classic confinement reexec and using the snap command *inside* the snap

Bug #1704860 reported by Adam Stokes
46
This bug affects 8 people
Affects Status Importance Assigned to Milestone
snapd
Fix Released
Critical
Zygmunt Krynicki

Bug Description

Doing a snap install conjure-up --classic on a fresh 16.04.02 system with snapd 2.25 installed. Causes snapd to update itself to 2.26.9 and breaking classic snap installs that use the "snap" command inside their classic confinement in the process.

This is the forum post related to this bug:

https://forum.snapcraft.io/t/snapd-2-26-9-and-conjure-up-no-longer-work/1348

And the related PR

https://github.com/snapcore/snapd/pull/3598

This was the last post from zyga during the writing of this bug:

```
So I think this is going on:

zyga@fyke:~/go/src/github.com/snapcore/snapd/client$ snap --version
snap 2.26.9
snapd 2.26.9
series 16
ubuntu 16.04
kernel 4.8.0-58-generic
Now let's run a shell of a snap with classic confinement:

zyga@fyke:~/go/src/github.com/snapcore/snapd/client$ snap run --shell conjure-up.lxd
zyga@fyke:~/go/src/github.com/snapcore/snapd/client$ snap --version
snap 2.25
snapd 2.26.9
series 16
ubuntu 16.04
kernel 4.8.0-58-generic
What just happened? We are still in the main mount namespace so /usr/bin/snap is the distro version. We have however set SNAP_DID_REEXEC=1 and SNAP_REEXEC= so subsequent invocations of snap will just run from the distro package and never attempt to re-exec into the core snap.

This means that classic confinement snaps will use the wrong snap, the wrong snap-confine and won't understand snap-seccomp.

Reply
 Bookmark Share Flag Reply
```

Tags: conjure
tags: added: conjure
Michael Vogt (mvo)
summary: - classic confinement reexec
+ classic confinement reexec and using the snap command *inside* the snap
description: updated
Zygmunt Krynicki (zyga)
Changed in snapd:
status: New → In Progress
importance: Undecided → Critical
assignee: nobody → Zygmunt Krynicki (zyga)
Revision history for this message
Adam Stokes (adam-stokes) wrote :

I have tested the beta core snap and can confirm conjure-up is able to work again

Thank you,
Adam

Revision history for this message
Felipe Alfaro Solana (felipe-alfaro-gmail) wrote :

Not sure if it's related, but with the "core" beta snapd, now conjure-up fails in a mysterious way:

# conjure-up.lxd init
error: Unable to talk to LXD: Get http://unix.socket/1.0: dial unix /var/snap/conjure-up/common/lxd/unix.socket: connect: no such file or directory

Revision history for this message
George Kraft (cynerva) wrote :

The beta core snap fixes kubernetes-test.e2e trying to call kubectl, too. Cheers.

Revision history for this message
Adam Stokes (adam-stokes) wrote :

Felipe,

Different issue please head over to https://github.com/conjure-up/conjure-up/issues

Zygmunt Krynicki (zyga)
Changed in snapd:
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.