setup-profile configures security based on snap.Info from DisconnectSnap, which still sees older revision
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Snappy |
Fix Released
|
High
|
Zygmunt Krynicki | ||
snapd (Ubuntu) |
Fix Released
|
High
|
Zygmunt Krynicki | ||
Xenial |
Fix Released
|
High
|
Zygmunt Krynicki |
Bug Description
When the same snap is sideloaded two times the security profile stops working:
```
$ sudo snap install youtube-
[\] Setup snap "youtube-dl" security profiles
$ youtube-dl.run
WARNING: Assuming --restrict-
Usage: youtube-dl [OPTIONS] URL [URL...]
youtube-dl: error: You must provide at least one URL.
Type youtube-dl --help to see a list of all options.
$ sudo snap install youtube-
[-] Copy snap "youtube-dl" data
$ youtube-dl.run
/bin/sh: 0: Can't open /snap/youtube-
$ dmesg|tail -n1
[13348.347319] audit: type=1400 audit(146114383
$ grep SNAP_REVISION}= /var/lib/
@{SNAP_
```
$ snap changes|grep sideload
6 Done 2016-04-
7 Done 2016-04-
Changed in snapd (Ubuntu): | |
status: | New → In Progress |
importance: | Undecided → High |
assignee: | nobody → Zygmunt Krynicki (zyga) |
Changed in snappy: | |
milestone: | none → sru-1 |
status: | New → Triaged |
importance: | Undecided → High |
Changed in snappy: | |
status: | Triaged → Fix Committed |
assignee: | nobody → Zygmunt Krynicki (zyga) |
Changed in snapd (Ubuntu): | |
status: | In Progress → Fix Committed |
Changed in snapd (Ubuntu Xenial): | |
status: | In Progress → Fix Committed |
tags: |
added: verification-done removed: verification-needed |
Changed in snappy: | |
status: | Fix Committed → Fix Released |
Here is the output of syslog:
``` snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 28 on Do: Mount snap "youtube-dl" snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 29 on Do: Copy snap "youtube-dl" data snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 30 on Do: Setup snap "youtube-dl" security profiles 3.099:127) : apparmor="STATUS" operation= "profile_ replace" profile= "unconfined" name="snap. youtube- dl.run" pid=28776 comm="apparmor_ parser" snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 31 on Do: Make snap "youtube-dl" available to the system dl_2016. 03.27_amd64. snap]: <nil> 6.683:128) : apparmor="DENIED" operation="open" profile= "snap.youtube- dl.run" name="/ proc/28781/ mounts" pid=28781 comm="python3" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000 6.839:129) : apparmor="DENIED" operation="exec" profile= "snap.youtube- dl.run" name="/ sbin/ldconfig" pid=28782 comm="python3" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 6.847:130) : apparmor="DENIED" operation="exec" profile= "snap.youtube- dl.run" name="/ sbin/ldconfig" pid=28784 comm="python3" requested_mask="x" denied_mask="x" fsuid=1000 ouid=0 snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 33 on Do: Mount snap "youtube-dl" snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 34 on Do: Make current revision for snap "youtube-dl" unavailable snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 35 on Do: Copy snap "youtube-dl" data snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 36 on Do: Setup snap "youtube-dl" security profiles 1.159:131) : apparmor="STATUS" operation= "profile_ replace" profile= "unconfined" name="snap. youtube- dl.run" pid=28846 comm="apparmor_ parser" snapd/snapd[ 2951]: taskrunner.go:234: DEBUG: Running task 37 on Do: Make snap "youtube-dl" available to the system dl_2016. 03.27_amd64. snap]: <nil> 3.011:132) : apparmor="DENIED" operation="open" profile= "snap.youtube- dl.run" name="/ snap/youtube- dl/100002/ command. ..
Apr 20 11:17:02 top /usr/lib/
Apr 20 11:17:02 top systemd[1]: Mounting Squashfs mount unit for youtube-dl...
Apr 20 11:17:03 top systemd[1]: Mounted Squashfs mount unit for youtube-dl.
Apr 20 11:17:03 top /usr/lib/
Apr 20 11:17:03 top /usr/lib/
Apr 20 11:17:03 top kernel: [13338.436765] audit: type=1400 audit(146114382
Apr 20 11:17:03 top /usr/lib/
Apr 20 11:17:03 top snap[28710]: main.go:151: DEBUG: cannot parse arguments: [snap install youtube-
Apr 20 11:17:06 top kernel: [13342.020641] audit: type=1400 audit(146114382
Apr 20 11:17:06 top kernel: [13342.178885] audit: type=1400 audit(146114382
Apr 20 11:17:06 top kernel: [13342.183377] audit: type=1400 audit(146114382
Apr 20 11:17:10 top /usr/lib/
Apr 20 11:17:11 top systemd[1]: Mounting Squashfs mount unit for youtube-dl...
Apr 20 11:17:11 top systemd[1]: Mounted Squashfs mount unit for youtube-dl.
Apr 20 11:17:11 top /usr/lib/
Apr 20 11:17:11 top /usr/lib/
Apr 20 11:17:11 top /usr/lib/
Apr 20 11:17:11 top kernel: [13346.496807] audit: type=1400 audit(146114383
Apr 20 11:17:11 top /usr/lib/
Apr 20 11:17:11 top snap[28789]: main.go:151: DEBUG: cannot parse arguments: [snap install youtube-
Apr 20 11:17:13 top kernel: [13348.347319] audit: type=1400 audit(146114383