Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
Name: snap-confine | Distribution: Fedora Project |
Version: 2.63 | Vendor: Fedora Project |
Release: 0.fc40 | Build date: Mon May 27 11:38:56 2024 |
Group: Unspecified | Build host: buildvm-a64-08.iad2.fedoraproject.org |
Size: 10914122 | Source RPM: snapd-2.63-0.fc40.src.rpm |
Packager: Fedora Project | |
Url: https://github.com/snapcore/snapd | |
Summary: Confinement system for snap applications |
This package is used internally by snapd to apply confinement to the started snap applications.
GPLv3
* Wed Apr 24 2024 Ernest Lotter <ernest.lotter@canonical.com> - New upstream release 2.63 - Support for snap services to show the current status of user services (experimental) - Refresh app awareness: record snap-run-inhibit notice when starting app from snap that is busy with refresh (experimental) - Refresh app awareness: use warnings as fallback for desktop notifications (experimental) - Aspect based configuration: make request fields in the aspect- bundle's rules optional (experimental) - Aspect based configuration: make map keys conform to the same format as path sub-keys (experimental) - Aspect based configuration: make unset and set behaviour similar to configuration options (experimental) - Aspect based configuration: limit nesting level for setting value (experimental) - Components: use symlinks to point active snap component revisions - Components: add model assertion support for components - Components: fix to ensure local component installation always gets a new revision number - Add basic support for a CIFS remote filesystem-based home directory - Add support for AppArmor profile kill mode to avoid snap-confine error - Allow more than one interface to grant access to the same API endpoint or notice type - Allow all snapd service's control group processes to send systemd notifications to prevent warnings flooding the log - Enable not preseeded single boot install - Update secboot to handle new sbatlevel - Fix to not use cgroup for non-strict confined snaps (devmode, classic) - Fix two race conditions relating to freedesktop notifications - Fix missing tunables in snap-update-ns AppArmor template - Fix rejection of snapd snap udev command line by older host snap- device-helper - Rework seccomp allow/deny list - Clean up files removed by gadgets - Remove non-viable boot chains to avoid secboot failure - posix_mq interface: add support for missing time64 mqueue syscalls mq_timedreceive_time64 and mq_timedsend_time64 - password-manager-service interface: allow kwalletd version 6 - kubernetes-support interface: allow SOCK_SEQPACKET sockets - system-observe interface: allow listing systemd units and their properties - opengl interface: enable use of nvidia container toolkit CDI config generation * Thu Mar 21 2024 Ernest Lotter <ernest.lotter@canonical.com> - New upstream release 2.62 - Aspects based configuration schema support (experimental) - Refresh app awareness support for UI (experimental) - Support for user daemons by introducing new control switches --user/--system/--users for service start/stop/restart (experimental) - Add AppArmor prompting experimental flag (feature currently unsupported) - Installation of local snap components of type test - Packaging of components with snap pack - Expose experimental features supported/enabled in snapd REST API endpoint /v2/system-info - Support creating and removing recovery systems for use by factory reset - Enable API route for creating and removing recovery systems using /v2/systems with action create and /v2/systems/{label} with action remove - Lift requirements for fde-setup hook for single boot install - Enable single reboot gadget update for UC20+ - Allow core to be removed on classic systems - Support for remodeling on hybrid systems - Install desktop files on Ubuntu Core and update after snapd upgrade - Upgrade sandbox features to account for cgroup v2 device filtering - Support snaps to manage their own cgroups - Add support for AppArmor 4.0 unconfined profile mode - Add AppArmor based read access to /etc/default/keyboard - Upgrade to squashfuse 0.5.0 - Support useradd utility to enable removing Perl dependency for UC24+ - Support for recovery-chooser to use console-conf snap - Add support for --uid/--gid using strace-static - Add support for notices (from pebble) and expose via the snapd REST API endpoints /v2/notices and /v2/notice - Add polkit authentication for snapd REST API endpoints /v2/snaps/{snap}/conf and /v2/apps - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps - Add refresh-inhibited select query to REST API endpoint /v2/snaps - Take into account validation sets during remodeling - Improve offline remodeling to use installed revisions of snaps to fulfill the remodel revision requirement - Add rpi configuration option sdtv_mode - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if present on host - Fix gadget zero-sized disk mapping caused by not ignoring zero sized storage traits - Fix gadget install case where size of existing partition was not correctly taken into account - Fix trying to unmount early kernel mount if it does not exist - Fix restarting mount units on snapd start - Fix call to udev in preseed mode - Fix to ensure always setting up the device cgroup for base bare and core24+ - Fix not copying data from newly set homedirs on revision change - Fix leaving behind empty snap home directories after snap is removed (resulting in broken symlink) - Fix to avoid using libzstd from host by adding to snapd snap - Fix autorefresh to correctly handle forever refresh hold - Fix username regex allowed for system-user assertion to not allow '+' - Fix incorrect application icon for notification after autorefresh completion - Fix to restart mount units when changed - Fix to support AppArmor running under incus - Fix case of snap-update-ns dropping synthetic mounts due to failure to match desired mount dependencies - Fix parsing of base snap version to enable pre-seeding of Ubuntu Core Desktop - Fix packaging and tests for various distributions - Add remoteproc interface to allow developers to interact with Remote Processor Framework which enables snaps to load firmware to ARM Cortex microcontrollers - Add kernel-control interface to enable controlling the kernel firmware search path - Add nfs-mount interface to allow mounting of NFS shares - Add ros-opt-data interface to allow snaps to access the host /opt/ros/ paths - Add snap-refresh-observe interface that provides refresh-app- awareness clients access to relevant snapd API endpoints - steam-support interface: generalize Pressure Vessel root paths and allow access to driver information, features and container versions - steam-support interface: make implicit on Ubuntu Core Desktop - desktop interface: improved support for Ubuntu Core Desktop and limit autoconnection to implicit slots - cups-control interface: make autoconnect depend on presence of cupsd on host to ensure it works on classic systems - opengl interface: allow read access to /usr/share/nvidia - personal-files interface: extend to support automatic creation of missing parent directories in write paths - network-control interface: allow creating /run/resolveconf - network-setup-control and network-setup-observe interfaces: allow busctl bind as required for systemd 254+ - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock- ro and read access to /var/lib/libvirt/dnsmasq/** - fwupd interface: allow access to IMPI devices (including locking of device nodes), sysfs attributes needed by amdgpu and the COD capsule update directory - uio interface: allow configuring UIO drivers from userspace libraries - serial-port interface: add support for NXP Layerscape SoC - lxd-support interface: add attribute enable-unconfined-mode to require LXD to opt-in to run unconfined - block-devices interface: add support for ZFS volumes - system-packages-doc interface: add support for reading jquery and sphinx documentation - system-packages-doc interface: workaround to prevent autoconnect failure for snaps using base bare - microceph-support interface: allow more types of block devices to be added as an OSD - mount-observe interface: allow read access to /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo - polkit interface: changed to not be implicit on core because installing policy files is not possible - upower-observe interface: allow stats