I'm not done looking at this, but I have confirmed this is a bug in libseccomp so retargeting there. What is happening is that snap-confine is getting a denial on geteuid (syscall 107) even though this syscall is included in the filter. This indicates a problem in the filter setup in libseccomp and not snap-confine itself and this patch appears to fix the issue:
eece06525d58d08fe6bb20e5f635eb02fd8d6eee
However, that patch needs the following to be applied:
9ca83f455562fe8a972823d0e101cc71a8063547
206da04b8b2366d9efb963569bb89fe82ed2d1ba
61fee77783fd458739eb6104f13d53bddfa389ac
While with the above 4 patches applied the snap-confine testsuite passes, the libseccomp internal testsuite has many failures. I'm now investigating if it is better to continue cherrypicking patches or to pull back 2.2.3 from xenial.
I'm not done looking at this, but I have confirmed this is a bug in libseccomp so retargeting there. What is happening is that snap-confine is getting a denial on geteuid (syscall 107) even though this syscall is included in the filter. This indicates a problem in the filter setup in libseccomp and not snap-confine itself and this patch appears to fix the issue: fe6bb20e5f635eb 02fd8d6eee
eece06525d58d08
However, that patch needs the following to be applied: a972823d0e101cc 71a8063547 9efb963569bb89f e82ed2d1ba 739eb6104f13d53 bddfa389ac
9ca83f455562fe8
206da04b8b2366d
61fee77783fd458
While with the above 4 patches applied the snap-confine testsuite passes, the libseccomp internal testsuite has many failures. I'm now investigating if it is better to continue cherrypicking patches or to pull back 2.2.3 from xenial.