snap-confine: mounts happen in the wrong order

[Kyle Fazzari]

This manifests itself on any system where / isn't MS_SHARED, in my particular experience, lxd. The side effect is that, when it comes time to garbage collect old snap revisions, they can't be unmounted, thus preventing the update from finishing.

A thorough breakdown of the issue by Stephane is here:

https://discuss.linuxcontainers.org/t/snapd-cant-remove-old-revisions-when-running-inside-lxd/452/3

[Kyle Fazzari (kyrofa)]

Setting to critical in alignment with forum post: https://forum.snapcraft.io/t/lxc-error-when-updating-snap-and-cleaning-old-revisions/786 .

[Kyle Fazzari (kyrofa)]

From the sound of the forum post, this is not actually in progress.

[Zygmunt Krynicki (zyga)]

I did a few attempts at fixing this bug and I plan to do some more soon but it's still open. The good side is that we now seem to have an agreement with security on how to approach this. The bad thing is that we don't have the fix in place yet and in case we run into more aspects that would intersect security we may need to wait for a moment for a slice of their time.

[Zygmunt Krynicki (zyga)]

This is now fixed in master and will be released in 2.31

[Zygmunt Krynicki (zyga)]

This has been fixed and released (eventually) in 2.32.x series.