snap's device cgroup is not discarded upon uninstall

[Ian Johnson]

When developing snaps that plug an interface that generates udev code and thus triggers enforcement of the device cgroup for the snap, removing the snap doesn't remove the device cgroup for the snap, and thus even if the snap is rebuilt and reinstalled with interfaces that don't trigger the device cgroup, the device cgroup is still being enforeced.

I think snap-discard-ns (or something else) should remove the device cgroup when the snap is uninstalled.

[Ian Johnson (anonymouse67)]

I think that all that needs to happen is after all processes from the device cgroup have died/been killed is just to remove the /sys/fs/cgroup/devices/$SNAP_NAME.$SNAP_APP/ directory to remove the cgroup.

[Zygmunt Krynicki (zyga)]

This is related to apparmor cleanup. Once we implement cgroup vacancy notification we can address this. For now it is just acknowledged.

[Zygmunt Krynicki (zyga)]

This will happen naturally as a consequence of the agent work I'm doing now.

[Ian Johnson (anonymouse67)]

Zygmunt, did you ever get a chance to work on this?

[Zygmunt Krynicki (zyga)]

Long story short, the approach was discarded.

The approach used a cgroup release agent that would be notified of cgroup vacancy and would remove it from the system with a single `rmdir` system call. We ultimately failed to get it to work across all the combinations of supported systems.

Having looked at the bug description I must say we cannot use snap-discard-ns to do this, because it would affect existing processes. Similarly to how we cannot remove apparmor profiles because that would remove confinement from applications that still keep running.

[Ian Johnson (anonymouse67)]

Thanks for the additional context