strict mode snaps crash with Segmentation fault on 16.10

[Sergio Schvezov]

Ever since snap-confine 1.0.41-0ubuntu2 got to the yakkety archives running snaps causes a Segmentation fault

http://paste.ubuntu.com/23211497/

[Zygmunt Krynicki (zyga)]

I tried to reproduce this on a 16.04 machine updated to 16.10 (with a reboot to change the kernel). I cannot reproduce it.

[Leo Arias (elopio)]

I can reproduce this in a yakkety machine started by adt-run in scalingstack.

This is the entry from syslog:
Sep 21 16:16:24 adt kernel: [ 997.682383] audit: type=1400 audit(1474474584.561:68): apparmor="DENIED" operation="file_mmap" profile="snap.mosquitto.subscribe" name="/usr/lib/snapd/snap-exec" pid=4525 comm="snap-exec" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0

When running with sudo gdb, it prints:
Cannot find user-level thread for LWP 4622: generic error

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Leo Arias (elopio)]

strace: http://paste.ubuntu.com/23212239/
/etc/apparmor.d/usr.lib.snapd.snap-confine: http://paste.ubuntu.com/23212242/

[Jamie Strandboge (jdstrand)]

The denial is in the default template, not snap-confine (profile="snap.mosquitto.subscribe"). I talked to the apparmor kernel devs and this has to do with the new linux 4.8 kernel and not snap-confine per se. This is a semantic change in the upstream kernel. Per jjohansen, "the location of the mmap check in the binfmt_elf loader changed, and along with it the cred that is used for the check".

The fix will need to be to default policy in snapd, not snap-confine.

[Leo Arias (elopio)]

Added snapcraft as affected because this makes the autopkgtests fail, so it blocks the release to yakkety.

[Jamie Strandboge (jdstrand)]

I was able to reproduce this on a classic 16.10 system only after upgrading the ubuntu-core snap and policy since that is where snap reexec is used. Ie, with:

snap-confine 1.0.41-0ubuntu2
snapd 2.13+16.10
$ cat /proc/version_signature
Ubuntu 4.8.0-11.12-generic 4.8.0-rc6

$ sudo snap install ubuntu-core --channel=edge

$ sudo snap install hello-world

$ snap list
Name Version Rev Developer Notes
hello-world 6.3 27 canonical -
ubuntu-core 16.04.1 687 canonical -

$ hello-world
Segmentation fault

$ grep audit /var/log/syslog
...
Sep 21 15:16:15 sec-yakkety-amd64 kernel: [ 72.061888] audit: type=1400 audit(1474488975.354:29): apparmor="DENIED" operation="file_mmap" profile="snap.hello-world.hello-world" name="/usr/lib/snapd/snap-exec" pid=1328 comm="snap-exec" requested_mask="m" denied_mask="m" fsuid=1000 ouid=0

If you don't have ubuntu-core from edge I found that I needed to reload the security policy. One way to do this is:

$ sudo snap refresh ubuntu-core --channel=edge
$ sudo snap remove hello-world
$ sudo snap install hello-world
$ hello-world
Segmentation fault

[Jamie Strandboge (jdstrand)]

https://github.com/snapcore/snapd/pull/1967

Uploaded 2.15.2+16.10.3 to yakkety.

[Kyle Fazzari (kyrofa)]

Invalidating the Snapcraft task since it's fixed everywhere else.