refresh - gpg-public-keys interface: allow creating lock file for certain gpg operations - shutdown interface: allow access to SetRebootParameter method - media-control interface: allow device file locking - u2f-devices interface: support for Trustkey G310H, JaCarta U2F, Kensington VeriMark Guard, RSA DS100, Google Titan v2 * Wed Mar 06 2024 Ernest Lotter <ernest.lotter@canonical.com> - New upstream release 2.61.3 - Install systemd files in correct location for 24.04 * Fri Feb 16 2024 Ernest Lotter <ernest.lotter@canonical.com> - New upstream release 2.61.2 - Fix to enable plug/slot sanitization for prepare-image - Fix panic when device-service.access=offline - Support offline remodeling - Allow offline update only remodels without serial - Fail early when remodeling to old model revision - Fix to enable plug/slot sanitization for validate-seed - Allow removal of core snap on classic systems - Fix network-control interface denial for file lock on /run/netns - Add well-known core24 snap-id - Fix remodel snap installation order - Prevent remodeling from UC18+ to UC16 - Fix cups auto-connect on classic with cups snap installed - u2f-devices interface support for GoTrust Idem Key with USB-C - Fix to restore services after unlink failure - Add libcudnn.so to Nvidia libraries - Fix skipping base snap download due to false snapd downgrade conflict * Sun Feb 11 2024 Maxwell G <maxwell@gtmx.me> - 2.61.1-2 - Rebuild for golang 1.22.0 * Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.61.1-1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild * Thu Jan 18 2024 Zygmunt Krynicki <me@zygoon.pl> - 2.61.1-1 - Changelog resynchronization * Wed Jan 17 2024 Zygmunt Krynicki <me@zygoon.pl> - 2.58.3-3 - Require xdelta on Fedora or EPEL >= 9 (for delta updates) * Fri Nov 24 2023 Ernest Lotter <ernest.lotter@canonical.com> - New upstream release 2.61.1 - Stop requiring default provider snaps on image building and first boot if alternative providers are included and available - Fix auth.json access for login as non-root group ID - Fix incorrect remodelling conflict when changing track to older snapd version - Improved check-rerefresh message - Fix UC16/18 kernel/gadget update failure due volume mismatch with installed disk - Stop auto-import of assertions during install modes - Desktop interface exposes GetIdletime - Polkit interface support for new polkit versions - Fix not applying snapd snap changes in tracked channel when remodelling * Fri Oct 13 2023 Philip Meulengracht <philip.meulengracht@canonical.com> - New upstream release 2.61 - Fix control of activated services in 'snap start' and 'snap stop' - Correctly reflect activated services in 'snap services' - Disabled services are no longer enabled again when snap is refreshed - interfaces/builtin: added support for Token2 U2F keys - interfaces/u2f-devices: add Swissbit iShield Key - interfaces/builtin: update gpio apparmor to match pattern that contains multiple subdirectories under /sys/devices/platform - interfaces: add a polkit-agent interface - interfaces: add pcscd interface - Kernel command-line can now be edited in the gadget.yaml - Only track validation-sets in run-mode, fixes validation-set issues on first boot. - Added support for using store.access to disable access to snap store - Support for fat16 partition in gadget - Pre-seed authority delegation is now possible - Support new system-user name daemon - Several bug fixes and improvements around remodelling - Offline remodelling support * Fri Sep 15 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.60.4 - i/b/qualcomm_ipc_router.go: switch to plug/slot and add socket permission - interfaces/builtin: fix custom-device udev KERNEL values - overlord: allow the firmware-updater snap to install user daemons - interfaces: allow loopback as a block-device * Fri Aug 25 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.60.3 - i/b/shared-memory: handle "private" plug attribute in shared- memory interface correctly - i/apparmor: support for home.d tunables from /etc/ * Fri Aug 04 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.60.2 - i/builtin: allow directories in private /dev/shm - i/builtin: add read access to /proc/task/schedstat in system- observe - snap-bootstrap: print version information at startup - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948 - snap, store: filter out invalid snap edited links from store info and persisted state - o/configcore: write netplan defaults to 00-snapd-config on seeding - snapcraft.yaml: pull in apparmor_parser optimization patches from https://gitlab.com/apparmor/apparmor/-/merge_requests/711 - snap-confine: fix missing \0 after readlink - cmd/snap: hide append-integrity-data - interfaces/opengl: add support for ARM Mali * Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.58.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Tue Jul 04 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.60.1 - install: fallback to lazy unmount() in writeFilesystemContent - data: include "modprobe.d" and "modules-load.d" in preseeded blob - gadget: fix install test on armhf - interfaces: fix typo in network_manager_observe - sandbox/apparmor: don't let vendored apparmor conflict with system - gadget/update: set parts in laid out data from the ones matched - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor - many: stop using `-O no-expr-simplify` in apparmor_parser - go.mod: update secboot to latest uc22 branch * Thu Jun 15 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.60 - Support for dynamic snapshot data exclusions - Apparmor userspace is vendored inside the snapd snap - Added a default-configure hook that exposes gadget default configuration options to snaps during first install before services are started - Allow install from initrd to speed up the initial installation for systems that do not have a install-device hook - New `snap sign --chain` flag that appends the account and account-key assertions - Support validation-sets in the model assertion - Support new "min-size" field in gadget.yaml - New interface: "userns" * Sat May 27 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.59.5 - Explicitly disallow the use of ioctl + TIOCLINUX This fixes CVE-2023-1523. * Fri May 12 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.59.4 - Retry when looking for disk label on non-UEFI systems (LP: #2018977) - Fix remodel from UC20 to UC22 * Wed May 03 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.59.3 - Fix quiet boot - i/b/physical_memory_observe: allow reading virt-phys page mappings - gadget: warn instead of returning error if overlapping with GPT header - overlord,wrappers: restart always enabled units - go.mod: update github.com/snapcore/secboot to latest uc22 - boot: make sure we update assets for the system-seed-null role - many: ignore case for vfat partitions when validating * Tue Apr 18 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.59.2 - Notify users when a user triggered auto refresh finished * Tue Mar 28 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.59.1 - Add udev rules from steam-devices to steam-support interface - Bugfixes for layout path checking, dm_crypt permissions, mount-control interface parameter checking, kernel commandline parsing, docker-support, refresh-app-awareness * Fri Mar 10 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.59 - Support setting extra kernel command line parameters via snap configuration and under a gadget allow-list - Support for Full-Disk-Encryption using ICE - Support for arbitrary home dir locations via snap configuration - New nvidia-drivers-support interface - Support for udisks2 snap - Pre-download of snaps ready for refresh and automatic refresh of the snap when all apps are closed - New microovn interface - Support uboot with `CONFIG_SYS_REDUNDAND_ENV=n` - Make "snap-preseed --reset" re-exec when needed - Update the fwupd interface to support fully confined fwupd - The memory,cpu,thread quota options are no longer experimental - Support debugging snap client requests via the `SNAPD_CLIENT_DEBUG_HTTP` environment variable - Support ssh listen-address via snap configuration - Support for quotas on single services - prepare-image now takes into account snapd versions going into the image, including in the kernel initrd, to fetch supported assertion formats * Sat Feb 25 2023 Maciek Borzecki <maciek.borzecki@gmail.com> - 2.58.3-1 - Releate 