Snapd STILL requires out-of-tree apparmor patches for strict confinement

snapd
77

Yeah, it seems the vendored apparmor(_parser) is still at 4.0.2

# ubuntu LTS
u@u2404:~#  /snap/snapd/24792/usr/lib/snapd/apparmor_parser --version
AppArmor parser version 4.0.2

# ubuntu 25.04 container on ubuntu LTS
root@2504_on_u2404:~# apparmor_parser --version
AppArmor parser version 4.1.0~beta5

root@2504_on_u2404:~# /snap/snapd/24792/usr/lib/snapd/apparmor_parser --version
AppArmor parser version 4.0.2

root@2504_on_u2404:~# snap refresh snapd --channel=latest/edge
snapd (edge) 2.70+g181.91c9fa2 from Canonical✓ refreshed
root@2504_on_u2404:~# /snap/snapd/25083/usr/lib/snapd/apparmor_parser --version
AppArmor parser version 4.0.2
Copyright (C) 1999-2008 Novell Inc.
Copyright 2009-2018 Canonical Ltd.

If the kernel changes get merged and distributions ship a current apparmor, that ironically could mean that the sandbox might work; that is until you install the snapd version of snap(?). Although that sounds like ubuntu also could break in that case with such a newer kernel. Canonical probably will have to add some sauce to make that backwards compatible(?) or simply dont ship the newer kernel to older ubuntu distributions.

1 Like