Snapd STILL requires out-of-tree apparmor patches for strict confinement

The internal parser means that snapd uses the apparmor parser shipped with snapd, which brings all necessary apparmor userspace. Also debian bookworm also only has partial support with a 6.4 kernel.

The info I from the implementers is that only socket mediation is missing in the mainline kernel.

Getting the ubuntu source via apt source linux and grepping through it, it is still in the ubutu diff and not in the mainline source.

root@t--23-10:~/linux-source# grep -i AF_UNIX linux_6.5.0-7.7.diff  | grep mediation
+    - SAUCE: apparmor4.0.0 [06/76]: af_unix mediation

Side Note: dbus mediation was said to require AF_UNIX mediation. But that dbus mediation is listed in sandbox-features ‘dbus: mediated-bus-access’ since a while. I guess they found a way to do mediation without AF_UNIX support (or it is partial?).

One can compile their own kernel with the patch, but caveat emptor and i do not know how to do that in a well maintainable way (auto-patching/compiling new kernels) without needing a lot of infrastructure (own apt repositories, a CI/pipeline for compiling and publishing the modified kernel).

The patches were maintained in apparmor-kernel. As @jdstrand left canonical I am not sure who is carrying the torch for this topic. @jjohansen is working on LSM stacking, but from my outside view does not seem currently to be involved in AF_UNIX mediation topics.

It certainly would be good to know if anybody is actually working on this or if there are usable workarounds.

1 Like