Shared memory in /dev/shm rewriting

snapd
8

There are two straightforward routes to solving the shared memory issue:

The first one is to prefix the shared memory files snap.<snap name>. This works out of the box without any interfaces.

Here are the specific apparmor rules:

# App-specific access to files and directories in /dev/shm. We allow file
# access in /dev/shm for shm_open() and files in subdirectories for open()
/{dev,run}/shm/snap.@{SNAP_NAME}.** mrwlkix,
# Also allow app-specific access for sem_open()
/{dev,run}/shm/sem.snap.@{SNAP_NAME}.* mrwk,

Then, if the above doesn’t work for you and your application, game, etc needs custom rules along the line of what we have for chromium, we can define a new interface for that. Just let us know about the details and we’ll implement the interface and release on the upcoming snapd.

1 Like