snapcraft produces snaps with dangling external symlinks
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Canonical Click Reviewers tools (obsolete) |
Fix Released
|
High
|
Jamie Strandboge | ||
Snapcraft |
Fix Released
|
High
|
Sergio Schvezov |
Bug Description
I used snapcraft to package minecraft (to test security policy on a non-trivial java program). Here is the bzr tree: lp:~jdstrand/+junk/minecraft-snap
$ click-review minecraft_
Errors
------
- lint_external_
package contains external symlinks: /tmp/clickrevie
This check in the review tools is looking at the symlink in the unpacked snap and seeing if they point outside of the snap's directories. The goal of the check is to point out problems when installing a snap on a minimal system like Ubuntu Core where the target files may not exist. For example, after installing the snap, /apps/minecraft
This is not a security issue because AppArmor will resolve the symlinks before applying policy.
This is known to at least affect 'stage-packages: openjdk-
WORKAROUND: if you have a snap that does this, use snapcraft, run the review tools on it to see the list external symlinks, then unpack the snap, remove the external symlinks, then repack the snap.
Related branches
- John Lenton (community): Approve
-
Diff: 106 lines (+44/-4)4 files modifiedplugins/jdk.yaml (+2/-0)
snapcraft/repo.py (+37/-3)
snapcraft/sources.py (+1/-1)
snapcraft/tests/test_repo.py (+4/-0)
Changed in snapcraft: | |
milestone: | none → 0.3 |
Changed in click-reviewers-tools: | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in snapcraft: | |
status: | New → Fix Committed |
Changed in click-reviewers-tools: | |
status: | Triaged → Fix Committed |
Changed in click-reviewers-tools: | |
status: | Fix Committed → Fix Released |
Changed in snapcraft: | |
status: | Fix Committed → Fix Released |
Assigning to Sergio since when we spoke about this on IRC he said he'd jump right on it since it blocks autopublication in the store.