Fedora Packages

snap-confine-2.70-1.el10_1 in Fedora EPEL 10.1

↵ Return to the main page of snap-confine
View build
Search for updates

Package Info (Data from x86_64 build)
🠗 Changelog
🠗 Provides
🠗 Files

Changelog

Date Author Change
2025-06-03 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.70 - FDE: Fix reseal with v1 hook key format - FDE: set role in TPM keys - AppArmor prompting (experimental): add handling for expired requests or listener in the kernel - AppArmor prompting: log the notification protocol version negotiated with the kernel - AppArmor prompting: implement notification protocol v5 (manually disabled for now) - AppArmor prompting: register listener ID with the kernel and resend notifications after snapd restart (requires protocol v5+) - AppArmor prompting: select interface from metadata tags and set request interface accordingly (requires protocol v5+) - AppArmor prompting: include request PID in prompt - AppArmor prompting: move the max prompt ID file to a subdirectory of the snap run directory - AppArmor prompting: avoid race between closing/reading socket fd - Confdb (experimental): make save/load hooks mandatory if affecting ephemeral - Confdb: clear tx state on failed load - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g. confdb-schema) - Confdb: add NestedEphemeral to confdb schemas - Confdb: add early concurrency checks - Simplify building Arch package - Enable snapd.apparmor on Fedora - Build snapd snap with libselinux - Emit snapd.apparmor warning only when using apparmor backend - When running snap, on system key mismatch e.g. due to network attached HOME, trigger and wait for a security profiles regeneration - Avoid requiring state lock to get user, warnings, or pending restarts when handling API requests - Start/stop ssh.socket for core24+ when enabling/disabling the ssh service - Allow providing a different base when overriding snap - Modify snap-bootstrap to mount snapd snap directly to /snap - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap as fallback - Modify core-initrd to use systemctl reboot instead of /sbin/reboot - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file creation directory so it can be copied to the kernel snap - Build the early initrd from installed ucode packages - Create drivers tree when remodeling from UC20/22 to UC24 - Load gpio-aggregator module before the helper-service needs it - Run 'systemctl start' for mount units to ensure they are run also when unchanged - Update godbus version to 'v5 v5.1.0' - Add support for POST to /v2/system-info with system-key-mismatch indication from the client - Add 'snap sign --update-timestamp' flag to update timestamp before signing - Add vfs support for snap-update-ns to use to simulate and evaluate mount sequences - Add refresh app awareness debug logging - Add snap-bootstrap scan-disk subcommand to be called from udev - Add feature to inject proxy store assertions in build image - Add OP-TEE bindings, enable by default in ARM and ARM64 builds - Fix systemd dependency options target to go under 'unit' section - Fix snap-bootstrap reading kernel snap instead of base resulting in bad modeenv - Fix a regression during seeding when using early-config - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps - Make Azure kernels reboot upon panic - Fix snap-confine to not drop capabilities if the original user is already root - Fix data race when stopping services - Fix task dependency issue by temporarily disable re-refresh on prerequisite updates - Fix compiling against op-tee on armhf - Fix dbx update when not using FDE - Fix potential validation set deadlock due to bases waiting on snaps - LP: #2104066 Only cancel notices requests on stop/shutdown - Interfaces: bool-file | fix gpio glob pattern as required for '[XXXX]*' format - Interfaces: system-packages-doc | allow access to /usr/local/share/doc - Interfaces: ros-snapd-support interface | added new interface - Interfaces: udisks2 | allow chown capability - Interfaces: system-observe | allow reading cpu.max - Interfaces: serial-port | add ttyMAXX to allowed list - Interfaces: modified seccomp template to disallow 'O_NOTIFICATION_PIPE' - Interfaces: fwupd | add support for modem-manager plugin - Interfaces: gpio-chardev | make unsupported and remove experimental flag to hide this feature until gpio-aggregator is available - Interfaces: hardware-random | fix udev match rule - Interfaces: timeserver-control | extend to allow timedatectl timesync commands - Interfaces: add symlinks backend - Interfaces: system key mismatch handling
