"enable" does not apply connected slot security policy

[Alberto Aguirre]

Using:
snap 2.26.14+git292.6ceaef7~ubuntu16.04.1
snapd 2.26.14+git292.6ceaef7~ubuntu16.04.1

When enabling/disabling a snap that is connected to a slot, the Rules that apply to the connected slot apparently don't run.

For example, when installing mir-kiosk and mir-kiosk-apps, you can see the following crucial apparmor rule applied to mir-kiosk, which allows it to receive data from mir-kiosk-apps, as they are connected through the mir interface:

cat /var/lib/snapd/apparmor/profiles/snap.mir-kiosk.mir-kiosk | grep unix:

unix (receive, send) type=seqpacket addr=none peer=(label="snap.mir-kiosk-apps.mir-kiosk-app-daemon")

However, after doing snap disable mir-kiosk-apps; snap enable mir-kiosk-apps, the rule is no longer applied.

[Michael Vogt (mvo)]

I can still reproduce this git master. I remember we fixed an issue with disable/enable a while ago.

[Zygmunt Krynicki (zyga)]

I fixed this locally and will send a PR shortly.

[Zygmunt Krynicki (zyga)]

This is now fixed with the following PR: https://github.com/snapcore/snapd/pull/4430

[Zygmunt Krynicki (zyga)]

The fix has just been merged into master. It should be available along with the next snapd release (circa 2.31)

[Zygmunt Krynicki (zyga)]

This was released a long time ago, marking as fix released.