From 2b199658c58017293231cfcbe70d0df7991049a5 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 27 May 2024 09:06:57 +0200 Subject: [PATCH 1/5] Update to 2.63 Small build change related to snap-seccomp, so that the progarm continues to build on rawhide (-D_GNU_SOURCE) and another change related to a stale removal of -Bstatic. Signed-off-by: Zygmunt Krynicki --- .gitignore | 3 +++ snapd.spec | 63 +++++++++++++++++++++++++++++++++++++++++++++++------- sources | 5 +++-- 3 files changed, 61 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 24dca27..045c011 100644 --- a/.gitignore +++ b/.gitignore @@ -104,3 +104,6 @@ /snapd_2.61.2.only-vendor.tar.xz /snapd_2.62.no-vendor.tar.xz /snapd_2.62.only-vendor.tar.xz +/snapd_2.63.no-vendor.tar.xz +/snapd_2.63.only-vendor.tar.xz +/snapd_2.63.vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 81658ad..274ae7b 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.62 +Version: 2.63 Release: 0%{?dist} Summary: A transactional software package manager License: GPLv3 @@ -132,7 +132,7 @@ Provides: %{name}-login-service%{?_isa} = 1.33 %endif %if ! 0%{?with_bundled} -BuildRequires: golang(github.com/boltdb/bolt) +BuildRequires: golang(go.etcd.io/bbolt) BuildRequires: golang(github.com/coreos/go-systemd/activation) BuildRequires: golang(github.com/godbus/dbus) BuildRequires: golang(github.com/godbus/dbus/introspect) @@ -225,7 +225,7 @@ BuildArch: noarch %endif %if ! 0%{?with_bundled} -Requires: golang(github.com/boltdb/bolt) +Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/coreos/go-systemd/activation) Requires: golang(github.com/godbus/dbus) Requires: golang(github.com/godbus/dbus/introspect) @@ -254,7 +254,7 @@ Requires: golang(gopkg.in/yaml.v3) # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) # *sigh*... I hate golang... -Provides: bundled(golang(github.com/snapcore/bolt)) +Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) Provides: bundled(golang(github.com/godbus/dbus)) Provides: bundled(golang(github.com/godbus/dbus/introspect)) @@ -534,10 +534,8 @@ BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl ) -%if 0%{?rhel} -# There's no static link library for libseccomp in RHEL/CentOS... -sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go -%endif +# We need -D_GNU_SOURCE to include xfs/linux.h for fallocate. +sed -e 's,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE,' -i cmd/snap-seccomp/main.go %gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp ( @@ -809,6 +807,7 @@ popd %dir %{_sharedstatedir}/snapd %dir %{_sharedstatedir}/snapd/assertions %dir %{_sharedstatedir}/snapd/cookie +%dir %{_sharedstatedir}/snapd/cgroup %dir %{_sharedstatedir}/snapd/dbus-1 %dir %{_sharedstatedir}/snapd/dbus-1/services %dir %{_sharedstatedir}/snapd/dbus-1/system-services @@ -945,6 +944,54 @@ fi %changelog +* Wed Apr 24 2024 Ernest Lotter +- New upstream release 2.63 + - Support for snap services to show the current status of user + services (experimental) + - Refresh app awareness: record snap-run-inhibit notice when + starting app from snap that is busy with refresh (experimental) + - Refresh app awareness: use warnings as fallback for desktop + notifications (experimental) + - Aspect based configuration: make request fields in the aspect- + bundle's rules optional (experimental) + - Aspect based configuration: make map keys conform to the same + format as path sub-keys (experimental) + - Aspect based configuration: make unset and set behaviour similar + to configuration options (experimental) + - Aspect based configuration: limit nesting level for setting value + (experimental) + - Components: use symlinks to point active snap component revisions + - Components: add model assertion support for components + - Components: fix to ensure local component installation always gets + a new revision number + - Add basic support for a CIFS remote filesystem-based home + directory + - Add support for AppArmor profile kill mode to avoid snap-confine + error + - Allow more than one interface to grant access to the same API + endpoint or notice type + - Allow all snapd service's control group processes to send systemd + notifications to prevent warnings flooding the log + - Enable not preseeded single boot install + - Update secboot to handle new sbatlevel + - Fix to not use cgroup for non-strict confined snaps (devmode, + classic) + - Fix two race conditions relating to freedesktop notifications + - Fix missing tunables in snap-update-ns AppArmor template + - Fix rejection of snapd snap udev command line by older host snap- + device-helper + - Rework seccomp allow/deny list + - Clean up files removed by