snapd

updated plug of system-files with additional read/write does not get updated apparmor profile on refresh

Bug #1942266 reported by Ian Johnson
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
snapd
Fix Committed
High
Paweł Stołowski
snapd 2.52

Bug Description

With this snap built locally and installed:

```
name: test-system-files-conn-snap
version: 0.1

plugs:
  foo:
    interface: system-files
    write:
      - /etc/resolv.conf

apps:
  bin:
   command: bin.sh
```

if you manually connect the foo plug, you will see apparmor policy generated for /etc/resolv.conf.

Then if you update the snap.yaml to this:

```
name: test-system-files-conn-snap
version: 0.2

plugs:
  foo:
    interface: system-files
    write:
      - /etc/resolv.conf
      - /etc/foo.conf

apps:
  bin:
   command: bin.sh
```

and then refresh the snap, the AppArmor profile is not updated to take into account the foo.conf too. If you disconnect the interface and then re-connect the interface, then AppArmor rules for /etc/foo.conf show up.

Revision history for this message
Ian Johnson (anonymouse67) wrote :

I have proposed a regression test which we can use to verify the fix at https://github.com/snapcore/snapd/pull/10707

Revision history for this message
Paweł Stołowski (stolowski) wrote :

We have two related issues:
- with auto-connect task we do not reconsider/recreate existing (already connected) autoconnections: see addNewConnection(..) in ifacestate helpers.go (this helper is used only for auto-connect and for gadget connections); they are explicitly filtered out and there is a comment about that in the code.
- for manually connected interfaces we do not "reconnect" them if their attributes changed - this was partially fixes for content interface long time ago (see https://bugs.launchpad.net/snapd/+bug/1825883, https://github.com/snapcore/snapd/pull/6802) but there is an XXX comment in reloadConnections about needing a complete fix.

Properly fixing this will require re-running interface hooks for changed interfaces (and maybe disconnect hooks first).

Changed in snapd:
status: New → Confirmed
importance: Undecided → High
Revision history for this message
Paweł Stołowski (stolowski) wrote :

This is fixed by https://github.com/snapcore/snapd/pull/10723

Changed in snapd:
status: Confirmed → Fix Committed
assignee: nobody → Paweł Stołowski (stolowski)
Revision history for this message
Ian Johnson (anonymouse67) wrote :

This is included in 2.52

Changed in snapd:
milestone: none → 2.52
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.