glib not aware of snap confinement

[Robert Ancell]

[ Impact]

glib is not aware of snap confinement and this causes the internal logic to decide when to use portals to not work as designed. One important case is the gsettings backend, which should use a keyfile when confined rather than using dconf. When using a fully confined desktop this is required, as dconf is not suitable for sharing between snaps.

This has been fixed in glib main: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3020

[ Test Plan ]

(requires a core snap running the updated glib).

1. Install gnome-calculator snap:
$ snap install gnome-calculator
2. Disconnect gsettings interface:
$ snap disconnect gnome-calculator:gsettings
3. Run gnome-calculator
4. Change mode from basic to advanced
5. Close and re-open gnome-calculator

Expected result:
Mode change remembered on second run. gnome-calculator settings written to ~/snap/gnome-calculator/current/.config/glib-2.0/settings/keyfile

Observed result:
Mode change not remembered on second run, errors shown in console about accessing dconf:
(gnome-calculator:1031938): dconf-CRITICAL **: 14:08:56.034: unable to create file '/run/user/1000/snap.gnome-calculator/dconf/user': Permission denied. dconf will not work properly.

[ Where problems could occur ]

- New bug introduced in glib causing a crash.
- Security issue introduced in glib due to accessing snapctl.
- Unexpected behaviour change when running snaps with updated glib.

[Robert Ancell (robert-ancell)]

Targeting 22.04 so this can become part of the core22 snap fixing the issue for most modern snaps.

[Sebastien Bacher (seb128)]

The upstream PR has been merged and we got the new glib serie in Lunar so assuming it's fixed there

[Chris Halse Rogers (raof)]

Hello Robert, or anyone else affected,

Accepted glib2.0 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/glib2.0/2.72.4-0ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted glib2.0 (2.72.4-0ubuntu2) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

auto-multiple-choice/1.5.2-1willsync1 (arm64)
dbus/1.12.20-2ubuntu4.1 (armhf)
fwupd/1.7.9-1~22.04.1 (armhf)
golang-github-ostreedev-ostree-go/0.0+git20190702.759a8c1-4 (s390x)
gvfs/1.48.2-0ubuntu1 (ppc64el)
mutter/42.5-0ubuntu1 (amd64)
udisks2/2.9.4-1ubuntu2 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#glib2.0

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Robert Ancell (robert-ancell)]

Tested glib2.0 2.72.4-0ubuntu2 in a jammy VM and working.

[Robert Ancell (robert-ancell)]

I've looked at the autopkgtests and the failures don't seem to be related to this change.

[Robie Basak (racb)]

Thanks. I agree and I've added a hint. This should hopefully clear the flag on the next (Jammy) britney run.

[Robie Basak (racb)]

In the meantime, please could you confirm what [sorry, that's ambiguous; I mean *how*] you tested?

[Robert Ancell (robert-ancell)]

I tested a standard jammy desktop in a VM by running various apps including calculator to confirm they were still working (i.e. looking for regressions).

I tested the core desktop behaviour by building the core22-desktop snap from https://github.com/canonical/core-base-desktop/ (locally modified to use updates) and then installing that into a core desktop.

[Andreas Hasenack (ahasenack)]

Hello Robert,

the [test plan] has very specific steps involving the calculator, gsettings, and an expected result. Did you perform those specifically?

[Robert Ancell (robert-ancell)]

Yes, these specific steps performed in a core desktop VM.

[Andreas Hasenack (ahasenack)]

I verified that the test was executed according to the [test plan].

I understand kinetic is not part of this SRU. The reason wasn't explained anywhere, but I'm assuming it's because it's a) ending support soon; and/or b) this glib update is more useful for core22 snap and core desktop deployments, which are 22.04 only (am I correct?).

That being said, of course it will also be available to regular 22.04 desktops, so it must not break that scenario. And this was tested in comment #9.

The package built correctly in all architectures and Ubuntu releases it was meant for.

There are no DEP8 regressions, or they were fixed.

There is no SRU freeze ongoing at the moment.

There is no halted phasing on the previous update.

[Launchpad Janitor (janitor)]

This bug was fixed in the package glib2.0 - 2.72.4-0ubuntu2

---------------
glib2.0 (2.72.4-0ubuntu2) jammy; urgency=medium

  * d/p/0001-gio-Make-portal-support-aware-of-snaps.patch:
    - Make portal support aware of snaps (LP: #1998267)

 -- Robert Ancell <email address hidden> Wed, 22 Mar 2023 15:52:13 +1300

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for glib2.0 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Robert Ancell (robert-ancell)]

Correct, this fix is valuable for core22, so kinetic was skipped. There should be no issues for anyone updating from jammy to kinetic. Though this will affect core20, we expect most snaps to be using core22 so no plan to backport it to focal.