many: switch to apparmor master with 5 ABI (DO NOT MERGE)#16780
Open
zyga wants to merge 11 commits intocanonical:masterfrom
Open
many: switch to apparmor master with 5 ABI (DO NOT MERGE)#16780zyga wants to merge 11 commits intocanonical:masterfrom
zyga wants to merge 11 commits intocanonical:masterfrom
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the snapd snap build to track AppArmor userspace “master” and extends snapd’s internal AppArmor parser ABI selection to prefer ABI 5 when available, so the snapd test suite can be used to detect regressions against upstream AppArmor changes.
Changes:
- Prefer internal AppArmor parser ABI
5.0(fallback to4.0, then3.0) when selecting--policy-features. - Refactor internal-parser test setup and add coverage for ABI 5 selection.
- Update snapcraft recipe to build AppArmor from the upstream git
masterbranch and adjust the libapparmor/parser build flags accordingly.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| sandbox/apparmor/apparmor.go | Prefer ABI 5 policy features for the internal apparmor_parser when present. |
| sandbox/apparmor/apparmor_test.go | Deduplicate internal-parser test setup and add ABI 5 selection test. |
| cmd/configure.ac | Pin snapcraft build to a libapparmor 5.x pkg-config version for snap builds. |
| build-aux/snap/snapcraft.yaml | Switch AppArmor source to upstream git master and build the parser/library with static-linking-related flags. |
You can also share your feedback on Copilot code review. Take the survey.
Comment on lines
918
to
925
| @@ -923,9 +924,12 @@ func AppArmorParser() (cmd *exec.Cmd, internal bool, err error) { | |||
| // older apparmor, use that instead so that things | |||
| // don't generally fail. | |||
Comment on lines
+85
to
+89
| # Expect AppArmor 5 when building as a snap under snapcraft | ||
| AS_IF([test "x$SNAPCRAFT_PROJECT_NAME" = "xsnapd"], [ | ||
| PKG_CHECK_MODULES([APPARMOR4], [libapparmor = 4.1.7], [ | ||
| AC_DEFINE([HAVE_APPARMOR], [1], [Build with apparmor4 support])], [ | ||
| AC_MSG_ERROR([unable to find apparmor4 for snap build of snapd])])], [ | ||
| PKG_CHECK_MODULES([APPARMOR4], [libapparmor = 5.0.0~beta1], [ | ||
| AC_DEFINE([HAVE_APPARMOR], [1], [Build with apparmor 5 support])], [ | ||
| AC_MSG_ERROR([unable to find apparmor 5 for snap build of snapd])])], [ |
zyga
changed the title
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #16780 +/- ##
==========================================
+ Coverage 77.56% 77.62% +0.06%
==========================================
Files 1366 1356 -10
Lines 188489 188391 -98
Branches 2446 2446
==========================================
+ Hits 146199 146247 +48
+ Misses 33460 33325 -135
+ Partials 8830 8819 -11
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Mon Mar 23 09:46:02 UTC 2026 Failures:Executing:
Skipped tests from snapd-testing-skip
|
zyga
force-pushed
the
rfc/apparmor-master
branch
from
a0d77c4 to
da90c6f
Compare
Switch the copy of apparmor bundled with snapd snap to the new 5 alpha 2 release. This keeps the old ABI intact so our profiles should retain old semantics. Jira: https://warthogs.atlassian.net/browse/SNAPDENG-35412 Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Disable support for building libapparmor.so and force static linking of libapparmor.a into apparmor_parser. Note that early in the 5.x series, apparmor userspace depends on libzstd for loading compressed profiles. Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
zyga
force-pushed
the
rfc/apparmor-master
branch
2 times, most recently
from
0995d6c to
778cd8c
Compare
Use 5.0 ABI when available. This may affect a few profiles so it's likely to be coupled with additional changes after the first round of testing. Jira: https://warthogs.atlassian.net/browse/SNAPDENG-35413 Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Extract duplicated internal apparmor parser fixture setup and assertions into shared test helpers. Rework TestAppArmorInternalAppArmorParserAbi3/4 to use helpers and add ABI 5 coverage with TestAppArmorInternalAppArmorParserAbi5. Reuse the helper in TestInternalParser and TestSetupConfCacheDirsWithInternalApparmor to remove duplicate fixture code. Rename helper to setupInternalAppArmorParserEnv for clearer scope. Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
zyga
force-pushed
the
rfc/apparmor-master
branch
from
778cd8c to
3470daa
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a perpetual branch that we will rebase from time to time. It aims to check if apparmor master has any regressions as observed by the snapd test suite.
Failure does not immediately indicate a bug in apparmor. It may be a bug in the test suite on snapd as well.
Please never merge this :)
For apparmor master with 5 abi please see: #16780
For apparmor 5.x with 5 ABI please see: #15967
For apparmor 5.x with 4 ABI please see: #16781