;
&lt;div class="highlight"&gt;&lt;div class="chroma"&gt;
&lt;table class="lntable"&gt;&lt;tr&gt;&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code&gt;&lt;span class="lnt"&gt;1
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code class="language-bash" data-lang="bash"&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;sudo apparmor_parser -r /etc/apparmor.d/nautilus
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;h2 id="cleaning-up-the-history-and-restarting"&gt;Cleaning up the history and restarting
&lt;/h2&gt;&lt;p&gt;Once the security block is resolved, we need to force Nautilus to retry generating the thumbnails that were already flagged as &amp;ldquo;failed&amp;rdquo;.&lt;/p&gt;
&lt;h3 id="empty-the-error-cache"&gt;Empty the error cache
&lt;/h3&gt;&lt;p&gt;Run this command to clear the history of failed images from the system:&lt;/p&gt;
&lt;div class="highlight"&gt;&lt;div class="chroma"&gt;
&lt;table class="lntable"&gt;&lt;tr&gt;&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code&gt;&lt;span class="lnt"&gt;1
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code class="language-bash" data-lang="bash"&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;rm -rf ~/.cache/thumbnails/fail/*
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;h3 id="restart-the-file-manager"&gt;Restart the file manager
&lt;/h3&gt;&lt;p&gt;Finally, completely close the Nautilus instance running in the background:&lt;/p&gt;
&lt;div class="highlight"&gt;&lt;div class="chroma"&gt;
&lt;table class="lntable"&gt;&lt;tr&gt;&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code&gt;&lt;span class="lnt"&gt;1
&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;
&lt;td class="lntd"&gt;
&lt;pre tabindex="0" class="chroma"&gt;&lt;code class="language-bash" data-lang="bash"&gt;&lt;span class="line"&gt;&lt;span class="cl"&gt;nautilus -q
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;p&gt;And that&amp;rsquo;s it! With all of this done, the next time you open your file manager and enter your image or video folders, you&amp;rsquo;ll see them populate again with all the thumbnails generated instantly and completely securely—just as it always should have been.&lt;/p&gt;
&lt;hr&gt;
&lt;p&gt;&lt;strong&gt;PD&lt;/strong&gt;: Banner image generated with AI.&lt;/p&gt;</description></item></channel></rss>