Snap arm64 on linuxondex

[ericoporto2008]

I see one can build in the snapcraft build cloud for arm64 without arm64 hardware. Are those snaps compatible with Samsung’s Linux On Dex?

[Lin-Buo-Ren]

According to the web site’s description, I see no reason why it isn’t compatible.

UPDATE: As ijohnson mentioned the kernel support might be a problem.

[ijohnson]

You may run into difficulties with confinement due to the additional SELinux component from Android, I’m not sure how compatible snapd is these days with SELinux in general, or with the version from Android which AIUI is slightly different than other Linux OS’s.

[beidl]

Last time I checked Matthew Garrett started a discussion about providing confinement via SELinux on platforms where SELinux is available instead of AppArmor.

SELinux interface support

I’ve been taking a look at what would be involved in writing SELinux policy for covering the existing interfaces. My current impression is that this is going to be (a) difficult, (b) fragile and © difficult, but let’s start with a quick introduction to SELinux and some fundamental differences between it and Apparmor. SELinux is based around processes running in contexts and interacting with resources that have labels. The SELinux policy describes how these interact - for example, a process runn…

On the implementation side this would require snapd to generate policies using more sophisticated methods, i.e abstracting policy generation away while - where simple template-based string insertion is used now - describing interfaces (user-visible) which are already very abstract through even more abstract means (internally).

Additionally, if it’s possible to have hierarchy-based implications within SELinux policies (context/label x implies y as y being a subset of x) then the path-based nature of AppArmor could indeed be mapped onto SELinux policies.