2.58.3 to Fedora RHBZ#2173056 * Tue Feb 21 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.58.3 - interfaces/screen-inhibit-control: Add support for xfce-power- manager - interfaces/network-manager: do not show ptrace read denials - interfaces: relax rules for mount-control `what` for functionfs - cmd/snap-bootstrap: add support for snapd_system_disk - interfaces/modem-manager: add net_admin capability - interfaces/network-manager: add permission for OpenVPN - httputil: fix checking x509 certification error on go 1.20 - i/b/fwupd: allow reading host os-release - boot: on classic+modes `MarkBootSuccessfull` does not need a base - boot: do not include `base=` in modeenv for classic+modes installs - tests: add spread test that validates revert on boot for core does not happen on classic+modes - snapstate: only take boot participants into account in UpdateBootRevisions - snapstate: refactor UpdateBootRevisions() to make it easier to check for boot.SnapTypeParticipatesInBoot() * Wed Jan 25 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.58.2 - bootloader: fix dirty build by hardcoding copyright year * Mon Jan 23 2023 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.58.1 - secboot: detect lockout mode in CheckTPMKeySealingSupported - cmd/snap-update-ns: prevent keeping unneeded mountpoints - o/snapstate: do not infinitely retry when an update fails during seeding - interfaces/modem-manager: add permissions for NETLINK_ROUTE - systemd/emulation.go: use `systemctl --root` to enable/disable - snap: provide more error context in `NotSnapError` - interfaces: add read access to /run for cryptsetup - boot: avoid reboot loop if there is a bad try kernel - devicestate: retry serial acquire on time based certificate errors - o/devicestate: run systemctl daemon-reload after install-device hook - cmd/snap,daemon: add 'held' to notes in 'snap list' - o/snapshotstate: check snapshots are self-contained on import - cmd/snap: show user+gating hold info in 'snap info' - daemon: expose user and gating holds at /v2/snaps/{name} * Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.57.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild * Fri Dec 16 2022 Maciek Borzecki <maciek.borzecki@gmail.com> - 2.57.6-2 - Fix for RHBZ#2152903 * Thu Dec 01 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.58 - many: Use /tmp/snap-private-tmp for per-snap private tmps - data: Add systemd-tmpfiles configuration to create private tmp dir - cmd/snap: test allowed and forbidden refresh hold values - cmd/snap: be more consistent in --hold help and err messages - cmd/snap: error on refresh holds that are negative or too short - o/homedirs: make sure we do not write to /var on build time - image: make sure file customizations happen also when we have defaultscause - tests/fde-on-classic: set ubuntu-seed label in seed partitions - gadget: system-seed-null should also have fs label ubuntu-seed - many: gadget.HasRole, ubuntu-seed can come also from system-seed- null - o/devicestate: fix paths for retrieving recovery key on classic - cmd/snap-confine: do not discard const qualifier - interfaces: allow python3.10+ in the default template - o/restart: fix PendingForSystemRestart - interfaces: allow wayland slot snaps to access shm files created by Firefox - o/assertstate: add Sequence() to val set tracking - o/assertstate: set val set 'Current' to pinned sequence - tests: tweak the libvirt interface test to work on 22.10 - tests: use system-seed-null role on classic with modes tests - boot: add directory for data on install - o/devicestate: change some names from esp to seed/seed-null - gadget: add system-seed-null role - o/devicestate: really add error to new error message - restart,snapstate: implement reboot-required notifications on classic - many: avoid automatic system restarts on classic through new overlord/restart logic - release: Fix WSL detection in LXD - o/state: introduce WaitStatus - interfaces: Fix desktop interface rules for document portal - client: remove classic check for `snap recovery --show- keys` - many: create snapd.mounts targets to schedule mount units - image: enable sysfs overlay for UC preseeding - i/b/network-control: add permissions for using AF_XDP - i/apparmor: move mocking of home and overlay conditions to osutil - tests/main/degraded: ignore man-db update failures in CentOS - cmd/snap: fix panic when running snap w/ flag but w/o subcommand - tests: save snaps generated during image preaparation - tests: skip building snapd based on new env var - client: remove misleading comments in ValidateApplyOptions - boot/seal: add debug traces for bootchains - bootloader/assets: fix grub.cfg when there are no labels - cmd/snap: improve refresh hold's output - packaging: enable BPF in RHEL9 - packaging: do not traverse filesystems in postrm script - tests: get microk8s from another branch - bootloader: do not specify Core version in grub entry - many: refresh --hold follow-up - many: support refresh hold/unhold to API and CLI - many: expand fully handling links mapping in all components, in the API and in snap info - snap/system_usernames,tests: Azure IoT Edge system usernames - interface: Allow access to org.freedesktop.DBus.ListActivatableNames via system-observe interface - o/devicestate,daemon: use the expiration date from the assertion in user-state and REST api (user-removal 4/n) - gadget: add unit tests for new install functions for FDE on classic - cmd/snap-seccomp: fix typo in AF_XDP value - tests/connected-after-reboot-revert: run also on UC16 - kvm: allow read of AMD-SEV parameters - data: tweak apt integration config var - o/c/configcore: add faillock configuration - tests: use dbus-daemon instead of dbus-launch - packaging: remove unclean debian-sid patch - asserts: add keyword 'user-presence' keyword in system-user assertion (auto-removal 3/n) - interfaces: steam-support allow pivot /run/media and /etc/nvidia mount - aspects: initial code - overlord: process auto-import assertion at first boot - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2 - tests: fix lxd-mount-units in ubuntu kinetic - tests: new variable used to configure the kernel command line in nested tests - go.mod: update to newer secboot/uc22 branch - autopkgtests: fix running autopkgtest on kinetic - tests: remove squashfs leftovers in fakeinstaller - tests: create partition table in fakeinstaller - o/ifacestate: introduce DebugAutoConnectCheck hook - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested helper - interfaces/polkit: do not require polkit directory if no file is needed - o/snapstate: be consistent not creating per-snap save dirs for classic models - inhibit: use hintFile() - tests: use `snap prepare-image` in fde-on-classic mk-image.sh - interfaces: add microceph interface - seccomp: allow opening XDP sockets - interfaces: allow access to icon subdirectories - tests: add minimal-smoke test for UC22 and increase minimal RAM - overlord: introduce hold levels in the snapstate.Hold* API - o/devicestate: support mounting ubuntu-save also on classic with modes - interfaces: steam-support allow additional mounts - fakeinstaller: format SystemDetails result with %+v - cmd/libsnap-confine-private: do not panic on chmod failure - tests: ensure that fakeinstaller put the seed into the right place - many: add stub services for prompting - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies - o/snapstate: fix snaps-hold pruning/reset in the presence of system holding - many: add support for setting up encryption from installer - many: support classic snaps in the context of classic and extended models - cmd/snap,daemon: allow zero values from client to daemon for journal rate limit - boot,o/devicestate: extend HasFDESetupHook to consider unrelated kernels - cmd/snap: validation set refresh-enforce CLI support + spread test - many: fix filenames written in modeenv for base/gadget plus drive- by TODO - seed: fix seed test to use a pseudo-random byte sequence - cmd/snap-confine: remove setuid calls from cgroup init code - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem - devicestate,boot,tests: make `fakeinstaller` test work - store: send Snap-Device-Location header with cloud information - overlord: fix unit tests after merging master in - o/auth: move HasUserExpired into UserState and name it HasExpired, and add unit tests for this - o/auth: rename NewUserData to NewUserParams - many: implementation of finish install step handlers - overlord: auto-resolve validation set enforcement constraints - i/backends,o/ifacestate: cleanup backends.All - cmd/snap-confine: move bind-mount setup into separate function - tests/main/mount-ns: update namespace for 18.04 - o/state: Hold pseudo-error for explicit holding, concept of pending changes in prune logic - many: support extended classic models that omit kernel/gadget - data/selinux: allow snapd to detect WSL - overlord: add code to remove users that has an expiration date set - wrappers,snap/quota: clear LogsDirectory= in the service unit for journal namespaces - daemon: move user add, remove operations to overlord device state - gadget: implement write content from gadget information - {device,snap}state: fix ineffectual assignments - daemon: support validation set refresh+enforce in API - many: rename AddAffected* to RegisterAffected*, add Change|State.Has, fix a comment - many: reset store session when setting proxy.store - overlord/ifacestate: fix conflict detection of auto-connection - interfaces: added read/write access to /proc/self/coredump_filter for process-control - interfaces: add read access to /proc/cgroups and /proc/sys/vm/swappiness to system-observe - fde: run fde-reveal-key with `DefaultDependencies=no` - many: don't concatenate non-constant format strings - o/devicestate: fix non-compiling test - release, snapd-apparmor: fixed outdated WSL detection - many: add todos discussed in the review in tests/nested/manual/fde-on-classic, snapstate cleanups - overlord: run install-device hook during factory reset - i/b/mount-control: add optional `/` to umount rules - gadget/install: split Run in several functions - o/devicestate: refactor some methods as preparation for install steps implementation - tests: fix how snaps are cached in uc22 - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and Bionic - many: make {Install,Initramfs}{{,Host},Writable}Dir a function - tests/nested/manual/core20: fix manual test after changes to 'tests.nested exec' - tests: move the unit tests system to 22.04 in github actions workflow - tests: fix nested errors uc20 - boot: rewrite switch in SnapTypeParticipatesInBoot() - gadget: refactor to allow usage from the installer - overlord/devicestate: support for mounting ubuntu-save before the install-device hook - many: allow to install/update kernels/gadgets on classic with modes - tests: fix issues related to dbus session and localtime in uc18 - many: support home dirs located deeper under /home - many: refactor tests to use explicit strings instead of boot.Install{Initramfs,Host}{Writable,FDEData}Dir - boot: add factory-reset cases for boot-flags - tests: disable quota tests on arm devices using ubuntu core - tests: fix unbound SPREAD_PATH variable on nested debug session - overlord: start turning restart into a full state manager - boot: apply boot logic also for classic with modes boot snaps - tests: fix snap-env test on debug section when no var files were created - overlord,daemon: allow returning errors when requesting a restart - interfaces: login-session-control: add further D-Bus interfaces - snapdenv: added wsl to userAgent - o/snapstate: support running multiple ops transactionally - store: use typed valset keys in store package - daemon: add `ensureStateSoon()` when calling systems POST api - gadget: add rules for validating classic with modes gadget.yaml files - wrappers: journal namespaces did not honor journal.persistent - many: stub devicestate.Install{Finish,SetupStorageEncryption}() - sandbox/cgroup: don't check V1 cgroup if V2 is active - seed: add support to load auto import assertion - tests: fix preseed tests for arm systems - include/lk: update LK recovery environment definition to include device lock state used by bootloader - daemon: return `storage-encryption` in /systems/<label> reply - tests: start using remote tools from snapd-testing-tools project in nested tests - tests: fix non mountable filesystem error in interfaces-udisks2 - client: clarify what InstallStep{SetupStorageEncryption,Finish} do - client: prepare InstallSystemOptions for real use - usersession: Remove duplicated struct - o/snapstate: support specific revisions in UpdateMany/InstallMany - i/b/system_packages_doc: restore access to Libreoffice documentation - snap/quota,wrappers: allow using 0 values for the journal rate limit - tests: add kinetic images to the gce bucket for preseed test - multiple: clear up naming convention for thread quota - daemon: implement stub `"action": "install"` - tests/main/snap-quota-{install/journal}: fix unstable spread tests - tests: remove code for old systems not supported anymore - tests: third part of the nested helper cleanup - image: clean snapd mount after preseeding - tests: use the new ubuntu kinetic image - i/b/system_observe: honour root dir when checking for /boot/config-* - tests: restore microk8s test on 16.04 - tests: run spread tests on arm64 instances in google cloud - tests: skip interfaces-udisks2 in fedora - asserts,boot,secboot: switch to a secboot version measuring classic - client: add API for GET /systems/<label> - overlord: frontend for --quota-group support (2/2) - daemon: add GET support for `/systems/<seed-label>` - i/b/system-observe: allow reading processes security label - many: support '--purge' when removing multiple snaps - snap-confine: remove obsolete code - interfaces: rework logic of unclashMountEntries - data/systemd/Makefile: add comment warning about "snapd." prefix - interfaces: grant access to speech-dispatcher socket (bug 1787245) - overlord/servicestate: disallow removal of quota group with any limits set - data: include snapd/mounts in preseeded blob - many: Set SNAPD_APPARMOR_REEXEC=1 - store/tooling,tests: support UBUNTU_STORE_URL override env var - multiple: clear up naming convention for cpu-set quota - tests: improve and standardize debug section on tests - device: add new DeviceManager.encryptionSupportInfo() - tests: check snap download with snapcraft v7+ export-login auth data - cmd/snap-bootstrap: changes to be able to boot classic rootfs - tests: fix debug section for test uc20-create-partitions - overlord: --quota-group support (1/2) - asserts,cmd/snap-repair: drop not pursued AuthorityDelegation/signatory-id - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode - interfaces: make polkit implicit on core if /usr/libexec/polkitd exists - multiple: move arguments for auth.NewUser into a struct (auto- removal 1/n) - overlord: track security profiles for non-active snaps - tests: remove NESTED_IMAGE_ID from nested manual tests - tests: add extra space to ubuntu bionic - store/tooling: support using snapcraft v7+ base64-encoded auth data - overlord: allow seeding in the case of classic with modes system - packaging/*/tests/integrationtests: reload ssh.service, not sshd.service - tests: rework snap-logs-journal test and add missing cleanup - tests: add spread test for journal quotas - tests: run spread tests in ubuntu kinetic - o/snapstate: extend support for holding refreshes - devicestate: return an error in checkEncryption() if KernelInfo fails - tests: fix sbuild test on debian sid - o/devicestate: do not run tests in this folder twice - sandbox/apparmor: remove duplicate hook into testing package - many: refactor store code to be able to use simpler form of auth creds - snap,store: drop support/consideration for anonymous download urls - data/selinux: allow snaps to read certificates - many: add Is{Core,Classic}Boot() to DeviceContext - o/assertstate: don't refresh enforced validation sets during check - go.mod: replace maze.io/x/crypto with local repo - many: fix unnecessary use of fmt.Sprintf - bootloader,systemd: fix `don't use Yoda conditions (ST1017)` - HACKING.md: extend guidelines with common review comments - many: progress bars should use the overridable stdouts - tests: remove ubuntu 21.10 from sru validation - tests: import remote tools - daemon,usersession: switch from HeaderMap to Header in tests - asserts: add some missing `c.Check()` in the asserts test - strutil: fix VersionCompare() to allow multiple `-` in the version - testutil: remove unneeded `fmt.Sprintf` - boot: remove some unneeded `fmt.Sprintf()` calls - tests: implement prepare_gadget and prepare_base and unify all the version - o/snapstate: refactor managed refresh schedule logic - o/assertstate, snapasserts: implementation of assertstate.TryEnforceValidationSets function - interfaces: add kconfig paths to system-observe - dbusutil: move debian patch into dbustest - many: change name and input of CheckProvenance to clarify usage - tests: Fix a missing parameter in command to wait for device - tests: Work-around non-functional --wait on systemctl - tests: unify the way the snapd/core and kernel are repacked in nested helper - tests: skip interfaces-ufisks2 on centos-9 - i/b/mount-control: allow custom filesystem types - interfaces,metautil: make error handling in getPaths() more targeted - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY - tests: fix pc-kernel repacking - systemd: add `WantedBy=default.target` to snap mount units - tests: disable microk8s test on 16.04 * Wed Nov 30 2022 Maciek Borzecki <maciek.borzecki@gmail.com> - 2.57.6-1 - Release 2.57.6 to Fedora * Tue Nov 15 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.57.6 - SECURITY UPDATE: Local privilege escalation - snap-confine: Fix race condition in snap-confine when preparing a private tmp mount namespace for a snap - CVE-2022-3328 * Mon Oct 17 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.57.5 - image: clean snapd mount after preseeding - wrappers,snap/quota: clear LogsDirectory= in the service unit for journal namespaces - cmd/snap,daemon: allow zero values from client to daemon for journal rate-limit - interfaces: steam-support allow pivot /run/media and /etc/nvidia mount - o/ifacestate: introduce DebugAutoConnectCheck hook - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2 - autopkgtests: fix running autopkgtest on kinetic - interfaces: add microceph interface - interfaces: steam-support allow additional mounts - many: add stub services - interfaces: add kconfig paths to system-observe - i/b/system_observe: honour root dir when checking for /boot/config-* - interfaces: grant access to speech-dispatcher socket - interfaces: rework logic of unclashMountEntries * Thu Sep 29 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.57.4 - release, snapd-apparmor: fixed outdated WSL detection - overlord/ifacestate: fix conflict detection of auto-connection - overlord: run install-device hook during factory reset - image/preseed/preseed_linux: add missing new line - boot: add factory-reset cases for boot-flags. - interfaces: added read/write access to /proc/self/coredump_filter for process-control - interfaces: add read access to /proc/cgroups and /proc/sys/vm/swappiness to system-observe - fde: run fde-reveal-key with `DefaultDependencies=no` - snapdenv: added wsl to userAgent - tests: fix restore section for persistent-journal-namespace - i/b/mount-control: add optional `/` to umount rules - cmd/snap-bootstrap: changes to be able to boot classic rootfs - cmd/snap-bootstrap: add CVM mode * Thu Sep 15 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.57.3 - wrappers: journal namespaces did not honor journal.persistent - snap/quota,wrappers: allow using 0 values for the journal rate to override the system default values - multiple: clear up naming convention for cpu-set quota - i/b/mount-control: allow custom filesystem types - i/b/system-observe: allow reading processes security label - sandbox/cgroup: don't check V1 cgroup if V2 is active - asserts,boot,secboot: switch to a secboot version measuring classic * Fri Sep 02 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.57.2 - store/tooling,tests: support UBUNTU_STORE_URL override env var - packaging/*/tests/integrationtests: reload ssh.service, not sshd.service - tests: check snap download with snapcraft v7+ export-login auth data - store/tooling: support using snapcraft v7+ base64-encoded auth data - many: progress bars should use the overridable stdouts - many: refactor store code to be able to use simpler form of auth creds - snap,store: drop support/consideration for anonymous download urls - data: include snapd/mounts in preseeded blob - many: Set SNAPD_APPARMOR_REEXEC=1 - overlord: track security profiles for non-active snaps * Wed Aug 10 2022 Alberto Mardegan <alberto.mardegan@canonical.com> - New upstream release 2.57.1 - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY - cmd/snap-update-ns: print current mount entries - cmd/snap-update-ns: check the unused mounts with a cleaned path - snap-confine: disable -Werror=array-bounds in __overflow tests to fix build error on Ubuntu 22.10 - systemd: add `WantedBy=default.target` to snap mount units (LP: #1983528) * Thu Jul 28 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.57 - tests: Fix calls to systemctl is-system-running - osutil/disks: handle GPT for 4k disk and too small tables - packaging: import change from the 2.54.3-1.1 upload - many: revert "features: disable refresh-app-awarness by default again" - tests: improve robustness of preparation for regression/lp-1803542 - tests: get the ubuntu-image binary built with test keys - tests: remove commented code from lxd test - interfaces/builtin: add more permissions for steam-support - tests: skip interfaces-network-control on i386 - tests: tweak the "tests/nested/manual/connections" test - interfaces: posix-mq: allow specifying message queue paths as an array - bootloader/assets: add ttyS0,115200n8 to grub.cfg - i/b/desktop,unity7: remove name= specification on D-Bus signals - tests: ensure that microk8s does not produce DENIED messages - many: support non-default provenance snap-revisions in DeriveSideInfo - tests: fix `core20-new-snapd-does-not-break-old-initrd` test - many: device and provenance revision authority cross checks - tests: fix nested save-data test on 22.04 - sandbox/cgroup: ignore container slices when tracking snaps - tests: improve 'ignore-running' spread test - tests: add `debug:` section to `tests/nested/manual/connections` - tests: remove leaking `pc-kernel.snap` in `repack_kernel_snap` - many: preparations for revision authority cross checks including device scope - daemon,overlord/servicestate: followup changes from PR #11960 to snap logs - cmd/snap: fix visual representation of 'AxB%' cpu quota modifier. - many: expose and support provenance from snap.yaml metadata - overlord,snap: add support for per-snap storage on ubuntu-save - nested: fix core-early-config nested test - tests: revert lxd change to support nested lxd launch - tests: add invariant check for leftover cgroup scopes - daemon,systemd: introduce support for namespaces in 'snap logs' - cmd/snap: do not track apps that wish to stay outside of the life- cycle system - asserts: allow classic + snaps models and add distribution to model - cmd/snap: add snap debug connections/connection commands - data: start snapd after time-set.target - tests: remove ubuntu 21.10 from spread tests due to end of life - tests: Update the whitebox word to avoid inclusive naming issues - many: mount gadget in run folder - interfaces/hardware-observe: clean up reading access to sysfs - tests: use overlayfs for interfaces-opengl-nvidia test - tests: update fake-netplan-apply test for 22.04 - tests: add executions for ubuntu 22.04 - tests: enable centos-9 - tests: make more robust the files check in preseed-core20 test - bootloader/assets: add fallback entry to grub.cfg - interfaces/apparmor: add permissions for per-snap directory on ubuntu-save partition - devicestate: add more path to `fixupWritableDefaultDirs()` - boot,secboot: reset DA lockout counter after successful boot - many: Revert "overlord,snap: add support for per-snap storage on ubuntu-save" - overlord,snap: add support for per-snap storage on ubuntu-save - tests: exclude centos-7 from kernel-module-load test - dirs: remove unused SnapAppArmorAdditionalDir - boot,device: extract SealedKey helpers from boot to device - boot,gadget: add new `device.TpmLockoutAuthUnder()` and use it - interfaces/display-control: allow changing brightness value - asserts: add more context to key expiry error - many: introduce IsUndo flag in LinkContext - i/apparmor: allow calling which.debianutils - tests: new profile id for apparmor in test preseed-core20 - tests: detect 403 in apt-hooks and skip test in this case - overlord/servicestate: restart the relevant journald service when a journal quota group is modified - client,cmd/snap: add journal quota frontend (5/n) - gadget/device: introduce package which provides helpers for locations of things - features: disable refresh-app-awarness by default again - many: install bash completion files in writable directory - image: fix handling of var/lib/extrausers when preseeding uc20 - tests: force version 2.48.3 on xenial ESM - tests: fix snap-network-erros on uc16 - cmd/snap-confine: be compatible with a snap rootfs built as a tmpfs - o/snapstate: allow install of unasserted gadget/kernel on dangerous models - interfaces: dynamic loading of kernel modules - many: add optional primary key provenance to snap-revision, allow delegating via snap-declaration revision-authority - tests: fix boringcripto errors in centos7 - tests: fix snap-validate-enforce in opensuse-tumbleweed - test: print User-Agent on failed checks - interfaces: add memory stats to system_observe - interfaces/pwm: Remove implicitOnCore/implicitOnClassic - spread: add openSUSE Leap 15.4 - tests: disable core20-to-core22 nested test - tests: fix nested/manual/connections test - tests: add spread test for migrate-home command - overlord/servicestate: refresh security profiles when services are affected by quotas - interfaces/apparmor: add missing apparmor rules for journal namespaces - tests: add nested test variant that adds 4k sector size - cmd/snap: fix test failing due to timezone differences - build-aux/snap: build against the snappy-dev/image PPA - daemon: implement api handler for refresh with enforced validation sets - preseed: suggest to install "qemu-user-static" - many: add migrate-home debug command - o/snapstate: support passing validation sets to storehelpers via RevisionOptions - cmd/snapd-apparmor: fix unit tests on distros which do not support reexec - o/devicestate: post factory reset ensure, spread test update - tests/core/basic20: Enable on uc22 - packaging/arch: install snapd-apparmor - o/snapstate: support migrating snap home as change - tests: enable snapd.apparmor service in all the opensuse systems - snapd-apparmor: add more integration-ish tests - asserts: store required revisions for missing snaps in CheckInstalledSnaps - overlord/ifacestate: fix path for journal redirect - o/devicestate: factory reset with encryption - cmd/snapd-apparmor: reimplement snapd-apparmor in Go - squashfs: improve error reporting when `unsquashfs` fails - o/assertstate: support multiple extra validation sets in EnforcedValidationSets - tests: enable mount-order-regression test for arm devices - tests: fix interfaces network control - interfaces: update AppArmor template to allow read the memory … - cmd/snap-update-ns: add /run/systemd to unrestricted paths - wrappers: fix LogNamespace being written to the wrong file - boot: release the new PCR handles when sealing for factory reset - tests: add support fof uc22 in test uboot-unpacked-assets - boot: post factory reset cleanup - tests: add support for uc22 in listing test - spread.yaml: add ubuntu-22.04-06 to qemu-nested - gadget: check also mbr type when testing for implicit data partition - interfaces/system-packages-doc: allow read-only access to /usr/share/cups/doc-root/ and /usr/share/gimp/2.0/help/ - tests/nested/manual/core20-early-config: revert changes that disable netplan checks - o/ifacestate: warn if the snapd.apparmor service is disabled - tests: add spread execution for fedora 36 - overlord/hookstate/ctlcmd: fix timestamp coming out of sync in unit tests - gadget/install: do not assume dm device has same block size as disk - interfaces: update network-control interface with permissions required by resolvectl - secboot: stage and transition encryption keys - secboot, boot: support and use alternative PCR handles during factory reset - overlord/ifacestate: add journal bind-mount snap layout when snap is in a journal quota group (4/n) - secboot/keymgr, cmd/snap-fde-keymgr: two step encryption key change - cmd/snap: cleanup and make the code a bit easier to read/maintain for quota options - overlord/hookstate/ctlcmd: add 'snapctl model' command (3/3) - cmd/snap-repair: fix snap-repair tests silently failing - spread: drop openSUSE Leap 15.2 - interfaces/builtin: remove the name=org.freedesktop.DBus restriction in cups-control AppArmor rules - wrappers: write journald config files for quota groups with journal quotas (3/n) - o/assertstate: auto aliases for apps that exist - o/state: use more detailed NoStateError in state - tests/main/interfaces-browser-support: verify jupyter notebooks access - o/snapstate: exclude services from refresh app awareness hard running check - tests/main/nfs-support: be robust against umount failures - tests: update centos images and add new centos 9 image - many: print valid/invalid status on snap validate --monitor - secboot, boot: TPM provisioning mode enum, introduce reprovisioning - tests: allow to re-execute aborted tests - cmd/snapd-apparmor: add explicit WSL detection to is_container_with_internal_policy - tests: avoid launching lxd inside lxd on cloud images - interfaces: extra htop apparmor rules - gadget/install: encrypted system factory reset support - secboot: helpers for dealing with PCR handles and TPM resources - systemd: improve error handling for systemd-sysctl command - boot, secboot: separate the TPM provisioning and key sealing - o/snapstate: fix validation sets restoring and snap revert on failed refresh - interfaces/builtin/system-observe: extend access for htop - cmd/snap: support custom apparmor features dir with snap prepare- image - interfaces/mount-observe: Allow read access to /run/mount/utab - cmd/snap: add help strings for set-quota options - interfaces/builtin: add README file - cmd/snap-confine: mount support cleanups - overlord: execute snapshot cleanup in task - i/b/accounts_service: fix path of introspectable objects - interfaces/opengl: update allowed PCI accesses for RPi - configcore: add core.system.ctrl-alt-del-action config option - many: structured startup timings - spread: switch back to building ubuntu-image from source - many: optional recovery keys - tests/lib/nested: fix unbound variable - run-checks: fail on equality checks w/ ErrNoState - snap-bootstrap: Mount as private - tests: Test for gadget connections - tests: set `br54.dhcp4=false` in the netplan-cfg test - tests: core20 preseed/nested spread test - systemd: remove the systemctl stop timeout handling - interfaces/shared-memory: Update AppArmor permissions for mmap+link - many: replace ErrNoState equality checks w/ errors.Is() - cmd/snap: exit w/ non-zero code on missing snap - systemd: fix snapd systemd-unit stop progress notifications - .github: Trigger daily riscv64 snapd edge builds - interfaces/serial-port: add ttyGS to serial port allow list - interfaces/modem-manager: Don't generate DBus plug policy - tests: add spread test to test upgrade from release snapd to current - wrappers: refactor EnsureSnapServices - testutil: add ErrorIs test checker - tests: import spread shellcheck changes - cmd/snap-fde-keymgr: best effort idempotency of add-recovery-key - interfaces/udev: refactor handling of udevadm triggers for input - secboot: support for changing encryption keys via keymgr * Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.56.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild * Tue Jul 19 2022 Maxwell G <gotmax@e.email> - 2.56.2-4 - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang * Wed Jul 13 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.56.3 - devicestate: add more path to `fixupWritableDefaultDirs()` - many: introduce IsUndo flag in LinkContext - i/apparmor: allow calling which.debianutils - interfaces: update AppArmor template to allow reading snap's memory statistics - interfaces: add memory stats to system_observe - i/b/{mount,system}-observe: extend access for htop - features: disable refresh-app-awarness by default again - image: fix handling of var/lib/extrausers when preseeding uc20 - interfaces/modem-manager: Don't generate DBus policy for plugs - interfaces/modem-manager: Only generate DBus plug policy on Core - interfaces/serial_port_test: fix static-checks errors - interfaces/serial-port: add USB gadget serial devices (ttyGSX) to allowed list - interface/serial_port_test: adjust variable IDs * Sun Jul 10 2022 Maxwell G <gotmax@e.email> - 2.56.2-2 - Only build on %golang_arches (i.e. where golang is available). - Rebuild to fix update ordering issues. * Sat Jul 09 2022 Maxwell G <gotmax@e.email> - 2.56.2-2 - Rebuild for CVE-2022-{24675,28327,29526 in golang} * Tue Jun 21 2022 Maciek Borzecki <maciek.borzecki@gmail.com> - 2.56.2-1 - Release 2.56.2 to Fedora and EPEL * Sat Jun 18 2022 Robert-André Mauchin <zebob.m@gmail.com> - 2.55.3-2 - Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191, CVE-2022-29526, CVE-2022-30629 * Wed Jun 15 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.56.2 - o/snapstate: exclude services from refresh app awareness hard running check - cmd/snap: support custom apparmor features dir with snap prepare-image * Wed Jun 15 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.56.1 - gadget/install: do not assume dm device has same block size as disk - gadget: check also mbr type when testing for implicit data partition - interfaces: update network-control interface with permissions required by resolvectl - interfaces/builtin: remove the name=org.freedesktop.DBus restriction in cups-control AppArmor rules - many: print valid/invalid status on snap validate --monitor ... - o/snapstate: fix validation sets restoring and snap revert on failed refresh - interfaces/opengl: update allowed PCI accesses for RPi - interfaces/shared-memory: Update AppArmor permissions for mmap+linkpaths * Thu May 19 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.56 - portal-info: Add CommonID Field - asserts/info,mkversion.sh: capture max assertion formats in snapd/info - tests: improve the unit testing workflow to run in parallel - interfaces: allow map and execute permissions for files on removable media - tests: add spread test to verify that connections are preserved if snap refresh fails - tests: Apparmor sandbox profile mocking - cmd/snap-fde-keymgr: support for multiple devices and authorizations for add/remove recovery key - cmd/snap-bootstrap: Listen to keyboard added after start and handle switch root - interfaces,overlord: add support for adding extra mount layouts - cmd/snap: replace existing code for 'snap model' to use shared code in clientutil (2/3) - interfaces: fix opengl interface on RISC-V - interfaces: allow access to the file locking for cryptosetup in the dm-crypt interface - interfaces: network-manager: add AppArmor rule for configuring bridges - i/b/hardware-observe.go: add access to the thermal sysfs - interfaces: opengl: add rules for NXP i.MX GPU drivers - i/b/mount_control: add an optional "/" to the mount target rule - snap/quota: add values for journal quotas (journal quota 2/n) - tests: spread test for uc20 preseeding covering snap prepare-image - o/snapstate: remove deadcode breaking static checks - secboot/keymgr: extend unit tests, add helper for identify keyslot used error - tests: use new snaps.name and snaps.cleanup tools - interfaces: tweak getPath() slightly and add some more tests - tests: update snapd testing tools - client/clientutil: add shared code for printing model assertions as yaml or json (1/3) - debug-tools: list all snaps - cmd/snap: join search terms passed in the command line - osutil/disks: partition UUID lookup - o/snapshotstate: refactor snapshot read/write logic - interfaces: Allow locking in block-devices - daemon: /v2/system-recovery-keys remove API - snapstate: do not auto-migrate to ~/Snap for core22 just yet - tests: run failed tests by default - o/snapshotstate: check installed snaps before running 'save' tasks - secboot/keymgr: remove recovery key, authorize with existing key - deps: bump libseccomp to include build fixes, run unit tests using CC=clang - cmd/snap-seccomp: only compare the bottom 32-bits of the flags arg of copy_file_range - osutil/disks: helper for obtaining the UUID of a partition which is a mount point source - image/preseed: umount the base snap last after writable paths - tests: new set of nested tests for uc22 - tests: run failed tests on nested suite - interfaces: posix-mq: add new interface - tests/main/user-session-env: remove openSUSE-specific tweaks - tests: skip external backend in mem-cgroup-disabled test - snap/quota: change the journal quota period to be a time.Duration - interfaces/apparmor: allow executing /usr/bin/numfmt in the base template - tests: add lz4 dependency for jammy to avoid issues repacking kernel - snap-bootstrap, o/devicestate: use seed parallelism - cmd/snap-update-ns: correctly set sticky bit on created directories where applicable - tests: install snapd while restoring in snap-mgmt - .github: skip misspell and ineffassign on go 1.13 - many: use UC20+/pre-UC20 in user messages as needed - o/devicestate: use snap handler for copying and checksuming preseeded snaps - image, cmd/snap-preseed: allow passing custom apparmor features path - o/assertstate: fix handling of validation set tracking update in enforcing mode - packaging: restart our units only after the upgrade - interfaces: add a steam-support interface - gadget/install, o/devicestate: do not create recovery and reinstall keys during installation - many: move recovery key responsibility to devicestate/secboot, prepare for a future with just optional recovery key - tests: do not run mem-cgroup-disabled on external backends - snap: implement "star" developers - o/devicestate: fix install tests on systems with /var/lib/snapd/snap - cmd/snap-fde-keymgr, secboot: followup cleanups - seed: let SnapHandler provided a different final path for snaps - o/devicestate: implement maybeApplyPreseededData function to apply preseed artifact - tests/lib/tools: add piboot to boot_path() - interfaces/builtin: shared-memory drop plugs allow-installation: true - tests/main/user-session-env: for for opensuse - cmd/snap-fde-keymgr, secboot: add a tiny FDE key manager - tests: re-execute the failed tests when "Run failed" label is set in the PR - interfaces/builtin/custom-device: fix unit tests on hosts with different libexecdir - sandbox: move profile load/unload to sandbox/apparmor - cmd/snap: handler call verifications for cmd_quota_tests - secboot/keys: introduce a package for secboot key types, use the package throughout the code base - snap/quota: add journal quotas to resources.go - many: let provide a SnapHandler to Seed.Load*Meta* - osutil: allow setting desired mtime on the AtomicFile, preserve mtime on copy - systemd: add systemd.Run() wrapper for systemd-run - tests: test fresh install of core22-based snap (#11696) - tests: initial set of tests to uc22 nested execution - o/snapstate: migration overwrites existing snap dir - tests: fix interfaces-location-control tests leaking provider.py process - tests/nested: fix custom-device test - tests: test migration w/ revert, refresh and XDG dir creation - asserts,store: complete support for optional primary key headers for assertions - seed: support parallelism when loading/verifying snap metadata - image/preseed, cmd/snap-preseed: create and sign preseed assertion - tests: Initial changes to run nested tests on uc22 - o/snapstate: fix TestSnapdRefreshTasks test after two r-a-a PRs - interfaces: add ACRN hypervisor support - o/snapstate: exclude TypeSnapd and TypeOS snaps from refresh-app- awareness - features: enable refresh-app-awareness by default - libsnap-confine-private: show proper error when aa_change_onexec() fails - i/apparmor: remove leftover comment - gadget: drop unused code in unit tests - image, store: move ToolingStore to store/tooling package - HACKING: update info for snapcraft remote build - seed: return all essential snaps found if no types are given to LoadEssentialMeta - i/b/custom_device: fix generation of udev rules - tests/nested/manual/core20-early-config: disable netplan checks - bootloader/assets, tests: add factory-reset mode, test non- encrypted factory-reset - interfaces/modem-manager: add support for Cinterion modules - gadget: fully support multi-volume gadget asset updates in Update() on UC20+ - i/b/content: use slot.Lookup() as suggested by TODO comment - tests: install linux-tools-gcp on jammy to avoid bpftool dependency error - tests/main: add spread tests for new cpu and thread quotas - snap-debug-info: print validation sets and validation set assertions - many: renaming related to inclusive language part 2 - c/snap-seccomp: update syscalls to match libseccomp 2657109 - github: cancel workflows when pushing to pull request branches - .github: use reviewdog action from woke tool - interfaces/system-packages-doc: allow read-only access to /usr/share/gtk-doc - interfaces: add max_map_count to system-observe - o/snapstate: print pids of running processes on BusySnapError - .github: run woke tool on PR's - snapshots: follow-up on exclusions PR - cmd/snap: add