Desktop Environment (if applicable): n/a (server, not a desktop)
Problem Description:
fwupdmgr cannot be used in Core 26.
Installing fwupd gives a warning, and trying to use it results in an error:
[redacted]@localhost:~$ snap install fwupd
2026-07-14T11:47:32Z INFO snap "fwupd" has bad plugs or slots: polkit (cannot use "action-prefix" attribute: "/usr/share/polkit-1/actions" is not writable)
fwupd 2.1.4 from Ken VanDine✪ installed
WARNING: There is 1 new warning. See 'snap warnings'.
[redacted]@localhost:~$ fwupdmgr refresh
Error registering authentication agent: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.11" (uid=1000 pid=3764 comm="/snap/fwupd/8528/usr/bin/pkttyagent --notify-fd 6" label="snap.fwupd.fwupdmgr (enforce)") interface="org.freedesktop.PolicyKit1.Authority" member="RegisterAuthenticationAgentWithOptions" error name="(unset)" requested_reply="0" destination=":1.12" (uid=111 pid=3768 comm="/usr/lib/polkit-1/polkitd --no-debug --log-level=n" label="unconfined") (g-dbus-error-quark, 9)
WARNING: UEFI ESP partition not detected or configured
See https://github.com/fwupd/fwupd/wiki/PluginFlag:esp-not-found for more information.
Authenticating… ▕ ⣾ ▏
Updating lvfs
Authenticating… ▕⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿▏ Less than one minute remaining…
Could not check for auth: GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.15" (uid=0 pid=3793 comm="/snap/fwupd/8528/libexec/fwupd/fwupd" label="snap.fwupd.fwupd (enforce)") interface="org.freedesktop.PolicyKit1.Authority" member="CheckAuthorization" error name="(unset)" requested_reply="0" destination=":1.12" (uid=111 pid=3768 comm="/usr/lib/polkit-1/polkitd --no-debug --log-level=n" label="unconfined")
What I’ve Tried:
I tried installing with classic:
snap install --classic fwupd
That gave the same error.
I tried running it in an LXC instance, but that failed:
[redacted]@localhost:~$ lxc shell abercorn
root@abercorn:~# fwupdmgr
Failed to connect to daemon: Error calling StartServiceByName for org.freedesktop.fwupd: Failed to activate service 'org.freedesktop.fwupd': timed out (service_start_timeout=25000ms)
I suspect that running it in an LXC instance wouldn’t be valid anyway, because it has to run on the host, not in a VM.
Relevant System Information:
A fresh installation of Ubuntu Core 26, running in VirtualBox.
Since classic is completely unconfined (it is just the equivalent of dropping some software into /opt, just more conveniently wrapped in a snap), classic mode has to be requested by the uploader of the snap and only after a review by the security team and when fitting in one of the permitted categories listed on the above page such a snap can be uploaded to the store …
The –classic switch of snap install … only exists to make sure a users consciously permits the install of such a snap, it is not a dynamic switch that would turn a strict snap into a classic one
(if you want to skip confinement you can actually install a snap with –devmode though note that this turns off updates for that particular snap (…and spams your logs since the confinement gets switched to “complain” mode in this case))
It seems that --devmode isn’t a good option, then.
Do you have any idea how to run fwupdmgr? I still get firmware updates regularly. It works on TPM-backed FDE Desktop, which uses Core, and on the standard Server, but not on Core itself.
Ubuntu Core 26 uses a read-only base snap (core26), which means /usr is completely read-only.
Why the installation warns: The fwupd snap defines a polkit plug that uses the action-prefix attribute to install its PolicyKit authorization files. To do this, snapd attempts to write to /usr/share/polkit-1/actions. Because that directory is read-only on Ubuntu Core, snapd flags the plug as “bad.”
Why the command fails: Because the polkit interface connection cannot be properly established, snapd doesn’t generate the necessary AppArmor security rules for it. When you run fwupdmgr, the fwupd daemon attempts to authenticate the request via D-Bus with PolicyKit (polkitd). Since the AppArmor policy lacks the permissions (due to the failed plug), the kernel blocks the D-Bus communication, resulting in the AccessDenied error.
The fwupd snap ships with a standalone utility called fwupdtool. Unlike fwupdmgr (which talks to the background system daemon over D-Bus), fwupdtool is a standalone CLI tool that activates the fwupd plugins directly.
Because it operates directly on the hardware and handles its own logic, it does not require Polkit or D-Bus communication, making it perfect for Ubuntu Core.
You must run it with sudo:
To check for devices:sudo fwupd.fwupdtool get-devices
To check for updates:sudo fwupd.fwupdtool get-updates
To install a local firmware file:sudo fwupd.fwupdtool install /path/to/firmware.cab
Note:fwupdtool is a low-level tool and bypasses some of the safety-guarded handshakes of the daemon, so double-check that you are flashing the correct files for your specific hardware.
That looks like a violation of FHS, right there. Data that’s supposed to change in the normal cause of action goes in /var[1], whereas /usr is (to be considered) read-only[2]. Arguably, Polkit actions, rules etc. are administrative data, for an exact match in that non-exhaustive list.
On Debian such is probably a high severity bug, possibly even release critical, because of a policy violation, FHS compliance being imexplicitly required by the Debian Policy. Don’t know where that leaves us in terms of Ubuntu in general and Snap in particular, though.
perhaps /etc but only if it’s not (too) dynamic ↩︎
BTW, why are you trying to run it from an LXC container. This might be a namespace issue. There is a fwupd Snap; works like a charm on my 24.04 laptop.
I was being dumb. I had forgotten to install fwupd.
The command still gives errors (or warnings?), though, possibly because of the error message that I mentioned earlier.
sudo fwupd.fwupdtool get-devices
Loading… ▕⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣀ ▏15:43:48.738 FuEngine failed to add device /sys/devices/pci0000:00/0000:00:01.1/ata1/host0/target0:0:0/0:0:0:0/block/sr0: failed to subclass open: failed to open /dev/sr0: Operation not permitted
15:43:48.744 FuEngine failed to add device /sys/devices/pci0000:00/0000:00:01.1/ata1/host0/target0:0:0/0:0:0:0/block/sr0: failed to subclass open: failed to open /dev/sr0: Operation not permitted
Loading… ▕⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣀ ▏15:43:48.753 FuEngine failed to add device /sys/devices/pci0000:00/0000:00:0d.0/ata3/host2/target2:0:0/2:0:0:0/block/sda: failed to subclass open: failed to open /dev/sda: Operation not permitted
15:43:48.759 FuEngine failed to add device /sys/devices/pci0000:00/0000:00:0d.0/ata3/host2/target2:0:0/2:0:0:0/block/sda: failed to subclass open: failed to open /dev/sda: Operation not permitted
Loading… ▕⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣄▏
WARNING: UEFI ESP partition not detected or configured
See https://github.com/fwupd/fwupd/wiki/PluginFlag:esp-not-found for more information.
innotek GmbH VirtualBox
[… cut …]
I tried it purely experimentally, since it didn’t work in the normal way. As I said, “I suspect that running it in an LXC instance wouldn’t be valid anyway, because it has to run on the host, not in a VM.”
How do I find out where the firmware cab is? The normal fwupdmgr command handles it all automatically.
Those are just your DVD or CD drive and SATA storage device, respectively. That probably just means that you can’t update them, which shouldn’t be too big of a deal. The Secure Boot cert updates are the most important ones in the Ubuntu Core context, I guess.
Note: