Fedora Packages

snap-confine-2.71-0.el10_2 in Fedora EPEL 10.2

↵ Return to the main page of snap-confine
View build
Search for updates

Package Info (Data from x86_64 build)
🠗 Changelog
🠗 Provides
🠗 Files

Changelog

Date Author Change
2025-08-22 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.71 - FDE: auto-repair when recovery key is used - FDE: revoke keys on shim update - FDE: revoke old TPM keys when dbx has been updated - FDE: do not reseal FDE hook keys every time - FDE: store keys in the kernel keyring when installing from initrd - FDE: allow disabled DMA on Core - FDE: snap-bootstrap: do not check for partition in scan-disk on CVM - FDE: support secboot preinstall check for 25.10+ hybrid installs via the /v2/system/{label} endpoint - FDE: support generating recovery key at install time via the /v2/systems/{label} endpoint - FDE: update passphrase quality check at install time via the /v2/systems/{label} endpoint - FDE: support replacing recovery key at runtime via the new /v2/system-volumes endpoint - FDE: support checking recovery keys at runtime via the /v2/system- volumes endpoint - FDE: support enumerating keyslots at runtime via the /v2/system- volumes endpoint - FDE: support changing passphrase at runtime via the /v2/system- volumes endpoint - FDE: support passphrase quality check at runtime via the /v2/system-volumes endpoint - FDE: update secboot to revision 3e181c8edf0f - Confdb: support lists and indexed paths on read and write - Confdb: alias references must be wrapped in brackets - Confdb: support indexed paths in confdb-schema assertion - Confdb: make API errors consistent with options - Confdb: fetch confdb-schema assertion on access - Confdb: prevent --previous from being used in read-side hooks - Components: fix snap command with multiple components - Components: set revision of seed components to x1 - Components: unmount extra kernel-modules components mounts - AppArmor Prompting: add lifespan "session" for prompting rules - AppArmor Prompting: support restoring prompts after snapd restart - AppArmor Prompting: limit the extra information included in probed AppArmor features and system key - Notices: refactor notice state internals - SELinux: look for restorecon/matchpathcon at all known locations rather than current PATH - SELinux: update policy to allow watching cgroups (for RAA), and talking to user session agents (service mgmt/refresh) - Refresh App Awareness: Fix unexpected inotify file descriptor cleanup - snap-confine: workaround for glibc fchmodat() fallback and handle ENOSYS - snap-confine: add support for host policy for limiting users able to run snaps - LP: #2114923 Reject system key mismatch advise when not yet seeded - Use separate lanes for essential and non-essential snaps during seeding and allow non-essential installs to retry - Fix bug preventing remodel from core18 to core18 when snapd snap is unchanged - LP: #2112551 Make removal of last active revision of a snap equal to snap remove - LP: #2114779 Allow non-gpt in fallback mode to support RPi - Switch from using systemd LogNamespace to manually controlled journal quotas - Change snap command trace logging to only log the command names - Grant desktop-launch access to /v2/snaps - Update code for creating the snap journal stream - Switch from using core to snapd snap for snap debug connectivity - LP: #2112544 Fix offline remodel case where we switched to a channel without an actual refresh - LP: #2112332 Exclude snap/snapd/preseeding when generating preseed tarball - LP: #1952500 Fix snap command progress reporting - LP: #1849346 Interfaces: kerberos-tickets | add new interface - Interfaces: u2f | add support for Thetis Pro - Interfaces: u2f | add OneSpan device and fix older device - Interfaces: pipewire, audio-playback | support pipewire as system daemon - Interfaces: gpg-keys | allow access to GPG agent sockets - Interfaces: usb-gadget | add new interface - Interfaces: snap-fde-control, firmware-updater-support | add new interfaces to support FDE - Interfaces: timezone-control | extend to support timedatectl varlink - Interfaces: cpu-control | fix rules for accessing IRQ sysfs and procfs directories - Interfaces: microstack-support | allow SR-IOV attachments - Interfaces: modify AppArmor template to allow snaps to read their own systemd credentials - Interfaces: posix-mq | allow stat on /dev/mqueue - LP: #2098780 Interfaces: log-observe | add capability dac_read_search - Interfaces: block-devices | allow access to ZFS pools and datasets - LP: #2033883 Interfaces: block-devices | opt-in access to individual partitions - Interfaces: accel | add new interface to support accel kernel subsystem - Interfaces: shutdown | allow client to bind on its side of dbus socket - Interfaces: modify seccomp template to allow pwritev2 - Interfaces: modify AppArmor template to allow reading /proc/sys/fs/nr_open - Packaging: drop snap.failure service for openSUSE - Packaging: add SELinux support for openSUSE - Packaging: disable optee when using nooptee build tag - Packaging: add support for static PIE builds in snapd.mk, drop pie.patch from openSUSE - Packaging: add libcap2-bin runtime dependency for ubuntu-16.04 - Packaging: use snapd.mk for packaging on Fedora - Packaging: exclude .git directory - Packaging: fix DPKG_PARSECHANGELOG assignment - Packaging: fix building on Fedora with dpkg installed
2025-08-15 Maxwell G <maxwell at gtmx dot me> - 2.70-3 - Rebuild for golang-1.25.0
2025-07-25 Fedora Release Engineering <releng at fedoraproject dot org> - 2.70-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
2025-06-03 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.70 - FDE: Fix reseal with v1 hook key format - FDE: set role in TPM keys - AppArmor prompting (experimental): add handling for expired requests or listener in the kernel - AppArmor prompting: log the notification protocol version negotiated with the kernel - AppArmor prompting: implement notification protocol v5 (manually disabled for now) - AppArmor prompting: register listener ID with the kernel and resend notifications after snapd restart (requires protocol v5+) - AppArmor prompting: select interface from metadata tags and set request interface accordingly (requires protocol v5+) - AppArmor prompting: include request PID in prompt - AppArmor prompting: move the max prompt ID file to a subdirectory of the snap run directory - AppArmor prompting: avoid race between closing/reading socket fd - Confdb (experimental): make save/load hooks mandatory if affecting ephemeral - Confdb: clear tx state on failed load - Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g. confdb-schema) - Confdb: add NestedEphemeral to confdb schemas - Confdb: add early concurrency checks - Simplify building Arch package - Enable snapd.apparmor on Fedora - Build snapd snap with libselinux - Emit snapd.apparmor warning only when using apparmor backend - When running snap, on system key mismatch e.g. due to network attached HOME, trigger and wait for a security profiles regeneration - Avoid requiring state lock to get user, warnings, or pending restarts when handling API requests - Start/stop ssh.socket for core24+ when enabling/disabling the ssh service - Allow providing a different base when overriding snap - Modify snap-bootstrap to mount snapd snap directly to /snap - Modify snap-bootstrap to mount /lib/{modules,firmware} from snap as fallback - Modify core-initrd to use systemctl reboot instead of /sbin/reboot - Copy the initramfs 'manifest-initramfs.yaml' to initramfs file creation directory so it can be copied to the kernel snap - Build the early initrd from installed ucode packages - Create drivers tree when remodeling from UC20/22 to UC24 - Load gpio-aggregator module before the helper-service needs it - Run 'systemctl start' for mount units to ensure they are run also when unchanged - Update godbus version to 'v5 v5.1.0' - Add support for POST to /v2/system-info with system-key-mismatch indication from the client - Add 'snap sign --update-timestamp' flag to update timestamp before signing - Add vfs support for snap-update-ns to use to simulate and evaluate mount sequences - Add refresh app awareness debug logging - Add snap-bootstrap scan-disk subcommand to be called from udev - Add feature to inject proxy store assertions in build image - Add OP-TEE bindings, enable by default in ARM and ARM64 builds - Fix systemd dependency options target to go under 'unit' section - Fix snap-bootstrap reading kernel snap instead of base resulting in bad modeenv - Fix a regression during seeding when using early-config - LP: #2107443 reset SHELL to /bin/bash in non-classic snaps - Make Azure kernels reboot upon panic - Fix snap-confine to not drop capabilities if the original user is already root - Fix data race when stopping services - Fix task dependency issue by temporarily disable re-refresh on prerequisite updates - Fix compiling against op-tee on armhf - Fix dbx update when not using FDE - Fix potential validation set deadlock due to bases waiting on snaps - LP: #2104066 Only cancel notices requests on stop/shutdown - Interfaces: bool-file | fix gpio glob pattern as required for '[XXXX]*' format - Interfaces: system-packages-doc | allow access to /usr/local/share/doc - Interfaces: ros-snapd-support interface | added new interface - Interfaces: udisks2 | allow chown capability - Interfaces: system-observe | allow reading cpu.max - Interfaces: serial-port | add ttyMAXX to allowed list - Interfaces: modified seccomp template to disallow 'O_NOTIFICATION_PIPE' - Interfaces: fwupd | add support for modem-manager plugin - Interfaces: gpio-chardev | make unsupported and remove experimental flag to hide this feature until gpio-aggregator is available - Interfaces: hardware-random | fix udev match rule - Interfaces: timeserver-control | extend to allow timedatectl timesync commands - Interfaces: add symlinks backend - Interfaces: system key mismatch handling
2025-04-08 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.69 - FDE: re-factor listing of the disks based on run mode model and model to correctly resolve paths - FDE: run snapd from snap-failure with the correct keyring mode - Snap components: allow remodeling back to an old snap revision that includes components - Snap components: fix remodel to a kernel snap that is already installed on the system, but not the current kernel due to a previous remodel. - Snap components: fix for snapctl inputs that can crash snapd - Confdb (experimental): load ephemeral data when reading data via snapctl get - Confdb (experimental): load ephemeral data when reading data via snap get - Confdb (experimental): rename {plug}-view-changed hook to observe- view-{plug} - Confdb (experimental): rename confdb assertion to confdb-schema - Confdb (experimental): change operator grouping in confdb-control assertion - Confdb (experimental): add confdb-control API - AppArmor: extend the probed features to include the presence of files, as well as directories - AppArmor prompting (experimental): simplify the listener - AppArmor metadata tagging (disabled): probe parser support for tags - AppArmor metadata tagging (disabled): implement notification protocol v5 - Confidential VMs: sysroot.mount is now dynamically created by snap-bootstrap instead of being a static file in the initramfs - Confidential VMs: Add new implementation of snap integrity API - Non-suid snap-confine: first phase to replace snap-confine suid with capabilities to achieve the required permissions - Initial changes for dynamic security profiles updates - Provide snap icon fallback for /v2/icons without requiring network access at runtime - Add eMMC gadget update support - Support reexec when using /usr/libexec/snapd on the host (Arch Linux, openSUSE) - Auto detect snap mount dir location on unknown distributions - Modify snap-confine AppArmor template to allow all glibc HWCAPS subdirectories to prevent launch errors - LP: #2102456 update secboot to bf2f40ea35c4 and modify snap- bootstrap to remove usage of go templates to reduce size by 4MB - Fix snap-bootstrap to mount kernel snap from /sysroot/writable/system-data - LP: #2106121 fix snap-bootstrap busy loop - Fix encoding of time.Time by using omitzero instead of omitempty (on go 1.24+) - Fix setting snapd permissions through permctl for openSUSE - Fix snap struct json tags typo - Fix snap pack configure hook permissions check incorrect file mode - Fix gadget snap reinstall to honor existing sizes of partitions - Fix to update command line when re-executing a snapd tool - Fix 'snap validate' of specific missing newline and add error on missed case of 'snap validate --refresh' without another action - Workaround for snapd-confine time_t size differences between architectures - Disallow pack and install of snapd, base and os with specific configure hooks - Drop udev build dependency that is no longer required and add missing systemd-dev dependency - Build snap-bootstrap with nomanagers tag to decrease size by 1MB - Interfaces: polkit | support custom polkit rules - Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is confined by AppArmor - Interfaces: log-observe | add missing udev rule - Interfaces: hostname-control | fix call to hostnamectl in core24 - Interfaces: network-control | allow removing created network namespaces - Interfaces: scsi-generic | re-enable base declaration for scsi- generic plug - Interfaces: u2f | add support for Arculus AuthentiKey
2025-04-02 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.4 - Snap components: LP: #2104933 workaround for classic 24.04/24.10 models that incorrectly specify core22 instead of core24 - Update build dependencies
2025-03-10 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.3 - FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to old keyring path - Fix Plucky snapd deb build issue related to /var/lib/snapd/void permissions - Fix snapd deb build complaint about ifneq with extra bracket
2025-02-27 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.2 - FDE: use boot mode for FDE hooks - FDE: add snap-bootstrap compatibility check to prevent image creation with incompatible snapd and kernel snap - FDE: add argon2 out-of-process KDF support - FDE: have separate mutex for the sections writing a fresh modeenv - FDE: LP: #2099709 update secboot to e07f4ae48e98 - Confdb: support pruning ephemeral data and process alternative types in order - core-initrd: look at env to mount directly to /sysroot - core-initrd: prepare for Plucky build and split out 24.10 (Oracular) - Fix missing primed packages in snapd snap manifest - Interfaces: posix-mq | fix incorrect clobbering of global variable and make interface more precise - Interfaces: opengl | add more kernel fusion driver files
2025-02-24 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68.1 - Fix snap-confine type specifier type mismatch on armhf
2025-02-13 Ernest Lotter <ernest dot lotter at canonical dot com> - New upstream release 2.68 - FDE: add support for new and more extensible key format that is unified between TPM and FDE hook - FDE: add support for adding passphrases during installation - FDE: update secboot to 30317622bbbc - Snap components: make kernel components available on firstboot after either initramfs or ephemeral rootfs style install - Snap components: mount drivers tree from initramfs so kernel modules are available in early boot stages - Snap components: support remodeling to models that contain components - Snap components: support offline remodeling to models that contain components - Snap components: support creating new recovery systems with components - Snap components: support downloading components with 'snap download' command - Snap components: support sideloading asserted components - AppArmor Prompting(experimental): improve version checks and handling of listener notification protocol for communication with kernel AppArmor - AppArmor Prompting(experimental): make prompt replies idempotent, and have at most one rule for any given path pattern, with potentially mixed outcomes and lifespans - AppArmor Prompting(experimental): timeout unresolved prompts after a period of client inactivity - AppArmor Prompting(experimental): return an error if a patch request to the API would result in a rule without any permissions - AppArmor Prompting(experimental): warn if there is no prompting client present but prompting is enabled, or if a prompting-related error occurs during snapd startup - AppArmor Prompting(experimental): do not log error when converting empty permissions to AppArmor permissions - Confdb(experimental): rename registries to confdbs (including API /v2/registries => /v2/confdb) - Confdb(experimental): support marking confdb schemas as ephemeral - Confdb(experimental): add confdb-control assertion and feature flag - Refresh App Awareness(experimental): LP: #2089195 prevent possibility of incorrect notification that snap will quit and update - Confidential VMs: snap-bootstrap support for loading partition information from a manifest file for cloudimg-rootfs mode - Confidential VMs: snap-bootstrap support for setting up cloudimg- rootfs as an overlayfs with integrity protection - dm-verity for essential snaps: add support for snap-integrity assertion - Interfaces: modify AppArmor template to allow owner read on @{PROC}/@{pid}/fdinfo/* - Interfaces: LP: #2072987 modify AppArmor template to allow using setpriv to run daemon as non-root user - Interfaces: add configfiles backend that ensures the state of configuration files in the filesystem - Interfaces: add ldconfig backend that exposes libraries coming from snaps to either the rootfs or to other snaps - Interfaces: LP: #1712808 LP: 1865503 disable udev backend when inside a container - Interfaces: add auditd-support interface that grants audit_control capability and required paths for auditd to function - Interfaces: add checkbox-support interface that allows unrestricted access to all devices - Interfaces: fwupd | allow access to dell bios recovery - Interfaces: fwupd | allow access to shim and fallback shim - Interfaces: mount-control | add mount option validator to detect mount option conflicts early - Interfaces: cpu-control | add read access to /sys/kernel/irq/ - Interfaces: locale-control | changed to be implicit on Ubuntu Core Desktop - Interfaces: microstack-support | support for utilizing of AMD SEV capabilities - Interfaces: u2f | added missing OneSpan device product IDs - Interfaces: auditd-support | grant seccomp setpriority - Interfaces: opengl interface | enable parsing of nvidia driver information files - Allow mksquashfs 'xattrs' when packing snap types os, core, base and snapd as part of work to support non-root snap-confine - Upstream/downstream packaging changes and build updates - Improve error logs for malformed desktop files to also show which desktop file is at fault - Provide more precise error message when overriding channels with grade during seed creation - Expose 'snap prepare-image' validation parameter - Add snap-seccomp 'dump' command that dumps the filter rules from a compiled profile - Add fallback release info location /etc/initrd-release - Added core-initrd to snapd repo and fixed issues with ubuntu-core- initramfs deb builds - Remove stale robust-mount-namespace-updates experimental feature flag - Remove snapd-snap experimental feature (rejected) and it's feature flag - Changed snap-bootstrap to mount base directly on /sysroot - Mount ubuntu-seed mounted as no-{suid,exec,dev} - Mapping volumes to disks: add support for volume-assignments in gadget - Fix silently broken binaries produced by distro patchelf 0.14.3 by using locally build patchelf 0.18 - Fix mismatch between listed refresh candidates and actual refresh due to outdated validation sets - Fix 'snap get' to produce compact listing for tty - Fix missing store-url by keeping it as part of auxiliary store info - Fix snap-confine attempting to retrieve device cgroup setup inside container where it is not available - Fix 'snap set' and 'snap get' panic on empty strings with early error checking - Fix logger debug entries to show correct caller and file information - Fix issue preventing hybrid systems from being seeded on first boot - LP: #1966203 remove auto-import udev rules not required by deb package to avoid unwanted syslog errors - LP: #1886414 fix progress reporting when stdout is on a tty, but stdin is not

Provides

  • snap-confine
  • snap-confine(x86-64)

Files


Sources on Pagure