2025-04-08 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.69 - FDE: re-factor listing of the disks based on run mode model and model to correctly resolve paths - FDE: run snapd from snap-failure with the correct keyring mode - Snap components: allow remodeling back to an old snap revision that includes components - Snap components: fix remodel to a kernel snap that is already installed on the system, but not the current kernel due to a previous remodel. - Snap components: fix for snapctl inputs that can crash snapd - Confdb (experimental): load ephemeral data when reading data via snapctl get - Confdb (experimental): load ephemeral data when reading data via snap get - Confdb (experimental): rename {plug}-view-changed hook to observe- view-{plug} - Confdb (experimental): rename confdb assertion to confdb-schema - Confdb (experimental): change operator grouping in confdb-control assertion - Confdb (experimental): add confdb-control API - AppArmor: extend the probed features to include the presence of files, as well as directories - AppArmor prompting (experimental): simplify the listener - AppArmor metadata tagging (disabled): probe parser support for tags - AppArmor metadata tagging (disabled): implement notification protocol v5 - Confidential VMs: sysroot.mount is now dynamically created by snap-bootstrap instead of being a static file in the initramfs - Confidential VMs: Add new implementation of snap integrity API - Non-suid snap-confine: first phase to replace snap-confine suid with capabilities to achieve the required permissions - Initial changes for dynamic security profiles updates - Provide snap icon fallback for /v2/icons without requiring network access at runtime - Add eMMC gadget update support - Support reexec when using /usr/libexec/snapd on the host (Arch Linux, openSUSE) - Auto detect snap mount dir location on unknown distributions - Modify snap-confine AppArmor template to allow all glibc HWCAPS subdirectories to prevent launch errors - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap- bootstrap to remove usage of go templates to reduce size by 4MB - Fix snap-bootstrap to mount kernel snap from /sysroot/writable/system-data - LP: #2106121 fix snap-bootstrap busy loop - Fix encoding of time.Time by using omitzero instead of omitempty (on go 1.24+) - Fix setting snapd permissions through permctl for openSUSE - Fix snap struct json tags typo - Fix snap pack configure hook permissions check incorrect file mode - Fix gadget snap reinstall to honor existing sizes of partitions - Fix to update command line when re-executing a snapd tool - Fix 'snap validate' of specific missing newline and add error on missed case of 'snap validate --refresh' without another action - Workaround for snapd-confine time_t size differences between architectures - Disallow pack and install of snapd, base and os with specific configure hooks - Drop udev build dependency that is no longer required and add missing systemd-dev dependency - Build snap-bootstrap with nomanagers tag to decrease size by 1MB - Interfaces: polkit | support custom polkit rules - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is confined by AppArmor - Interfaces: log-observe | add missing udev rule - Interfaces: hostname-control | fix call to hostnamectl in core24 - Interfaces: network-control | allow removing created network namespaces - Interfaces: scsi-generic | re-enable base declaration for scsi- generic plug - Interfaces: u2f | add support for Arculus AuthentiKey
2025-04-02 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.4 - Snap components: LP: #2104933 workaround for classic 24.04/24.10 models that incorrectly specify core22 instead of core24 - Update build dependencies
2025-03-10 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.3 - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to old keyring path - Fix Plucky snapd deb build issue related to /var/lib/snapd/void permissions - Fix snapd deb build complaint about ifneq with extra bracket
2025-02-27 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.2 - FDE: use boot mode for FDE hooks - FDE: add snap-bootstrap compatibility check to prevent image creation with incompatible snapd and kernel snap - FDE: add argon2 out-of-process KDF support - FDE: have separate mutex for the sections writing a fresh modeenv - FDE: LP: #2099709 update secboot to e07f4ae48e98 - Confdb: support pruning ephemeral data and process alternative types in order - core-initrd: look at env to mount directly to /sysroot - core-initrd: prepare for Plucky build and split out 24.10 (Oracular) - Fix missing primed packages in snapd snap manifest - Interfaces: posix-mq | fix incorrect clobbering of global variable and make interface more precise - Interfaces: opengl | add more kernel fusion driver files
2025-02-24 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.1 - Fix snap-confine type specifier type mismatch on armhf
2025-02-13 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68 - FDE: add support for new and more extensible key format that is unified between TPM and FDE hook - FDE: add support for adding passphrases during installation - FDE: update secboot to 30317622bbbc - Snap components: make kernel components available on firstboot after either initramfs or ephemeral rootfs style install - Snap components: mount drivers tree from initramfs so kernel modules are available in early boot stages - Snap components: support remodeling to models that contain components - Snap components: support offline remodeling to models that contain components - Snap components: support creating new recovery systems with components - Snap components: support downloading components with 'snap download' command - Snap components: support sideloading asserted components - AppArmor Prompting(experimental): improve version checks and handling of listener notification protocol for communication with kernel AppArmor - AppArmor Prompting(experimental): make prompt replies idempotent, and have at most one rule for any given path pattern, with potentially mixed outcomes and lifespans - AppArmor Prompting(experimental): timeout unresolved prompts after a period of client inactivity - AppArmor Prompting(experimental): return an error if a patch request to the API would result in a rule without any permissions - AppArmor Prompting(experimental): warn if there is no prompting client present but prompting is enabled, or if a prompting-related error occurs during snapd startup - AppArmor Prompting(experimental): do not log error when converting empty permissions to AppArmor permissions - Confdb(experimental): rename registries to confdbs (including API /v2/registries => /v2/confdb) - Confdb(experimental): support marking confdb schemas as ephemeral - Confdb(experimental): add confdb-control assertion and feature flag - Refresh App Awareness(experimental): LP: #2089195 prevent possibility of incorrect notification that snap will quit and update - Confidential VMs: snap-bootstrap support for loading partition information from a manifest file for cloudimg-rootfs mode - Confidential VMs: snap-bootstrap support for setting up cloudimg- rootfs as an overlayfs with integrity protection - dm-verity for essential snaps: add support for snap-integrity assertion - Interfaces: modify AppArmor template to allow owner read on @{PROC}/@{pid}/fdinfo/* - Interfaces: LP: #2072987 modify AppArmor template to allow using setpriv to run daemon as non-root user - Interfaces: add configfiles backend that ensures the state of configuration files in the filesystem - Interfaces: add ldconfig backend that exposes libraries coming from snaps to either the rootfs or to other snaps - Interfaces: LP: #1712808 LP: 1865503 disable udev backend when inside a container - Interfaces: add auditd-support interface that grants audit_control capability and required paths for auditd to function - Interfaces: add checkbox-support interface that allows unrestricted access to all devices - Interfaces: fwupd | allow access to dell bios recovery - Interfaces: fwupd | allow access to shim and fallback shim - Interfaces: mount-control | add mount option validator to detect mount option conflicts early - Interfaces: cpu-control | add read access to /sys/kernel/irq/ - Interfaces: locale-control | changed to be implicit on Ubuntu Core Desktop - Interfaces: microstack-support | support for utilizing of AMD SEV capabilities - Interfaces: u2f | added missing OneSpan device product IDs - Interfaces: auditd-support | grant seccomp setpriority - Interfaces: opengl interface | enable parsing of nvidia driver information files - Allow mksquashfs 'xattrs' when packing snap types os, core, base and snapd as part of work to support non-root snap-confine - Upstream/downstream packaging changes and build updates - Improve error logs for malformed desktop files to also show which desktop file is at fault - Provide more precise error message when overriding channels with grade during seed creation - Expose 'snap prepare-image' validation parameter - Add snap-seccomp 'dump' command that dumps the filter rules from a compiled profile - Add fallback release info location /etc/initrd-release - Added core-initrd to snapd repo and fixed issues with ubuntu-core- initramfs deb builds - Remove stale robust-mount-namespace-updates experimental feature flag - Remove snapd-snap experimental feature (rejected) and it's feature flag - Changed snap-bootstrap to mount base directly on /sysroot - Mount ubuntu-seed mounted as no-{suid,exec,dev} - Mapping volumes to disks: add support for volume-assignments in gadget - Fix silently broken binaries produced by distro patchelf 0.14.3 by using locally build patchelf 0.18 - Fix mismatch between listed refresh candidates and actual refresh due to outdated validation sets - Fix 'snap get' to produce compact listing for tty - Fix missing store-url by keeping it as part of auxiliary store info - Fix snap-confine attempting to retrieve device cgroup setup inside container where it is not available - Fix 'snap set' and 'snap get' panic on empty strings with early error checking - Fix logger debug entries to show correct caller and file information - Fix issue preventing hybrid systems from being seeded on first boot - LP: #1966203 remove auto-import udev rules not required by deb package to avoid unwanted syslog errors - LP: #1886414 fix progress reporting when stdout is on a tty, but stdin is not