gadgets + - Remove non-viable boot chains to avoid secboot failure + - posix_mq interface: add support for missing time64 mqueue syscalls + mq_timedreceive_time64 and mq_timedsend_time64 + - password-manager-service interface: allow kwalletd version 6 + - kubernetes-support interface: allow SOCK_SEQPACKET sockets + - system-observe interface: allow listing systemd units and their + properties + - opengl interface: enable use of nvidia container toolkit CDI + config generation + * Thu Mar 21 2024 Ernest Lotter - New upstream release 2.62 - Aspects based configuration schema support (experimental) diff --git a/sources b/sources index 869f45e..3bb8564 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -SHA512 (snapd_2.62.no-vendor.tar.xz) = 3fb9fa65e25e7deec7e92def9b60f756cfce35c00b90e5cc370bd641034414313f07c973fcbdef4c58e7a9abc20197316fd51a4a2bf5087088a0593b59104590 -SHA512 (snapd_2.62.only-vendor.tar.xz) = d07a3ba83cad8d25fc03ecb7efc69e8e3f105e41c076bc5b450acf4e98409f11f738b65f542965fac5ccaa56eb9f7b1b36aa06f8b68cd3549b9d2a01b10faa09 +SHA512 (snapd_2.63.no-vendor.tar.xz) = 5973b7922f2caf1d4b0bc0db4fe5564134b04d6ca3b52204e9963b584bd80a91789c46902840169f9a8b1b1184820c86902401f585915ca06a010d81a2d9a453 +SHA512 (snapd_2.63.only-vendor.tar.xz) = 3ff9b8610c01997935b720e883644597f7d397a9a7b7e23eadbe95a67f62564e9d4d836c5667e39f95ed073115b106d58e5f4107f229c72014433414168baaa7 +SHA512 (snapd_2.63.vendor.tar.xz) = 956ee142ab6cb5de522307f7844819c861b2831e22dab56f7bfca16ff7f947093f8a8727d49370cc000ed71f3af9c57cff9c4be93ebf199e8c631a152a68ec5b From 3b170ec4243ed5101c2ece59710274039db5793a Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 27 May 2024 09:06:57 +0200 Subject: [PATCH 2/5] Update to 2.63 Small build change related to snap-seccomp, so that the progarm continues to build on rawhide (-D_GNU_SOURCE) and another change related to a stale removal of -Bstatic. Signed-off-by: Zygmunt Krynicki --- .gitignore | 108 +---------------------------------------------------- snapd.spec | 63 +++++++++++++++++++++++++++---- sources | 4 +- 3 files changed, 59 insertions(+), 116 deletions(-) diff --git a/.gitignore b/.gitignore index 24dca27..e5d0e26 100644 --- a/.gitignore +++ b/.gitignore @@ -1,106 +1,2 @@ -/snapcore-selinux-6331fd4.tar.gz -/snapd-2.16.tar.gz -/snapcore-selinux-e5c1177.tar.gz -/snapcore-selinux-4566045.tar.gz -/snapd-2.23.6.tar.gz -/snapd-2.24.tar.gz -/snapd-2.25.tar.gz -/snapd-2.26.3.tar.gz -/snapd-2.27.tar.gz -/snapd-2.27.1.tar.gz -/snapd-2.27.2.tar.gz -/snapd-2.27.5.tar.gz -/snapd-2.27.6.tar.gz -/snapd-2.28.1.tar.gz -/snapd-2.28.4.tar.gz -/snapd-2.28.5.tar.gz -/snapd-2.29.4.tar.gz -/snapd-2.30.tar.gz -/snapd-2.31.1.tar.gz -/snapd-2.32.4.tar.gz -/snapd-2.33.1.tar.gz -/snapd-2.35.tar.gz -/snapd-2.36.tar.gz -/snapd_2.36.only-vendor.tar.xz -/snapd-2.36.3.tar.gz -/snapd_2.36.3.only-vendor.tar.xz -/snapd-2.37.2.tar.gz -/snapd_2.37.2.only-vendor.tar.xz -/snapd-2.37.3.tar.gz -/snapd_2.37.3.only-vendor.tar.xz -/snapd-2.37.4.tar.gz -/snapd_2.37.4.only-vendor.tar.xz -/snapd_2.38.no-vendor.tar.xz -/snapd_2.38.only-vendor.tar.xz -/snapd_2.39.no-vendor.tar.xz -/snapd_2.39.only-vendor.tar.xz -/snapd_2.39.1.no-vendor.tar.xz -/snapd_2.39.1.only-vendor.tar.xz -/snapd_2.39.2.no-vendor.tar.xz -/snapd_2.39.2.only-vendor.tar.xz -/snapd_2.41.no-vendor.tar.xz -/snapd_2.41.only-vendor.tar.xz -/snapd_2.42.no-vendor.tar.xz -/snapd_2.42.only-vendor.tar.xz -/snapd_2.42.1.no-vendor.tar.xz -/snapd_2.42.1.only-vendor.tar.xz -/snapd_2.42.2.no-vendor.tar.xz -/snapd_2.42.2.only-vendor.tar.xz -/snapd_2.43.3.no-vendor.tar.xz -/snapd_2.43.3.only-vendor.tar.xz -/snapd_2.45.no-vendor.tar.xz -/snapd_2.45.only-vendor.tar.xz -/snapd_2.45.1.no-vendor.tar.xz -/snapd_2.45.1.only-vendor.tar.xz -/snapd_2.45.2.no-vendor.tar.xz -/snapd_2.45.2.only-vendor.tar.xz -/snapd_2.45.3.1.no-vendor.tar.xz -/snapd_2.45.3.1.only-vendor.tar.xz -/snapd_2.46.1.no-vendor.tar.xz -/snapd_2.46.1.only-vendor.tar.xz -/snapd_2.47.1.no-vendor.tar.xz -/snapd_2.47.1.only-vendor.tar.xz -/snapd_2.48.2.no-vendor.tar.xz -/snapd_2.48.2.only-vendor.tar.xz -/snapd_2.49.no-vendor.tar.xz -/snapd_2.49.only-vendor.tar.xz -/snapd_2.50.no-vendor.tar.xz -/snapd_2.50.only-vendor.tar.xz -/snapd_2.51.no-vendor.tar.xz -/snapd_2.51.only-vendor.tar.xz -/snapd_2.51.7.no-vendor.tar.xz -/snapd_2.51.7.only-vendor.tar.xz -/snapd_2.52.no-vendor.tar.xz -/snapd_2.52.only-vendor.tar.xz -/snapd_2.53.1.no-vendor.tar.xz -/snapd_2.53.1.only-vendor.tar.xz -/snapd_2.53.2.no-vendor.tar.xz -/snapd_2.53.2.only-vendor.tar.xz -/snapd_2.53.4.no-vendor.tar.xz -/snapd_2.53.4.only-vendor.tar.xz -/snapd_2.54.1.no-vendor.tar.xz -/snapd_2.54.1.only-vendor.tar.xz -/snapd_2.54.2.no-vendor.tar.xz -/snapd_2.54.2.only-vendor.tar.xz -/snapd_2.54.3.no-vendor.tar.xz -/snapd_2.54.3.only-vendor.tar.xz -/snapd_2.54.4.no-vendor.tar.xz -/snapd_2.54.4.only-vendor.tar.xz -/snapd_2.55.2.no-vendor.tar.xz -/snapd_2.55.2.only-vendor.tar.xz -/snapd_2.55.3.no-vendor.tar.xz -/snapd_2.55.3.only-vendor.tar.xz -/snapd_2.56.2.no-vendor.tar.xz -/snapd_2.56.2.only-vendor.tar.xz -/snapd_2.57.5.no-vendor.tar.xz -/snapd_2.57.5.only-vendor.tar.xz -/snapd_2.57.6.no-vendor.tar.xz -/snapd_2.57.6.only-vendor.tar.xz -/snapd_2.58.3.no-vendor.tar.xz -/snapd_2.58.3.only-vendor.tar.xz -/snapd_2.61.1.no-vendor.tar.xz -/snapd_2.61.1.only-vendor.tar.xz -/snapd_2.61.2.no-vendor.tar.xz -/snapd_2.61.2.only-vendor.tar.xz -/snapd_2.62.no-vendor.tar.xz -/snapd_2.62.only-vendor.tar.xz +/snapd_2.63.no-vendor.tar.xz +/snapd_2.63.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 81658ad..274ae7b 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.62 +Version: 2.63 Release: 0%{?dist} Summary: A transactional software package manager License: GPLv3 @@ -132,7 +132,7 @@ Provides: %{name}-login-service%{?_isa} = 1.33 %endif %if ! 0%{?with_bundled} -BuildRequires: golang(github.com/boltdb/bolt) +BuildRequires: golang(go.etcd.io/bbolt) BuildRequires: golang(github.com/coreos/go-systemd/activation) BuildRequires: golang(github.com/godbus/dbus) BuildRequires: golang(github.com/godbus/dbus/introspect) @@ -225,7 +225,7 @@ BuildArch: noarch %endif %if ! 0%{?with_bundled} -Requires: golang(github.com/boltdb/bolt) +Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/coreos/go-systemd/activation) Requires: golang(github.com/godbus/dbus) Requires: golang(github.com/godbus/dbus/introspect) @@ -254,7 +254,7 @@ Requires: golang(gopkg.in/yaml.v3) # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) # *sigh*... I hate golang... -Provides: bundled(golang(github.com/snapcore/bolt)) +Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) Provides: bundled(golang(github.com/godbus/dbus)) Provides: bundled(golang(github.com/godbus/dbus/introspect)) @@ -534,10 +534,8 @@ BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl ) -%if 0%{?rhel} -# There's no static link library for libseccomp in RHEL/CentOS... -sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go -%endif +# We need -D_GNU_SOURCE to include xfs/linux.h for fallocate. +sed -e 's,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE,' -i cmd/snap-seccomp/main.go %gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp ( @@ -809,6 +807,7 @@ popd %dir %{_sharedstatedir}/snapd %dir %{_sharedstatedir}/snapd/assertions %dir %{_sharedstatedir}/snapd/cookie +%dir %{_sharedstatedir}/snapd/cgroup %dir %{_sharedstatedir}/snapd/dbus-1 %dir %{_sharedstatedir}/snapd/dbus-1/services %dir %{_sharedstatedir}/snapd/dbus-1/system-services @@ -945,6 +944,54 @@ fi %changelog +* Wed Apr 24 2024 Ernest Lotter +- New upstream release 2.63 + - Support for snap services to show the current status of user + services (experimental) + - Refresh app awareness: record snap-run-inhibit notice when + starting app from snap that is busy with refresh (experimental) + - Refresh app awareness: use warnings as fallback for desktop + notifications (experimental) + - Aspect based configuration: make request fields in the aspect- + bundle's rules optional (experimental) + - Aspect based configuration: make map keys conform to the same + format as path sub-keys (experimental) + - Aspect based configuration: make unset and set behaviour similar + to configuration options (experimental) + - Aspect based configuration: limit nesting level for setting value + (experimental) + - Components: use symlinks to point active snap component revisions + - Components: add model assertion support for components + - Components: fix to ensure local component installation always gets + a new revision number + - Add basic support for a CIFS remote filesystem-based home + directory + - Add support for AppArmor profile kill mode to avoid snap-confine + error + - Allow more than one interface to grant access to the same API + endpoint or notice type + - Allow all snapd service's control group processes to send systemd + notifications to prevent warnings flooding the log + - Enable not preseeded single boot install + - Update secboot to handle new sbatlevel + - Fix to not use cgroup for non-strict confined snaps (devmode, + classic) + - Fix two race conditions relating to freedesktop notifications + - Fix missing tunables in snap-update-ns AppArmor template + - Fix rejection of snapd snap udev command line by older host snap- + device-helper + - Rework seccomp allow/deny list + - Clean up files removed by gadgets + - Remove non-viable boot chains to avoid secboot failure + - posix_mq interface: add support for missing time64 mqueue syscalls + mq_timedreceive_time64 and mq_timedsend_time64 + - password-manager-service interface: allow kwalletd version 6 + - kubernetes-support interface: allow SOCK_SEQPACKET sockets + - system-observe interface: allow listing systemd units and their + properties + - opengl interface: enable use of nvidia container toolkit CDI + config generation + * Thu Mar 21 2024 Ernest Lotter - New upstream release 2.62 - Aspects based configuration schema support (experimental) diff --git a/sources b/sources index 869f45e..569bfcb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.62.no-vendor.tar.xz) = 3fb9fa65e25e7deec7e92def9b60f756cfce35c00b90e5cc370bd641034414313f07c973fcbdef4c58e7a9abc20197316fd51a4a2bf5087088a0593b59104590 -SHA512 (snapd_2.62.only-vendor.tar.xz) = d07a3ba83cad8d25fc03ecb7efc69e8e3f105e41c076bc5b450acf4e98409f11f738b65f542965fac5ccaa56eb9f7b1b36aa06f8b68cd3549b9d2a01b10faa09 +SHA512 (snapd_2.63.no-vendor.tar.xz) = 5973b7922f2caf1d4b0bc0db4fe5564134b04d6ca3b52204e9963b584bd80a91789c46902840169f9a8b1b1184820c86902401f585915ca06a010d81a2d9a453 +SHA512 (snapd_2.63.only-vendor.tar.xz) = 3ff9b8610c01997935b720e883644597f7d397a9a7b7e23eadbe95a67f62564e9d4d836c5667e39f95ed073115b106d58e5f4107f229c72014433414168baaa7 From 6277e01d50a41e85b37504ed311c75aa5dd5b34a Mon Sep 17 00:00:00 2001 From: Maciek Borzecki Date: Mon, 19 May 2025 12:46:56 +0200 Subject: [PATCH 3/5] snapd: revert upstream patch dropping timedatex Fixes bug reported in snapd LP: https://bugs.launchpad.net/snapd/+bug/2097170 Signed-off-by: Maciek Borzecki --- ...-data-selinux-remove-timedatex-14670.patch | 32 +++++++++++++++++++ snapd.spec | 8 ++++- 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 0001-Revert-data-selinux-remove-timedatex-14670.patch diff --git a/0001-Revert-data-selinux-remove-timedatex-14670.patch b/0001-Revert-data-selinux-remove-timedatex-14670.patch new file mode 100644 index 0000000..3e31510 --- /dev/null +++ b/0001-Revert-data-selinux-remove-timedatex-14670.patch @@ -0,0 +1,32 @@ +From 18faae8698370c3f192319c88214fe01dd06b83f Mon Sep 17 00:00:00 2001 +Message-ID: <18faae8698370c3f192319c88214fe01dd06b83f.1747651437.git.maciej.borzecki@canonical.com> +From: Maciej Borzecki +Date: Mon, 19 May 2025 12:02:54 +0200 +Subject: [PATCH] Revert "data/selinux: remove timedatex (#14670)" + +This reverts commit cc90a8be2eaa9718dba018ff42cce2c6cd0ad963. + +Signed-off-by: Maciej Borzecki +--- + data/selinux/snappy.te | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te +index f66e7d5b37dd721c7cac0e17fc58a29b4029a656..802bddd520a5d3341acf8299fcfda8a29cc3a9eb 100644 +--- a/data/selinux/snappy.te ++++ b/data/selinux/snappy.te +@@ -345,6 +345,11 @@ optional_policy(` + allow snappy_t systemd_timedated_t:dbus send_msg; + allow systemd_timedated_t snappy_t:dbus send_msg; + ') ++# or on some systems same dbus API may be provided by timedatex ++# RHEL7: there is no timedatex.if ++ifndef(`distro_rhel7',` ++ timedatex_dbus_chat(snappy_t) ++') + + # kernel-module-load interface may inspect or write files under /etc/modprobe.d + optional_policy(` +-- +2.49.0 + diff --git a/snapd.spec b/snapd.spec index 8edbbef..faa31a7 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,12 +84,14 @@ Name: snapd Version: 2.68.3 -Release: 0%{?dist} +Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz +# EPEL8: fix for https://bugs.launchpad.net/snapd/+bug/2097170 +Patch0: 0001-Revert-data-selinux-remove-timedatex-14670.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -940,6 +942,10 @@ if [ $1 -eq 0 ]; then fi %changelog +* Mon May 19 2025 Maciek Borzecki - 2.68.3-1 +- Revert upstream patch dropping timedatex from SELinux policy of snapd + - Fixes: https://bugs.launchpad.net/snapd/+bug/2097170 + * Mon Mar 10 2025 Ernest Lotter - New upstream release 2.68.3 - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to From aa6e3b7d5e088b2aedb1ed56212466a306c3d47c Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 14 Jul 2025 13:41:14 +0200 Subject: [PATCH 4/5] New upstream release 2.70 Signed-off-by: Zygmunt Krynicki --- .gitignore | 4 +- snapd.spec | 223 ++++++++++++++++++++++++++++++++++++++++++++++++----- sources | 4 +- 3 files changed, 206 insertions(+), 25 deletions(-) diff --git a/.gitignore b/.gitignore index 1f4cd8b..6db0575 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/snapd_2.68.3.no-vendor.tar.xz -/snapd_2.68.3.only-vendor.tar.xz +/snapd_2.70.no-vendor.tar.xz +/snapd_2.70.only-vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index