-
Notifications
You must be signed in to change notification settings - Fork 68
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Snap/Apparmor deprecation #325
Comments
70 patches with 6.5 FWIW |
Hi, is this still something planned? |
Please read the announcement in the forum |
Ah thank you for the clarification. The issue wasnt updated so I wasnt sure if this is on the table, but Solus committed publicly to deprecate snap so this is clearly the wrong place to ask about the patch sets. |
we need to enable flathub by default as well |
Our patchset is imported from the Ubuntu kernels (see here for LTS kernel) as far as I know. It might be the case that not all of those are needed, but part of the problem is that it is difficult to track what is actually needed. The upstream kernel patches only go up to Linux 4.8, but the existence of a patch set that is applied to Ubuntu kernels strongly suggests that it isn't the case that no patches are needed for any newer kernels. Note that it isn't the case that we're dropping Snap support because we hate snaps, so we'll gladly reverse on the deprecation decision if it turns out that no patches are needed for strict confinement (and things stay that way).
I've updated the issue to reflect the current status. Note that it will land in stable Solus in the next sync, and we're hard at work to provide tooling and documentation to help people migrate (mainly unsnap). |
thanks for the clarifications, had a look at the ubuntu sauce for 6.8 ; current patch set for apparmor 4 seems to contain 90 patches (big chunk is the LSM stacking v39 patch set which was intended to land in 6.1 but obviously did not). A current apparmor is included in the snapd snap and i know that apparmor is able to nest; I assume though that only the user space parts (for parsing policies etc) are vendored and I would be surprised if that adds mediation features if the kernel does not support it. edit: one more datapoint: ruhen.vanderberg extracted the necessary patches for a 6.1 linux kernel, looks like a 2k lines diff. https://github.com/RJvdBerg/UbuntuCore-kernelpatches - looks really like only the AF_UNIX mediation related patches; so my guess is canonical adds a lot extra changes to apparmor probably for LSM stacking and not really necessary for snap
thanks for that as well |
The maintenance of the (almost 60) AppArmor patches adds a significant maintenance burden for our kernels. These patches are only needed for strict confinement of Snaps.
To decrease the maintenance burden we should drop support for Snaps and move users over to Flatpak, seeing as 1) there is little progress on upstreaming the patches, 2) Flatpak seems to have won the battle for the desktop and 3) there is (in my opinion) no value in only supporting unconfined Snaps.
Note that Apparmor support will remain enabled in the kernel. Only the additional patches are removed.
Plan is as follows:
snapd
from ISOsInitially in this issueThe text was updated successfully, but these errors were encountered: