With the following YAML built with "snapcraft, version 3.0.1" tested against Ubuntu 18.10 (snap version below) the resultant snap can be installed twice (executing the configured app to ensure the mount namespace is set-up) but fails on the third attempt. Executing `/usr/lib/snapd/snap-discard-ns` allows two more successful subsequent attemps and then the third fails as before. This seems to be specific to non-native triplet folders in `/usr/lib` - I tested this on x86_64, so the native `/usr/lib` triplet is `x86_64-linux-gnu`. Testing with the native triplet instead of `i386-linux-gnu` does not fail however many attempts I make.
```plain
$ snap version
snap 2.36.2
snapd 2.36.2
series 16
ubuntu 18.10
kernel 4.18.0-12-generic
```
```plain
# attempt 1
$ sudo snap install layout-test_1_amd64.snap --dangerous
layout-test 1 installed
$ layout-test
[OK] bind mount works
[OK] symlink works
done.
# attempt 2
$ sudo snap install layout-test_1_amd64.snap --dangerous
layout-test 1 installed
$ layout-test
[OK] bind mount works
[OK] symlink works
done.
# attempt 3
$ sudo snap install layout-test_1_amd64.snap --dangerous
error: cannot perform the following tasks:
- Setup snap "layout-test" (unset) security profiles (cannot setup mount for snap "layout-test": cannot update mount namespace of snap "layout-test": cannot update preserved namespace of snap "layout-test": cannot update snap namespace: cannot write to "/usr/lib/i386-linux-gnu/test.txt" because it would affect the host in "/usr/lib/i386-linux-gnu")
- Setup snap "layout-test" (unset) security profiles (cannot update mount namespace of snap "layout-test": cannot update preserved namespace of snap "layout-test": cannot update snap namespace: cannot write to "/usr/lib/i386-linux-gnu/test.txt" because it would affect the host in "/usr/lib/i386-linux-gnu")
```
```yaml
name: layout-test
version: '1'
summary: layout-test
description: layout-test
grade: devel
confinement: strict
base: core18
layout:
/usr/lib/i386-linux-gnu/test:
bind: $SNAP
/usr/lib/i386-linux-gnu/test.txt:
symlink: $SNAP/test.txt
parts:
layout-test:
plugin: dump
source: .
override-pull: |
cat > test.txt <<EOF
This is a test file
EOF
cat > test.sh <<EOF
#!/bin/bash
if [ -f "/usr/lib/i386-linux-gnu/test/test.txt" ]; then
echo '[OK] bind mount works'
else
echo '[FAIL] bind mount is broken'
fi
if [ -f "/usr/lib/i386-linux-gnu/test.txt" ]; then
echo '[OK] symlink works'
else
echo '[FAIL] symlink is broken'
fi
echo 'done.'
EOF
chmod +x test.sh
apps:
layout-test:
command: test.sh
```
I spent some time looking at this and I cannot reproduce it on 2.36.3 on openSUSE Tumbleweed. I will add a test that examines the mount changes across the layout mount profile evolution to see if we are doing something wrong there.
My gut feeling is that there is some other factor at play that is missing from the test.