many: switch to apparmor 5.x with 5 ABI#15967
Open
zyga wants to merge 10 commits intocanonical:masterfrom
Open
many: switch to apparmor 5.x with 5 ABI#15967zyga wants to merge 10 commits intocanonical:masterfrom
zyga wants to merge 10 commits intocanonical:masterfrom
Conversation
github-actions
bot
added
the
Run only one system
|
Mon Mar 23 10:48:38 UTC 2026 Failures:Preparing:
Executing:
Skipped tests from snapd-testing-skip
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #15967 +/- ##
==========================================
+ Coverage 77.56% 77.63% +0.07%
==========================================
Files 1366 1352 -14
Lines 188489 188228 -261
Branches 2446 2446
==========================================
- Hits 146199 146136 -63
+ Misses 33460 33278 -182
+ Partials 8830 8814 -16
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
zyga
changed the title
Member
|
This is surprisingly green. Maybe it would be best to have two separate draft PRs in parallel, one with 5.0.0 but with still ABI v4, then one which switches to ABI v5, so we can ensure that there's actually anything different in that switch (as there should be). |
zyga
changed the title
Contributor
Author
|
I have updated this to 5 alpha 6. @olivercalder I would like to return to this after 4.1.6 lands and after we have a sane 6.19 kernel |
github-actions
bot
removed
the
Run only one system
Contributor
There was a problem hiding this comment.
Pull request overview
Updates snapd’s AppArmor userspace integration to start consuming AppArmor 5 (alpha) and prefer ABI 5 policy features when using the internal apparmor_parser, as part of early enablement work toward ABI 5 profiles.
Changes:
- Prefer the internal
apparmor.d/abi/5.0file (falling back to 4.0/3.0) when selecting--policy-featuresfor the internal parser. - Pin snap-confine’s snap-build dependency to libapparmor 5 alpha.
- Update snapcraft to fetch/build AppArmor 5 alpha (and stop applying the previously-carried local patches during that build).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| sandbox/apparmor/apparmor.go | Prefer ABI 5.0 for internal apparmor_parser policy features when available. |
| cmd/configure.ac | Pin snap-build libapparmor requirement to AppArmor 5 alpha. |
| build-aux/snap/snapcraft.yaml | Fetch/build AppArmor 5 alpha6 tarball for the snap build. |
Comments suppressed due to low confidence (1)
sandbox/apparmor/apparmor.go:920
- The comment above this logic still says we "ensure we use the 4.0 feature ABI", but the code now prefers ABI 5.0 when present. Please update the comment so it matches the new selection order (5.0 → 4.0 → 3.0).
snapdAbi50File := filepath.Join(prefix, "/apparmor.d/abi/5.0")
// When using the internal apparmor_parser also use its own
// configuration and includes etc plus also ensure we use the 4.0
// feature ABI to get the widest array of policy features across
Contributor
Author
|
I've updated this to apparmor 5 beta 1 which is also available as a classic debian package in Ubuntu 26.04 now. |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
sandbox/apparmor/apparmor.go:921
- The comment on line 919 states "ensure we use the 4.0 feature ABI" but the code now supports ABI 5.0. This comment should be updated to reflect that the code now preferentially uses ABI 5.0 when available, with fallbacks to 4.0 and 3.0.
// When using the internal apparmor_parser also use its own
// configuration and includes etc plus also ensure we use the 4.0
// feature ABI to get the widest array of policy features across
// the widest array of kernel versions.
a83531c to
3ac1f54
Compare
zyga
changed the title
Switch the copy of apparmor bundled with snapd snap to the new 5 alpha 2 release. This keeps the old ABI intact so our profiles should retain old semantics. Jira: https://warthogs.atlassian.net/browse/SNAPDENG-35412 Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Disable support for building libapparmor.so and force static linking of libapparmor.a into apparmor_parser. Note that early in the 5.x series, apparmor userspace depends on libzstd for loading compressed profiles. Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Use 5.0 ABI when available. This may affect a few profiles so it's likely to be coupled with additional changes after the first round of testing. Jira: https://warthogs.atlassian.net/browse/SNAPDENG-35413 Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Extract duplicated internal apparmor parser fixture setup and assertions into shared test helpers. Rework TestAppArmorInternalAppArmorParserAbi3/4 to use helpers and add ABI 5 coverage with TestAppArmorInternalAppArmorParserAbi5. Reuse the helper in TestInternalParser and TestSetupConfCacheDirsWithInternalApparmor to remove duplicate fixture code. Rename helper to setupInternalAppArmorParserEnv for clearer scope. Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is extremely early work as we need to align some stars before we get to hit the bugs and fix them:
we need apparmor 5.0.0 alpha 2 for upstream af_unix featureswe need to actively use abi 5 across our profilesthere's no abi 5.0 file in the release we are using so that part of the code is dormantThen we get to test and see what breaks.
For apparmor master with 5 abi please see: #16780
For apparmor 5.x with 5 ABI please see: #15967
For apparmor 5.x with 4 ABI please see: #16781