Commits on Apr 18, 2024

1. i/apparmor: add missing expansion for s-u-n template …

   This fixes access to /etc/apparmor.d/tunables when running from snapd snap.
   When snapd snap re-executes, and uses apparmor_parser from snapd snap (those
   are separate conditions), then it re-directs the parser away from host
   /etc/apparmor.d and we have special code to load tunables from the host anyway.
   Those tunables are themselves conditional on the conditional include syntax
   that may or may not be supported by apparmor (otherwise the would be explicitly
   spelled out in the template, and not dynamically expanded with custom logic).
   
   The problem was introduced along with patch
   b98e4af (i/apparmor: support for home.d
   tunables from /etc/ (snapcore#13118)), as the case for snap-update-ns was missed, and
   the default expansion is an empty string.
   
   Regression-testing this requires that we re-package snapd snap, so the test
   will come in with a separate patch as it requires somewhat more effort to
   behave correctly.
   
   This issue was identified by Maciej Borzecki.
   
   Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

   

   zyga committed Apr 18, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 3a6ffdd
   • Browse repository at this point

   Copy the full SHA

   3a6ffdd View commit details

   Browse the repository at this point in the history