check switch for snap debug state - tests: do not run mount-order-regression test on i386 - interfaces/system-packages-doc: allow read-only access to /usr/share/xubuntu-docs - interfaces/hardware_observe: add read access for various devices - packaging: use latest go to build spread - tests: Enable more tests for UC22 - interfaces/builtin/network-control: also allow for mstp and bchat devices too - interfaces/builtin: update apparmor profile to allow creating mimic over /usr/share* - data/selinux: allow snap-update-ns to mount on top of /var/snap inside the mount ns - interfaces/cpu-control: fix apparmor rules of paths with CPU ID - tests: remove the file that configures nm as default - tests: fix the change done for netplan-cfg test - tests: disable netplan-cfg test - cmd/snap-update-ns: apply content mounts before layouts - overlord/state: add a helper to detect cyclic dependencies between tasks in change - packaging/ubuntu-16.04/control: recommend `fuse3 | fuse` - many: change "transactional" flag to a "transaction" option - b/piboot.go: check EEPROM version for RPi4 - snap/quota,spread: raise lower memory quota limit to 640kb - boot,bootloader: add missing grub.cfg assets mocks in some tests - many: support --ignore-running with refresh many - tests: skip the test interfaces-many-snap-provided in trusty - o/snapstate: rename XDG dirs during HOME migration - cmd/snap,wrappers: fix wrong implementation of zero count cpu quota - i/b/kernel_module_load: expand $SNAP_COMMON in module options - interfaces/u2f-devices: add Solo V2 - overlord: add missing grub.cfg assets mocks in manager_tests.go - asserts: extend optional primary keys support to the in-memory backend - tests: update the lxd-no-fuse test - many: fix failing golangci checks - seed,many: allow to limit LoadMeta to snaps of a precise mode - tests: allow ubuntu-image to be built with a compatible snapd tree - o/snapstate: account for repeat migration in ~/Snap undo - asserts: start supporting optional primary keys in fs backend, assemble and signing - b/a: do not set console in kernel command line for arm64 - tests/main/snap-quota-groups: fix spread test - sandbox,quota: ensure cgroup is available when creating mem quotas - tests: add debug output what keeps `/home` busy - sanity: rename "sanity.Check" to "syscheck.CheckSystem" - interfaces: add pkcs11 interface - o/snapstate: undo migration on 'snap revert' - overlord: snapshot exclusions - interfaces: add private /dev/shm support to shared-memory interface - gadget/install: implement factory reset for unencrypted system - packaging: install Go snap from 1.17 channel in the integration tests - snap-exec: fix detection if `cups` interface is connected - tests: extend gadget-config-defaults test with refresh.retain - cmd/snap,strutil: move lineWrap to WordWrapPadded - bootloader/piboot: add support for armhf - snap,wrappers: add `sigint{,-all}` to supported stop-modes - packaging/ubuntu-16.04/control: depend on fuse3 | fuse - interfaces/system-packages-doc: allow read-only access to /usr/share/libreoffice/help - daemon: add a /v2/accessories/changes/{ID} endpoint - interfaces/appstream-metadata: Re-create app-info links to swcatalog - debug-tools: add script to help debugging GCE instances which fail to boot - gadget/install, kernel: more ICE helpers/support - asserts: exclude empty snap id from duplicates lookup with preseed assert - cmd/snap, signtool: move key-manager related helpers to signtool package - tests/main/snap-quota-groups: add 219 as possible exit code - store: set validation-sets on actions when refreshing - github/workflows: update golangci-lint version - run-check: use go install instead of go get - tests: set as manual the interfaces-cups-control test - interfaces/appstream-metadata: Support new swcatalog directory names - image/preseed: migrate tests from cmd/snap-preseed - tests/main/uc20-create-partitions: update the test for new Go versions - strutil: move wrapGeneric function to strutil as WordWrap - many: small inconsequential tweaks - quota: detect/error if cpu-set is used with cgroup v1 - tests: moving ubuntu-image to candidate to fix uc16 tests - image: integrate UC20 preseeding with image.Prepare - cmd/snap,client: frontend for cpu/thread quotas - quota: add test for `Resource.clone()` - many: replace use of "sanity" with more inclusive naming (part 2) - tests: switch to "test-snapd-swtpm" - i/b/network-manager: split rule with more than one peers - tests: fix restore of the BUILD_DIR in failover test on uc18 - cmd/snap/debug: sort changes by their spawn times - asserts,interfaces/policy: slot-snap-id allow-installation constraints - o/devicestate: factory reset mode, no encryption - debug-tools/snap-debug-info.sh: print message if no gadget snap found - overlord/devicestate: install system cleanups - cmd/snap-bootstrap: support booting into factory-reset mode - o/snapstate, ifacestate: pass preseeding flag to AddSnapdSnapServices - o/devicestate: restore device key and serial when assertion is found - data: add static preseed.json file - sandbox: improve error message from `ProbeCgroupVersion()` - tests: fix the nested remodel tests - quota: add some more unit tests around Resource.Change() - debug-tools/snap-debug-info.sh: add debug script - tests: workaround lxd issue lp:10079 (function not implemented) on prep-snapd-in-lxd - osutil/disks: blockdev need not be available in the PATH - cmd/snap-preseed: address deadcode linter - tests/lib/fakestore/store: return snap base in details - tests/lib/nested.sh: rm core18 snap after download - systemd: do not reload system when enabling/disabling services - i/b/kubernetes_support: add access to Java certificates * Wed May 11 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.55.5 - snapstate: do not auto-migrate to ~/Snap for core22 just yet - cmd/snap-seccomp: add copy_file_range to syscallsWithNegArgsMaskHi32 - cmd/snap-update-ns: correctly set sticky bit on created directories where applicable - .github: Skip misspell and ineffassign on go 1.13 - tests: add lz4 dependency for jammy to avoid issues repacking kernel - interfaces: posix-mq: add new interface * Sat Apr 30 2022 Michael Vogt <michael.vogt@ubuntu.com> - New upstream release 2.55.4 - tests: do not run mount-order-regression test on i386 - c/snap-seccomp: update syscalls - o/snapstate: overwrite ~/.snap subdir when migrating - o/assertstate: fix handling of validation set tracking update in enforcing mode - packaging: restart our units only after the upgrade - interfaces: add a steam-support interface - features: enable refresh-app-awareness by default - i/b/custom_device: fix generation of udev rules - interfaces/system-packages-doc: allow read-only access to /usr/share/gtk-doc - interfaces/system-packages-doc: allow read-only access to /usr/share/xubuntu-docs - interfaces/builtin/network-control: also allow for mstp and bchat devices too - interfaces/builtin: update apparmor profile to allow creating mimic over /usr/share - data/selinux: allow snap-update-ns to mount on top of /var/snap inside the mount ns - interfaces/cpu-control: fix apparmor rules of paths with CPU ID
/usr/lib/.build-id /usr/lib/.build-id/03 /usr/lib/.build-id/03/04b7bcc258af8b3f3f52b295e16ceaab324fe3 /usr/lib/.build-id/09 /usr/lib/.build-id/09/c152ee7dda0d776a83afa4e0120f756e6bab63 /usr/lib/.build-id/30/2db73d328a0346bdfa66ed689073aec6ba7dfe /usr/lib/.build-id/42 /usr/lib/.build-id/42/40e6a06193803b76f82515b6ea2c43a5584557 /usr/lib/.build-id/44 /usr/lib/.build-id/44/c3c84d8c46f27e4654a11a3cbf767c26939a78 /usr/lib/.build-id/54 /usr/lib/.build-id/54/31bdb2c751073e0a09346180d12234a88b3f3d /usr/lib/.build-id/7a /usr/lib/.build-id/7a/b97c8c3da2aa2e18197f81789bea08c62a1836 /usr/lib/.build-id/e8 /usr/lib/.build-id/e8/c531d72d43c720a33de64e9da98dec7e2e62ca /usr/lib/systemd/system-generators/snapd-generator /usr/libexec/snapd /usr/libexec/snapd/snap-confine /usr/libexec/snapd/snap-device-helper /usr/libexec/snapd/snap-discard-ns /usr/libexec/snapd/snap-gdb-shim /usr/libexec/snapd/snap-gdbserver-shim /usr/libexec/snapd/snap-seccomp /usr/libexec/snapd/snap-update-ns /usr/share/doc/snap-confine /usr/share/doc/snap-confine/PORTING /usr/share/licenses/snap-confine /usr/share/licenses/snap-confine/COPYING /usr/share/man/man8/snap-confine.8.gz /usr/share/man/man8/snap-discard-ns.8.gz /var/lib/snapd/void
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 18 10:32:39 2024