Snap application cannot be run as snap_daemon user out of the box

Bug #2011581 reported by Shayan
14
This bug affects 3 people
Affects Status Importance Assigned to Milestone
snapd
New
Undecided
Unassigned

Bug Description

The MySQL charm uses the charmed-mysql snap (https://github.com/canonical/charmed-mysql-snap). This snap contains all the binaries required to run a MySQL charm (e.g. mysql-server, mysql-shell, xtrabackup, etc) installed from apt packages. The charmed-mysql snap has a daemon (https://github.com/canonical/charmed-mysql-snap/blob/8.0/edge/snap/snapcraft.yaml#L54-L60) to run mysqld, which is run as the snap_daemon user (https://github.com/canonical/charmed-mysql-snap/blob/8.0/edge/snap/local/start-mysqld.sh#L3-L4).

Since mysqld is run as snap_daemon, the MySQL data files are owned by the snap_daemon user. Thus, when the charm runs an application binary (e.g. xtrabackup - https://github.com/canonical/charmed-mysql-snap/blob/8.0/edge/snap/snapcraft.yaml#L100-L105), it must be run as snap_daemon to have access to the data files.

The home directory for the snap_daemon user is `/nonexistent` by default, and we run into the following error when we try to invoke the charmed-mysql.xtrabackup binary with the snap_daemon user in python using subprocess:

```
cmd_run.go:1046: WARNING: cannot create user data directory: cannot create snap home dir: mkdir /nonexistent: permission denied
cmd_run.go:1046: WARNING: cannot create user data directory: cannot create snap home dir: mkdir /nonexistent: permission denied
Sorry, home directories outside of /home are not currently supported.
See https://forum.snapcraft.io/t/11209 for details.
Sorry, home directories outside of /home are not currently supported.
```

The python code that tries to execute charmed-mysql.xtrabackup binary as the snap_daemon user is:

```
import subprocess

user = "snap_daemon"
group = "snap_daemon"
command = "/snap/bin/charmed-mysql.xtrabackup --help".split()
env = {}

process = subprocess.run(
    command,
    user=user,
    group=group,
    capture_output=True,
    text=True,
    env=env,
    encoding="utf-8",
)
print("stdout: ", process.stdout)
print("stderr: ", process.stderr)
```

Shayan (shayanp)
description: updated
tags: added: canonical-data-platform-eng
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.