2025-01-22 Zygmunt Krynicki <zygmunt dot krynicki at canonical dot com> - The changelog date and author have been modified to maintain linearity. - Drop 0001-data-selinux-remove-timedatex.patch - applied upstream. - New upstream release 2.67 - AppArmor prompting (experimental): allow overlapping rules - Registry view (experimental): Changes to registry data (from both users and snaps) can be validated and saved by custodian snaps - Registry view (experimental): Support 'snapctl get --pristine' to read the registry data excluding staged transaction changes - Registry view (experimental): Put registry commands behind experimental feature flag - Components: Make modules shipped/created by kernel-modules components available right after reboot - Components: Add tab completion for local component files - Components: Allow installing snaps and components from local files jointly on the CLI - Components: Allow 'snapctl model' command for gadget and kernel snaps - Components: Add 'snap components' command - Components: Bug fixes - eMMC gadget updates (WIP): add syntax support in gadget.yaml for eMMC schema - Support for ephemeral recovery mode on hybrid systems - Support for dm-verity options in snap-bootstrap - Support for overlayfs options and allow empty what argument for tmpfs - Enable ubuntu-image to determine the size of the disk image to create - Expose 'snap debug' commands 'validate-seed' and 'seeding' - Add debug API option to use dedicated snap socket /run/snapd- snap.socket - Hide experimental features that are no longer required (accepted/rejected) - Mount ubuntu-save partition with no{exec,dev,suid} at install, run and factory-reset - Improve memory controller support with cgroup v2 - Support ssh socket activation configurations (used by ubuntu 22.10+) - Fix generation of AppArmor profile with incorrect revision during multi snap refresh - Fix refresh app awareness related deadlock edge case - Fix not caching delta updated snap download - Fix passing non root uid, guid to initial tmpfs mount - Fix ignoring snaps in try mode when amending - Fix reloading of service activation units to avoid systemd errors - Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS updates PPA - Make killing of snap apps best effort to avoid possibility of malicious failure loop - Alleviate impact of auto-refresh failure loop with progressive delay - Dropped timedatex in selinux-policy to avoid runtime issue - Fix missing syscalls in seccomp profile - Modify AppArmor template to allow using SNAP_REEXEC on arch systems - Modify AppArmor template to allow using vim.tiny (available in base snaps) - Modify AppArmor template to add read-access to debian_version - Modify AppArmor template to allow owner to read @{PROC}/@{pid}/sessionid - {common,personal,system}-files interface: prohibit trailing @ in filepaths - {desktop,shutdown,system-observe,upower-observe} interface: improve for Ubuntu Core Desktop - custom-device interface: allow @ in custom-device filepaths - desktop interface: improve launch entry and systray integration with session - desktop-legacy interface: allow DBus access to com.canonical.dbusmenu - fwupd interface: allow access to nvmem for thunderbolt plugin - mpris interface: add plasmashell as label - mount-control interface: add support for nfs mounts - network-{control,manager} interface: add missing dbus link rules - network-manager-observe interface: add getDevices methods - opengl interface: add Kernel Fusion Driver access to opengl - screen-inhibit-control interface: improve screen inhibit control for use on core - udisks2 interface: allow ping of the UDisks2 service - u2f-devices interface: add Nitrokey Passkey
2025-01-19 Fedora Release Engineering <releng at fedoraproject dot org> - 2.66.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
2025-01-15 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.67.1 - Fix apparmor permissions to allow snaps access to kernel modules and firmware on UC24, which also fixes the kernel-modules-control interface on UC24 - AppArmor prompting (experimental): disallow /./ and /../ in path patterns - Fix 'snap run' getent based user lookup in case of bad PATH - Fix snapd using the incorrect AppArmor version during undo of an refresh for regenerating snap profiles - Add new syscalls to base templates - hardware-observe interface: allow riscv_hwprobe syscall - mount-observe interface: allow listmount and statmount syscalls

Provides

  • snap-confine
  • snap-confine(x86-64)

Files


Sources on Pagure