snapd no longer detects apparmor changes on upgrade

[Jamie Strandboge]

snappy in 16.04 used to compare /usr/share/snappy/security-policy-version and /var/lib/snappy/security-policy-version on boot to see if the apparmor package changed and therefore if it needed to regenerate all snap policy. This functionality was recently removed with nothing added to replace it.

snapd must have a means to detect changes to the parser or the abstractions which the snap may #include, otherwise we cannot deliver parser and policy fixes from apparmor to installed snaps. It is fine to use a different method than what we had before, but we need to have something.

[Zygmunt Krynicki (zyga)]

I discussed this issue with Gustavo and we think that apparmor itself should detect this and re-load all profiles when a change to any of the parsers or templates occurs. From snappy's POV we will re-load all profiles for a specific snap each time something in that snap changes *AND* we promise to detect changes to the internal templates built into snappy. We would not like to detect changes to apparmor itself as that can be done by a systemd job shipped with apparmor. That job should simply compile and re-load all the profiles stored in a standard directory (or have a way for snappy to tell apparmor that it stores profiles in a non-standard directory).

What do you think?

[Jamie Strandboge (jdstrand)]

If you want apparmor to handle it, then it can do essentially what snappy was doing before by tucking away the version somewhere in its packaging and comparing it to a cached version somewhere on the device.

[Jamie Strandboge (jdstrand)]

Ok, I've added an apparmor task and assigned to me. Leaving the snappy tasks open for "we will re-load all profiles for a specific snap each time something in that snap changes *AND* we promise to detect changes to the internal templates built into snappy" where I understand the first part is done but the changes to internal templates is not. Assigning zyga for the time being-- please adjust as necessary.

[Zygmunt Krynicki (zyga)]

This is now done in 2.23