mirror of
https://github.com/token2/snapd.git
synced 2026-03-13 11:15:47 -07:00
47ccab3269
* many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor Then when using the internal vendored AppArmor, use a different location for SnapConfineAppArmorDir so that we don't interfere with the system installed AppArmor. In Ubuntu, the snapd deb includes an AppArmor profile for /usr/lib/snapd/snap-confine that includes any profile snippets from the hard-coded directory of /var/lib/snapd/apparmor/snap-confine. When we use the snapd snap with the vendored AppArmor, this may contain newer features and so would create snippets under /var/lib/snapd/apparmor/snap-confine that then may not be supported by the system installed AppArmor. When the system installed apparmor.service would run on boot, it would try and load the snap-confine AppArmor profile shipped in the snapd deb, which would then try and include these snippets generated by the newer vendored AppArmor and could fail to load them as they would use new features not supported by the system AppArmor. So instead, when using the vendored AppArmor, have snapd use a different directory for the snap-confine profile snippets and then have the snapd-generated AppArmor profiles for snap-confine reference this location instead. This should allow to support both use-cases simultaneously. Signed-off-by: Alex Murray <alex.murray@canonical.com> * apparmor: add unit test that ensures that snap-confine include snippet is rewriten * sandbox/apparmor: add unit test around setupConfCacheDirs() * tests: add check check in snapd-snap for /v/l/snapd/apparmor/snap-confine.internal path usage * tests: fix spread test to look at the right profiles * i/apparmor: allow read of /usr/lib/snapd/info in snap-update-ns profile --------- Signed-off-by: Alex Murray <alex.murray@canonical.com> Co-authored-by: Michael Vogt <mvo@ubuntu.com>