faa31a7..80c2c0c 100644 --- a/snapd.spec +++ b/snapd.spec @@ -52,27 +52,27 @@ %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} -%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.mounts.target snapd.mounts-pre.target +%global snappy_svcs snapd.service snapd.socket snapd.autoimport.service snapd.seeded.service snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target %global snappy_user_svcs snapd.session-agent.service snapd.session-agent.socket # Until we have a way to add more extldflags to gobuild macro... # Always use external linking when building static binaries. %if 0%{?fedora} || 0%{?rhel} >= 8 -%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; +%define gobuild_static(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; %endif %if 0%{?rhel} == 7 # no pass PIE flags due to https://bugzilla.redhat.com/show_bug.cgi?id=1634486 -%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v -x %{?**}; +%define gobuild_static(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags -static'" -a -v %{?**}; %endif # These macros are missing BUILDTAGS in RHEL 8/9, see RHBZ#1825138 %if 0%{?rhel} >= 8 -%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%define gobuild(o:) go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; %endif # These macros are not defined in RHEL 7 %if 0%{?rhel} == 7 -%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v -x %{?**}; +%define gobuild(o:) go build -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "-B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -linkmode external -extldflags '%__global_ldflags'" -a -v %{?**}; %define gotest() go test -compiler gc %{?**}; %endif @@ -83,7 +83,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.68.3 +Version: 2.70 Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only @@ -137,8 +137,8 @@ Provides: %{name}-login-service%{?_isa} = 1.33 BuildRequires: golang(go.etcd.io/bbolt) BuildRequires: golang(github.com/bmatcuk/doublestar/v4) BuildRequires: golang(github.com/coreos/go-systemd/activation) -BuildRequires: golang(github.com/godbus/dbus) -BuildRequires: golang(github.com/godbus/dbus/introspect) +BuildRequires: golang(github.com/godbus/dbus/v5) +BuildRequires: golang(github.com/godbus/dbus/v5/introspect) BuildRequires: golang(github.com/gorilla/mux) BuildRequires: golang(github.com/jessevdk/go-flags) BuildRequires: golang(github.com/juju/ratelimit) @@ -231,8 +231,8 @@ BuildArch: noarch Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/bmatcuk/doublestar/v4) Requires: golang(github.com/coreos/go-systemd/activation) -Requires: golang(github.com/godbus/dbus) -Requires: golang(github.com/godbus/dbus/introspect) +Requires: golang(github.com/godbus/dbus/v5) +Requires: golang(github.com/godbus/dbus/v5/introspect) Requires: golang(github.com/gorilla/mux) Requires: golang(github.com/jessevdk/go-flags) Requires: golang(github.com/juju/ratelimit) @@ -261,8 +261,8 @@ Requires: golang(gopkg.in/yaml.v3) Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/bmatcuk/doublestar/v4)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) -Provides: bundled(golang(github.com/godbus/dbus)) -Provides: bundled(golang(github.com/godbus/dbus/introspect)) +Provides: bundled(golang(github.com/godbus/dbus/v5)) +Provides: bundled(golang(github.com/godbus/dbus/v5/introspect)) Provides: bundled(golang(github.com/gorilla/mux)) Provides: bundled(golang(github.com/jessevdk/go-flags)) Provides: bundled(golang(github.com/juju/ratelimit)) @@ -509,7 +509,7 @@ export GO111MODULE=off # see https://github.com/gofed/go-macros/blob/master/rpm/macros.d/macros.go-compilers-golang BUILDTAGS= %if 0%{?with_test_keys} -BUILDTAGS="withtestkeys nosecboot" +BUILDTAGS="withtestkeys nosecboot structuredlogging" %else BUILDTAGS="nosecboot" %endif @@ -526,6 +526,7 @@ sed -e "s:github.com/snapcore/bolt:github.com/boltdb/bolt:g" -i advisor/*.go BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild -o bin/snap $GOFLAGS %{import_path}/cmd/snap %gobuild -o bin/snap-failure $GOFLAGS %{import_path}/cmd/snap-failure +%gobuild -o bin/snapd-apparmor $GOFLAGS %{import_path}/cmd/snapd-apparmor # To ensure things work correctly with base snaps, # snap-exec, snap-update-ns, and snapctl need to be built statically @@ -563,7 +564,6 @@ BUILDTAGS="${BUILDTAGS} nomanagers" # Build snap-confine pushd ./cmd autoreconf --force --install --verbose -# FIXME: add --enable-caps-over-setuid as soon as possible (setuid discouraged!) %configure \ --disable-apparmor \ --enable-selinux \ @@ -630,6 +630,7 @@ install -p -m 0755 bin/snap-failure %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snapd %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snap-update-ns %{buildroot}%{_libexecdir}/snapd install -p -m 0755 bin/snap-seccomp %{buildroot}%{_libexecdir}/snapd +install -p -m 0755 bin/snapd-apparmor %{buildroot}%{_libexecdir}/snapd # Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl install -p -m 0755 bin/snapctl %{buildroot}%{_libexecdir}/snapd/snapctl ln -sf %{_libexecdir}/snapd/snapctl %{buildroot}%{_bindir}/snapctl @@ -686,12 +687,17 @@ rm -fv %{buildroot}%{_unitdir}/snapd.recovery-chooser-trigger.service rm %{buildroot}%{_libexecdir}/snapd/snapd.core-fixup.sh rm %{buildroot}%{_libexecdir}/snapd/system-shutdown -# Remove snapd apparmor service -rm -f %{buildroot}%{_unitdir}/snapd.apparmor.service -rm -f %{buildroot}%{_libexecdir}/snapd/snapd-apparmor +# Remove gpio-chardev ordering target +rm -f %{buildroot}%{_unitdir}/snapd.gpio-chardev-setup.target # Disable re-exec by default -echo 'SNAP_REEXEC=0' > %{buildroot}%{_sysconfdir}/sysconfig/snapd +mkdir -p %{buildroot}%{_sysconfdir}/sysconfig +cat <<'EOF' > %{buildroot}%{_sysconfdir}/sysconfig/snapd +# Snapd daemon can reexec into the binary from the snapd snap, if +# it is newer than the version installed through distro packaging. +# Set to 1 to enable reexec. The default is 0. +#SNAP_REEXEC=0 +EOF # Create state.json and the README file to be ghosted touch %{buildroot}%{_sharedstatedir}/snapd/state.json @@ -771,6 +777,7 @@ make -C data -k check %{_libexecdir}/snapd/snap-failure %{_libexecdir}/snapd/info %{_libexecdir}/snapd/snap-mgmt +%{_libexecdir}/snapd/snapd-apparmor %{_libexecdir}/snapd/snap-mgmt-selinux %{_mandir}/man8/snap.8* %{_datadir}/applications/snap-handle-link.desktop @@ -787,6 +794,7 @@ make -C data -k check %{_unitdir}/snapd.autoimport.service %{_unitdir}/snapd.failure.service %{_unitdir}/snapd.seeded.service +%{_unitdir}/snapd.apparmor.service %{_unitdir}/snapd.mounts.target %{_unitdir}/snapd.mounts-pre.target %{_userunitdir}/snapd.session-agent.service @@ -840,9 +848,8 @@ make -C data -k check %doc cmd/snap-confine/PORTING %license COPYING %dir %{_libexecdir}/snapd -# For now, we can't use caps -# FIXME: Switch to "%%attr(0755,root,root) %%caps(cap_sys_admin=pe)" asap! -%attr(4755,root,root) %{_libexecdir}/snapd/snap-confine +%caps(cap_dac_override,cap_dac_read_search,cap_sys_admin,cap_sys_chroot,cap_chown,cap_fowner,cap_sys_ptrace=p) %{_libexecdir}/snapd/snap-confine +%{_libexecdir}/snapd/snap-confine.caps %{_libexecdir}/snapd/snap-device-helper %{_libexecdir}/snapd/snap-discard-ns %{_libexecdir}/snapd/snap-gdb-shim @@ -942,10 +949,184 @@ if [ $1 -eq 0 ]; then fi %changelog +* Tue Jun 03 2025 Ernest Lotter +- New upstream release 2.70 + - FDE: Fix reseal with v1 hook key format + - FDE: set role in TPM keys + - AppArmor prompting (experimental): add handling for expired + requests or listener in the kernel + - AppArmor prompting: log the notification protocol version + negotiated with the kernel + - AppArmor prompting: implement notification protocol v5 (manually + disabled for now) + - AppArmor prompting: register listener ID with the kernel and + resend notifications after snapd restart (requires protocol v5+) + - AppArmor prompting: select interface from metadata tags and set + request interface accordingly (requires protocol v5+) + - AppArmor prompting: include request PID in prompt + - AppArmor prompting: move the max prompt ID file to a subdirectory + of the snap run directory + - AppArmor prompting: avoid race between closing/reading socket fd + - Confdb (experimental): make save/load hooks mandatory if affecting + ephemeral + - Confdb: clear tx state on failed load + - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g. + confdb-schema) + - Confdb: add NestedEphemeral to confdb schemas + - Confdb: add early concurrency checks + - Simplify building Arch package + - Enable snapd.apparmor on Fedora + - Build snapd snap with libselinux + - Emit snapd.apparmor warning only when using apparmor backend + - When running snap, on system key mismatch e.g. due to network + attached HOME, trigger and wait for a security profiles + regeneration + - Avoid requiring state lock to get user, warnings, or pending + restarts when handling API requests + - Start/stop ssh.socket for core24+ when enabling/disabling the ssh + service + - Allow providing a different base when overriding snap + - Modify snap-bootstrap to mount snapd snap directly to /snap + - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap + as fallback + - Modify core-initrd to use systemctl reboot instead of /sbin/reboot + - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file + creation directory so it