Snapcraft should fail or warn when using a stage-snap with different base

when using a stage snap that has a different base (i.e. building a base: core18 nodejs snap using node from the 10/stable track) there will not be access to the glibc from the core base snap and the snap fails to run with apparmor denials like below:

Nov 21 12:54:53 localhost kernel: audit: type=1400 audit(1605963293.507:539): apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/libdl-2.23.so" pid=
Nov 21 12:54:53 localhost kernel: audit: type=1400 audit(1605963293.507:540): apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/librt-2.23.so" pid=
Nov 21 12:54:53 localhost kernel: audit: type=1400 audit(1605963293.507:541): apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/usr/lib/x86_64-linux-gnu/libstdc++.so.6.
Nov 21 12:54:53 localhost kernel: audit: type=1400 audit(1605963293.507:542): apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/libm-2.23.so" pid=4
Nov 21 12:54:53 localhost kernel: audit: type=1400 audit(1605963293.507:543): apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/libgcc_s.so.1" pid=
Nov 21 12:54:53 localhost audit[4123]: AVC apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/libpthread-2.23.so" pid=4123 comm="node" requested_mas
Nov 21 12:54:53 localhost audit[4123]: AVC apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/libc-2.23.so" pid=4123 comm="node" requested_mask="r" 
Nov 21 12:54:53 localhost kernel: audit: type=1400 audit(1605963293.511:544): apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/libpthread-2.23.so"
Nov 21 12:54:53 localhost kernel: audit: type=1400 audit(1605963293.511:545): apparmor="DENIED" operation="open" profile="snap.picviewer-kiosk.file-browser" name="/snap/core/10185/lib/x86_64-linux-gnu/libc-2.23.so" pid=4
Nov 21 12:54:53 localhost kernel: node[4123]: segfault at 0 ip 0000000000000000 sp 00007ffda5de47a8 error 14 in node[3ff000+1000]

since snapcraft unpacks stage snaps, it can surely also check what base a stage snap uses, it should then fail the build or at least warn that you can not combine stage snaps with the chosen base.

3 Likes