snap-confine doesn't work from per-snap namespaces it creates

[Zygmunt Krynicki]

This is a mirror of the following github issue:

https://github.com/snapcore/snap-confine/issues/179

Technically this is caused by the fact that per-snap namesapce doesn't contain /run/snapd/ns/ from the outer, main mount namespace as it has to be a privately shared mount point to satisfy kernel requirements.

As a solution snap-confine should measure the namespace of pid 1 and its own namespace and setns to the pid 1 namespace if they differ, before trying to create a derivative namespace of any kind.

[Chris Wayne (cwayne)]

Any update on this?

[Zygmunt Krynicki (zyga)]

This is now tracked as https://github.com/snapcore/snapd/pull/2624

There's a chance this will not land as it seems to cause an oops in the kernel.

[Zygmunt Krynicki (zyga)]

This has been fixed and is pending merge. The next kernel SRU on the 20th of Feb should allow us to land the fix.

[Chris Wayne (cwayne)]

Any progress on getting this SRUd?

[Jerry Kao (jerry.kao)]

Is there any update on this?

[Zygmunt Krynicki (zyga)]

This is now bound to the release cycle of the -67 ubuntu kernel for Xenial (and other releases).