can be copied to the kernel snap + - Build the early initrd from installed ucode packages + - Create drivers tree when remodeling from UC20/22 to UC24 + - Load gpio-aggregator module before the helper-service needs it + - Run 'systemctl start' for mount units to ensure they are run also + when unchanged + - Update godbus version to 'v5 v5.1.0' + - Add support for POST to /v2/system-info with system-key-mismatch + indication from the client + - Add 'snap sign --update-timestamp' flag to update timestamp before + signing + - Add vfs support for snap-update-ns to use to simulate and evaluate + mount sequences + - Add refresh app awareness debug logging + - Add snap-bootstrap scan-disk subcommand to be called from udev + - Add feature to inject proxy store assertions in build image + - Add OP-TEE bindings, enable by default in ARM and ARM64 builds + - Fix systemd dependency options target to go under 'unit' section + - Fix snap-bootstrap reading kernel snap instead of base resulting + in bad modeenv + - Fix a regression during seeding when using early-config + - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps + - Make Azure kernels reboot upon panic + - Fix snap-confine to not drop capabilities if the original user is + already root + - Fix data race when stopping services + - Fix task dependency issue by temporarily disable re-refresh on + prerequisite updates + - Fix compiling against op-tee on armhf + - Fix dbx update when not using FDE + - Fix potential validation set deadlock due to bases waiting on + snaps + - LP: #2104066 Only cancel notices requests on stop/shutdown + - Interfaces: bool-file | fix gpio glob pattern as required for + '[XXXX]*' format + - Interfaces: system-packages-doc | allow access to + /usr/local/share/doc + - Interfaces: ros-snapd-support interface | added new interface + - Interfaces: udisks2 | allow chown capability + - Interfaces: system-observe | allow reading cpu.max + - Interfaces: serial-port | add ttyMAXX to allowed list + - Interfaces: modified seccomp template to disallow + 'O_NOTIFICATION_PIPE' + - Interfaces: fwupd | add support for modem-manager plugin + - Interfaces: gpio-chardev | make unsupported and remove + experimental flag to hide this feature until gpio-aggregator is + available + - Interfaces: hardware-random | fix udev match rule + - Interfaces: timeserver-control | extend to allow timedatectl + timesync commands + - Interfaces: add symlinks backend + - Interfaces: system key mismatch handling * Mon May 19 2025 Maciek Borzecki - 2.68.3-1 - Revert upstream patch dropping timedatex from SELinux policy of snapd - Fixes: https://bugs.launchpad.net/snapd/+bug/2097170 +* Tue Apr 08 2025 Ernest Lotter +- New upstream release 2.69 + - FDE: re-factor listing of the disks based on run mode model and + model to correctly resolve paths + - FDE: run snapd from snap-failure with the correct keyring mode + - Snap components: allow remodeling back to an old snap revision + that includes components + - Snap components: fix remodel to a kernel snap that is already + installed on the system, but not the current kernel due to a + previous remodel. + - Snap components: fix for snapctl inputs that can crash snapd + - Confdb (experimental): load ephemeral data when reading data via + snapctl get + - Confdb (experimental): load ephemeral data when reading data via + snap get + - Confdb (experimental): rename {plug}-view-changed hook to observe- + view-{plug} + - Confdb (experimental): rename confdb assertion to confdb-schema + - Confdb (experimental): change operator grouping in confdb-control + assertion + - Confdb (experimental): add confdb-control API + - AppArmor: extend the probed features to include the presence of + files, as well as directories + - AppArmor prompting (experimental): simplify the listener + - AppArmor metadata tagging (disabled): probe parser support for + tags + - AppArmor metadata tagging (disabled): implement notification + protocol v5 + - Confidential VMs: sysroot.mount is now dynamically created by + snap-bootstrap instead of being a static file in the initramfs + - Confidential VMs: Add new implementation of snap integrity API + - Non-suid snap-confine: first phase to replace snap-confine suid + with capabilities to achieve the required permissions + - Initial changes for dynamic security profiles updates + - Provide snap icon fallback for /v2/icons without requiring network + access at runtime + - Add eMMC gadget update support + - Support reexec when using /usr/libexec/snapd on the host (Arch + Linux, openSUSE) + - Auto detect snap mount dir location on unknown distributions + - Modify