Snapd STILL requires out-of-tree apparmor patches for strict confinement

snapd
41

yeah once this lands, LSM stacking is last missing piece to finally be “universal”

the most recent information that i can find on this is: https://lwn.net/Articles/919059 the discussed patchset seems to be merged by now: https://lkml.org/lkml/2023/10/26/1089 there is no sign yet of the “next step” afaict

42

The changes got pulled into linux-next ; so guess it is available as 6.14-rc1

oh wow that’s sooner than expected, i was looking at this, https://www.reddit.com/r/Ubuntu/comments/zoz5qd/comment/m8866es, expecting it in 6.15 :smiley:

found this: it appears that it is not yet available in 6.14-rc2 but perhaps the next RC https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/log/

43

Yes. Stacking support is currently only mainlined for minor security modules (i.e. not AppArmor/SELinux). I thought Fedora would support running their kernels with AppArmor instead of SELinux like RHEL does (AFAIK choosing the LSMs as a kernel parameter), but it seems Fedora does not. I think the kernel has to be build to allow for that. So, bummer. Maybe I’ll switch to Arch on that machine.

44

yes, the missing peace to be able to run confined snaps on SELinux systems. Not sure what works out of the box though. Snap vendors its own apparmor, so hopefully there is not much to do.

its there since rc1; search for apparmor in the revision log; its this commit:

https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=26c200e28a322b308518cda764307c18d7df705d

45

That is the correct commit, however look at the date: February 10th

rc2 was cut out on February 9th: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?h=v6.14-rc2&id=a64dcfb451e254085a7daee5fe51bf22959d52d3

yes snapd vendors apparmor, the challenge is running apparmor on top of SELinux, this does not work currently as far as i know

46

That is the date of the then-current linux-next, which Stephen Rothwell recreates several times a week. It’s not the date it was merged the first time into linux-next. The important part it is in linux-next at the time 6.14 gets released and there is no indication that won’t happen :slight_smile:

47

if that’s not enough for you, then here is linus’s tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/

The RC2 tag on here is the same tag as the rc2 tag on the linux-next tree, so if it has been in since rc1, the commit should also be in this tree :wink:

yes this is the important part :partying_face:

Now i wonder if we can reach out to the solus people to get some positive PR :smiley:

Note that it isn’t the case that we’re dropping Snap support because we hate snaps, so we’ll gladly reverse on the deprecation decision if it turns out that no patches are needed for strict confinement (and things stay that way).

48

hm, yes it is not there. and the merge window is closed, so i am not sure it gets into 6.14 sigh

We should not tell the Solus people before it is released (definitly not before it is in linus tree); AFAIU they have nobody/not enough manpower to care about the kernel so it would not speed up anything even in the best case.

49

hmmm so it might be a 6.15 release after all :thinking:

hmmm but given they did do the patches before, and apparently not knowing which patches were actually needed, they likely could take this smaller patch until 6.15 :thinking:

at least we could slow their snap deprecation down hehe

50

snap deprecation in solus has been delayed:

Tho it appears they may need need help to get it working with the upstream work