strict snap run from classic snap can't write to filesystem
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| snapd |
Triaged
|
High
|
Unassigned | ||
Bug Description
Haven't yet made a minimal reproducer without the docker snap, but for the time being it is reproducible with the docker snap on disco:
1. install the docker snap
2. install a classic snap (i.e. snapcraft)
3. start a new shell in the classic snap
4. create a docker container with the docker snap and get the ID
5. Try exporting the rootfs of that docker container to a file
See:
$ snap install docker
$ snap install snapcraft --classic
$ snap run --shell snapcraft
$ echo $SNAP
/snap/snapcraft
$ which docker
/snap/bin/docker
$ ID=$(docker create hello-world)
$ docker export $ID > rootfs.tgz
write /dev/stdout: permission denied
The following denials show up:
```
Jul 08 10:20:18 audit[40194]: AVC apparmor="DENIED" operation=
Jul 08 10:20:18 kernel: audit: type=1400 audit(156259921
Jul 08 10:20:18 audit[40194]: AVC apparmor="DENIED" operation=
Jul 08 10:20:18 kernel: audit: type=1400 audit(156259921
Jul 08 10:25:47 audit[41151]: AVC apparmor="DENIED" operation=
Jul 08 10:25:47 kernel: audit: type=1400 audit(156259954
```
Doing the same steps outside of a classic snap shell works as expected:
$ which docker
/snap/bin/docker
$ echo $SNAP
$ ID=$(docker create hello-world)
$ docker export $ID > rootfs.tgz
$ file rootfs.tgz
rootfs.tgz: POSIX tar archive
$
| Julian Andres Klode (juliank) wrote | #1 |
| Zygmunt Krynicki (zyga) wrote | #2 |
| Changed in snapd: | |
| status: | New → Triaged |
| importance: | Undecided → High |
| Ian Johnson (anonymouse67) wrote | #3 |
| Jamie Strandboge (jdstrand) wrote | #4 |
I'm seeing this when trying to use the go snap with the code snap:
[329584.830660] audit: type=1400 audit(1565382151.152:4651): apparmor="DENIED" operation="file_inherit" profile="/usr/lib/snapd/snap-confine" pid=1032 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none
This happens when the go tool is run on save in visual studio code (and then nothing happens, /snap/bin/go just exits doing nothing), but it does not happen when running it inside snap --shell code.