Snapd STILL requires out-of-tree apparmor patches for strict confinement

It is being worked on. A new version of the af_unix patches revised to solve the problems with upstreaming them should land in one of either the 6.7 or 6.8 kernels.


Yep, still sad to see that we are still in the same boat.

I still patch my own kernels to have proper support for snapd, but is there any out-of-tree kernel patches available for 5.16.x and newer?

Currently, I am still on 5.10.y or 5.15.y with Ubuntu Core 20 on my gateways, and would love to run a recent ‘mainline’ kernel (whatever the latest kernel version is, 6.5?) with proper snapd support.

I guess this didn’t land on 6.7 but, do you still think 6.8 might get it?

By the way, thanks for all the hard work!


Sorry to necro this thread…

Quick question, I have a 6.1 imx kernel that I want to patch for full confinement, is there any Apparmor patches required for it to have full ‘strict’ confinement, could someone point me in the right direction?

My knowledge of C is not so polished, much less to port over the AF_UNIX patches from 5.15 to 6.1…

Many thanks.

I know this is not the answer you are looking for but I will be working on updating yocto meta-layers and I plan to get the currently supported versions of Yocto (and the kernels used by default) to work. I know IMX has separate meta-layers but it might come out as a part of that.

Or, one could probably look at the 6.1 Ubuntu kernel sources and try to make a diff patch for the kernel to be patched…

Just a brainwave I had last-night.

I already have some 5.15 and 5.10 patches for mainline? kernels. I cannot promise that I will make a 6.1.y patchset for full snapd confinement support (that includes AF_UNIX for AppArmor) and if I do so, I will make a new post on the forum, linking my patchset for everyone to use.

1 Like

The patches are broken out and apply mostly quite cleanly, since the changes are fairly isolated. Those are in Yocto meta-layer but also in several other places.

Thanks, as soon as I can get some time on my hands, I have a look at the patches, and use them as a reference, for creating a 6.1.x mainline? patchset, and link those on my Github.


This task slips down the week as I’m going to be busy with the snapd point release but I will update this post once I have something specific.


Good day.

I made a experimental 6.1.0 kernel patch, based on Canonical’s kernel sources.

You can find it on Github:

I hope this can help in getting your custom kernel(s) supported for Ubuntu Core.

NOTE: This has been done over the weekends, I cannot promise you that your kernel will compile successfully, but mine did, and it worked. YMMV.


Hi again! @jjohansen will this be included in kernel 6.9?


1 Like

I just wondered about the patch set in the ubuntu kernel, its like 90 patches for apparmor. Is my assumption correct that you (@ruhan.vanderberg) only needed to apply the ~3 patches for AF_UNIX mediation and the other patches in the ubuntu kernel are for LSM stacking (and not necessary for strict snap confinement)?

And @pachulo no, AF_UNIX mediation did not go into 6.9 (and it does not seem to go into 6.10 either) :frowning: