many: switch to apparmor 5.x with 4 ABI#16781
Open
zyga wants to merge 7 commits intocanonical:masterfrom
Open
Conversation
This was referenced Mar 18, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the snapd snap build to use AppArmor userspace 5.0.0 beta1 (ABI 4 series per PR description) as a drop-in replacement for the previously pinned 4.1.7, aligning the snapcraft build inputs and the autoconf pkg-config expectations.
Changes:
- Bump the snapcraft build of AppArmor from 4.1.7 to 5.0.0-beta1 (including checksum update).
- Adjust
cmd/configure.acto require the newer libapparmor version when building under snapcraft. - Build libapparmor/parser with static-linking-oriented flags in the snapcraft part.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
cmd/configure.ac |
Updates snapcraft-specific libapparmor pkg-config check to target AppArmor 5 beta. |
build-aux/snap/snapcraft.yaml |
Switches AppArmor source tarball/checksum to 5.0.0-beta1 and tweaks build flags for static linking. |
You can also share your feedback on Copilot code review. Take the survey.
| PKG_CHECK_MODULES([APPARMOR4], [libapparmor = 4.1.7], [ | ||
| AC_DEFINE([HAVE_APPARMOR], [1], [Build with apparmor4 support])], [ | ||
| AC_MSG_ERROR([unable to find apparmor4 for snap build of snapd])])], [ | ||
| PKG_CHECK_MODULES([APPARMOR4], [libapparmor = 5.0.0~beta1], [ |
|
Mon Mar 23 12:43:42 UTC 2026 Failures:Executing:
Skipped tests from snapd-testing-skip
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #16781 +/- ##
==========================================
- Coverage 77.56% 77.56% -0.01%
==========================================
Files 1366 1365 -1
Lines 188489 188418 -71
Branches 2446 2446
==========================================
- Hits 146199 146141 -58
+ Misses 33460 33449 -11
+ Partials 8830 8828 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
zyga
force-pushed
the
rfc/apparmor-5-abi-4
branch
from
079fd1d to
37363bb
Compare
Switch the copy of apparmor bundled with snapd snap to the new 5 alpha 2 release. This keeps the old ABI intact so our profiles should retain old semantics. Jira: https://warthogs.atlassian.net/browse/SNAPDENG-35412 Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Disable support for building libapparmor.so and force static linking of libapparmor.a into apparmor_parser. Note that early in the 5.x series, apparmor userspace depends on libzstd for loading compressed profiles. Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
zyga
force-pushed
the
rfc/apparmor-5-abi-4
branch
from
37363bb to
c9742e3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is apparmor 5.x release with ABI 4.0, which should theoretically be a drop-in replacement over current apparmor 4.1.7.
Note that the beta release we are using is not up-to-date with some fixes from 4.1.7 (new 5.x release is pending) so some failures are expected.
For apparmor master with 5 abi please see: #16780
For apparmor 5.x with 5 ABI please see: #15967
For apparmor 5.x with 4 ABI please see: #16781