snap-confine AppArmor template to allow all glibc HWCAPS + subdirectories to prevent launch errors + - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap- + bootstrap to remove usage of go templates to reduce size by 4MB + - Fix snap-bootstrap to mount kernel snap from + /sysroot/writable/system-data + - LP: #2106121 fix snap-bootstrap busy loop + - Fix encoding of time.Time by using omitzero instead of omitempty + (on go 1.24+) + - Fix setting snapd permissions through permctl for openSUSE + - Fix snap struct json tags typo + - Fix snap pack configure hook permissions check incorrect file mode + - Fix gadget snap reinstall to honor existing sizes of partitions + - Fix to update command line when re-executing a snapd tool + - Fix 'snap validate' of specific missing newline and add error on + missed case of 'snap validate --refresh' without another action + - Workaround for snapd-confine time_t size differences between + architectures + - Disallow pack and install of snapd, base and os with specific + configure hooks + - Drop udev build dependency that is no longer required and add + missing systemd-dev dependency + - Build snap-bootstrap with nomanagers tag to decrease size by 1MB + - Interfaces: polkit | support custom polkit rules + - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is + confined by AppArmor + - Interfaces: log-observe | add missing udev rule + - Interfaces: hostname-control | fix call to hostnamectl in core24 + - Interfaces: network-control | allow removing created network + namespaces + - Interfaces: scsi-generic | re-enable base declaration for scsi- + generic plug + - Interfaces: u2f | add support for Arculus AuthentiKey + +* Wed Apr 02 2025 Ernest Lotter +- New upstream release 2.68.4 + - Snap components: LP: #2104933 workaround for classic 24.04/24.10 + models that incorrectly specify core22 instead of core24 + - Update build dependencies + * Mon Mar 10 2025 Ernest Lotter - New upstream release 2.68.3 - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to diff --git a/sources b/sources index 59677d6..cd873e5 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (snapd_2.68.3.no-vendor.tar.xz) = 65039fb0fe515cfcdb2779d5c4b40b64612e9bd7fcc763ac8cd3ddd9efb26d4c7f0b6f58f9c80cec274bed5bfece8c94bad8645189a8a8534b73017e3848a97c -SHA512 (snapd_2.68.3.only-vendor.tar.xz) = b6f68082e4c5df6e957f9da0aec04638821e42629fd13b9660ad3986da9fcde70572c17213d754788408c260814f9369a5d00e212a7f6054918eec4eaa1299f3 +SHA512 (snapd_2.70.no-vendor.tar.xz) = f4864658793d2f6e11823b604c85cadc204a231e7efc5d9302d395c6afc7b500f389317cd3066a39a1d9f138aef5c8a0c2eff07dfb1c5b4473dfa5b489356689 +SHA512 (snapd_2.70.only-vendor.tar.xz) = b6e0309bc56a1573a3edea2e35b3feb313f8220633a64f11f6d0a5b155d39b1b3a2b058edc2d01aca0bf04f4515a17f9011cb49b5c7aa96a5a4610d0032cddcb From d29928ac8948720ce517daa53748b855c04911ef Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Thu, 4 Sep 2025 08:34:46 +0200 Subject: [PATCH 5/5] Add patch excluding fs_watch_cgroup_dirs Signed-off-by: Zygmunt Krynicki --- fs_watch_group_dirs.patch | 15 +++++++++++++++ snapd.spec | 4 ++++ 2 files changed, 19 insertions(+) create mode 100644 fs_watch_group_dirs.patch diff --git a/fs_watch_group_dirs.patch b/fs_watch_group_dirs.patch new file mode 100644 index 0000000..5601167 --- /dev/null +++ b/fs_watch_group_dirs.patch @@ -0,0 +1,15 @@ +diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te +index 61284f4bf7..d91f5d69ed 100644 +--- a/data/selinux/snappy.te ++++ b/data/selinux/snappy.te +@@ -464,7 +464,9 @@ gen_require(` + allow snappy_t devicekit_power_exec_t:file { getattr }; + + # Snapd monitors cgroup hierarchy for refresh app awareness. +-fs_watch_cgroup_dirs(snappy_t) ++ifndef(`distro_rhel8',` ++ fs_watch_cgroup_dirs(snappy_t) ++') + + # connect to unix socket of snap session agent usually executing as unconfined_t. + # TODO: define separate policy for user session agent diff --git a/snapd.spec b/snapd.spec index 219e47e..f39743d 100644 --- a/snapd.spec +++ b/snapd.spec @@ -92,6 +92,7 @@ Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_ Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz # EPEL8: fix for https://bugs.launchpad.net/snapd/+bug/2097170 Patch0: 0001-Revert-data-selinux-remove-timedatex-14670.patch +Patch1: fs_watch_group_dirs.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -600,6 +601,9 @@ EOF %if 0%{?rhel} == 7 M4PARAM='-D distro_rhel7' %endif +%if 0%{?rhel} == 8 + M4PARAM='-D distro_rhel8' +%endif %if 0%{?rhel} == 7 || 0%{?rhel} == 8 || 0%{?rhel} == 9 # RHEL7, RHEL8 and RHEL9 are missing the BPF interfaces from their reference policy M4PARAM="$M4PARAM -D no_bpf"