Snap installed with --devmode can't use sudo

[Chris Wayne]

When installing a snap that has scripts that call sudo (in this case, checkbox-snappy, available in the store on edge channel), any call to sudo fails with "pkexec must be setuid root" when run on a classic 16.04 or 16.10 system. Calling the snap itself with sudo fixes the issue, but for other reasons we would prefer to elevate to sudo only on scripts where it is required.

snapd: 2.11+16.10
snap-confine: 1.0.38-3
Ubuntu 16.04 + 16.10

Expected results:

A snap installed with --devmode should be able to run sudo

Actual results:

Any call to sudo fails with the error "pkexec must be setuid root"

ProblemType: Bug
DistroRelease: Ubuntu 16.10
Package: snapd 2.11+16.10
ProcVersionSignature: Ubuntu 4.4.0-33.52-generic 4.4.15
Uname: Linux 4.4.0-33-generic x86_64
NonfreeKernelModules: wl
ApportVersion: 2.20.3-0ubuntu2
Architecture: amd64
CurrentDesktop: Unity
Date: Fri Aug 5 11:08:14 2016
InstallationDate: Installed on 2015-04-24 (468 days ago)
InstallationMedia: Ubuntu 15.04 "Vivid Vervet" - Release amd64 (20150422)
SourcePackage: snapd
UpgradeStatus: No upgrade log present (probably fresh install)

[Jamie Strandboge (jdstrand)]

A devmode snap should be able to use sudo. I think the error stems from this:

'Any call to sudo fails with the error "pkexec must be setuid root"'

pkexec is not part of the core snap. sudo itself doesn't call pkexec for anything. Is checkbox using 'sudo something.that.eventually.calls.pkexec'?

[Zygmunt Krynicki (zyga)]

This is not true:

 any call to sudo fails with "pkexec must be setuid root"

This is plainbox attempting to use pkexec after failing to use sudo.

[Sylvain Pineau (sylvain-pineau)]

It was indeed plainbox calling pkexec (the one from the snap). I've landed a change to lower the score of the pkexec execution controller when snappy is detected to always use sudo when we have to run job commands as root.

The updated plainbox is available on pypi: https://pypi.python.org/pypi/plainbox/0.30.post1

I've rebuilt our checkbox snap and with --devmode, we can now run jobs as root without having to call our app with sudo.

I'm setting this as Invalid for snapd.

Thanks a lot for your help and pointers to diagnose this bug.

[Jamie Strandboge (jdstrand)]

Thanks for reporting back Sylvain! :)