File 0001-snap-confine-add-tmpfs-mount-rule-to-appar... of Package snapd

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-snap-confine-add-tmpfs-mount-rule-to-apparmor-profil.patch of Package snapd (Revision db375c45bc386c40c8f944613a3b91cb)

Currently displaying revision db375c45bc386c40c8f944613a3b91cb , Show latest

From 7ba18c455c435f60d06056397e1fc3c9032a92ab Mon Sep 17 00:00:00 2001
From: Michael Vogt <mvo@ubuntu.com>
Date: Mon, 5 Jun 2023 16:18:47 +0200
Subject: [PATCH 1/1] snap-confine: add `tmpfs` mount rule to apparmor profile
 (#12845)

There is a bugfix to make the mount rules more strict/explicit in apparmor 3.0.10, see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.10 - this affects snapd as it's current profile relies on the implicit behavior. With this commit the missing mount rule is added explicitly.
---
 cmd/snap-confine/snap-confine.apparmor.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cmd/snap-confine/snap-confine.apparmor.in b/cmd/snap-confine/snap-confine.apparmor.in
index fb999368b..73d14c8c7 100644
--- a/cmd/snap-confine/snap-confine.apparmor.in
+++ b/cmd/snap-confine/snap-confine.apparmor.in
@@ -172,6 +172,7 @@
 
     # boostrapping the mount namespace
     /tmp/snap.rootfs_*/ rw,
+    mount fstype=tmpfs none -> /tmp/snap.rootfs_*/,
     mount options=(rw rshared) -> /,
     mount options=(rw bind) /tmp/snap.rootfs_*/ -> /tmp/snap.rootfs_*/,
     mount options=(rw unbindable) -> /tmp/snap.rootfs_*/,
-- 
2.42.1

Places

File 0001-snap-confine-add-tmpfs-mount-rule-to-apparmor-profil.patch of Package snapd (Revision db375c45bc386c40c8f944613a3b91cb)

Places