Arch Linux User Repository

Package update notes

2.36

2.36 is the first release with AppArmor enabled by default on Arch.

If you do not have AppArmor enabled at boot there should be no functional changes visible.

If you wish to use snaps with Apparmor, first make sure that Apparmor is enabled during boot, see https://wiki.archlinux.org/index.php/AppArmor for details. After upgrading the package, you need to do the following steps:

• Reload the profiles: systemctl restart apparmor.service
• Restart snapd: systemctl restart snapd.service
• Load profiles for snaps: systemctl enable --now snapd.apparmor.service

2.62

Since 2.62 snapd generated additional files describing the sandbox. The snapd service needs to be restarted after the update for snaps to continue working (unless the system is rebooted after the update, in which case no additional steps are needed). To restart, run systemctl restart snapd.service

Error:

==> Starting build()...
*** Setting version to '2.48.2-1' from user.
# pkg-config --cflags  -- libseccomp libseccomp
pkg-config: exec: "pkg-config": executable file not found in $PATH
==> ERROR: A failure occurred in build().
    Aborting...

Solved by installing pkgconf. Please add pkgconf to makedepends.

New update from upstream with check sum:

# Maintainer: aimileus <me at aimileus dot nl>
# Maintainer: Maciej Borzecki <maciek.borzecki@gmail.com>
# Contributor: Timothy Redaelli <timothy.redaelli@gmail.com>
# Contributor: Zygmunt Krynicki <me at zygoon dot pl>

pkgname=snapd
pkgdesc="Service and tools for management of snap packages."
depends=('squashfs-tools' 'libseccomp' 'libsystemd' 'apparmor')
optdepends=('bash-completion: bash completion support'
            'xdg-desktop-portal: desktop integration')
pkgver=2.48.2
pkgrel=1
arch=('x86_64' 'i686' 'armv7h' 'aarch64')
url="https://github.com/snapcore/snapd"
license=('GPL3')
makedepends=('git' 'go' 'go-tools' 'libseccomp' 'libcap' 'systemd' 'xfsprogs' 'python-docutils' 'apparmor')
conflicts=('snap-confine')
options=('!strip' 'emptydirs')
install=snapd.install
source=("$pkgname-$pkgver.tar.xz::https://github.com/snapcore/${pkgname}/releases/download/${pkgver}/${pkgname}_${pkgver}.vendor.tar.xz")
sha256sums=('7d3b4772b35af699eebedc9ade5bade7b87be0cdb7a9dec7511d3c096e553a50')

_gourl=github.com/snapcore/snapd

prepare() {
  cd "$pkgname-$pkgver"

  export GOPATH="$srcdir/go"
  mkdir -p "$GOPATH"

  # Have snapd checkout appear in a place suitable for subsequent GOPATH. This
  # way we don't have to go get it again and it is exactly what the tag/hash
  # above describes.
  mkdir -p "$(dirname "$GOPATH/src/${_gourl}")"
  ln --no-target-directory -fs "$srcdir/$pkgname-$pkgver" "$GOPATH/src/${_gourl}"

  for name in "${source[@]}"; do
      if [[ "${name%.patch}" == "$name" ]]; then
          # not a patch
          continue
      fi
      msg2 "applying $name"
      patch -p1 -i "$srcdir/$name"
  done
}

build() {
  cd "$pkgname-$pkgver"
  export GOPATH="$srcdir/go"

  # GOFLAGS may be modified by CI tools
  # GOFLAGS are the go build flags for all binaries, GOFLAGS_SNAP are for snap
  # build only.
  GOFLAGS=""
  GOFLAGS_SNAP="-tags nomanagers"
  # snapd does not support modules yet, explicitly disable Go modules
  export GO111MODULE=off

  export CGO_ENABLED="1"
  export CGO_CFLAGS="${CFLAGS}"
  export CGO_CPPFLAGS="${CPPFLAGS}"
  export CGO_CXXFLAGS="${CXXFLAGS}"
  export CGO_LDFLAGS="${LDFLAGS}"

  ./mkversion.sh $pkgver-$pkgrel

  # because argument expansion with quoting in bash is hard, and -ldflags=-extldflags='-foo'
  # is not exactly the same as -ldflags "-extldflags '-foo'" use the array trick
  # to pass exactly what we want
  flags=(-buildmode=pie -ldflags "-s -linkmode external -extldflags '$LDFLAGS'" -trimpath)
  staticflags=(-buildmode=pie -ldflags "-s -linkmode external -extldflags '$LDFLAGS -static'" -trimpath)
  # Build/install snap and snapd
  go build "${flags[@]}" -o "$srcdir/go/bin/snap" $GOFLAGS_SNAP "${_gourl}/cmd/snap"
  go build "${flags[@]}" -o "$srcdir/go/bin/snapd" $GOFLAGS "${_gourl}/cmd/snapd"
  go build "${flags[@]}" -o "$srcdir/go/bin/snap-seccomp" $GOFLAGS "${_gourl}/cmd/snap-seccomp"
  go build "${flags[@]}" -o "$srcdir/go/bin/snap-failure" $GOFLAGS "${_gourl}/cmd/snap-failure"
  # build snap-exec and snap-update-ns completely static for base snaps
  go build "${staticflags[@]}" -o "$srcdir/go/bin/snap-update-ns" $GOFLAGS "${_gourl}/cmd/snap-update-ns"
  go build "${staticflags[@]}" -o "$srcdir/go/bin/snap-exec" $GOFLAGS "${_gourl}/cmd/snap-exec"
  go build "${staticflags[@]}" -o "$srcdir/go/bin/snapctl" $GOFLAGS "${_gourl}/cmd/snapctl"

  # Generate data files such as real systemd units, dbus service, environment
  # setup helpers out of the available templates
  make -C data \
       BINDIR=/bin \
       LIBEXECDIR=/usr/lib \
       SYSTEMDSYSTEMUNITDIR=/usr/lib/systemd/system \
       SNAP_MOUNT_DIR=/var/lib/snapd/snap \
       SNAPD_ENVIRONMENT_FILE=/etc/default/snapd

  cd cmd
  autoreconf -i -f
  ./configure \
    --prefix=/usr \
    --libexecdir=/usr/lib/snapd \
    --with-snap-mount-dir=/var/lib/snapd/snap \
    --enable-apparmor \
    --enable-nvidia-biarch \
    --enable-merged-usr
  make $MAKEFLAGS
}

check() {
    export GOPATH="$srcdir/go"
    cd "$srcdir/go/src/${_gourl}"

    # make sure the binaries that need to be built statically really are
    for binary in snap-exec snap-update-ns snapctl; do
        LC_ALL=C ldd "$srcdir/go/bin/$binary" 2>&1 | grep -q 'not a dynamic executable'
    done
}

package() {
  cd "$pkgname-$pkgver"
  export GOPATH="$srcdir/go"
  # snapd does not use modules, setting GO111MODULE=on in the environment breaks
  # the build
  unset GO111MODULE

  # Install bash completion
  install -Dm644 data/completion/bash/snap \
    "$pkgdir/usr/share/bash-completion/completions/snap"
  install -Dm644 data/completion/bash/complete.sh \
    "$pkgdir/usr/lib/snapd/complete.sh"
  install -Dm644 data/completion/bash/etelpmoc.sh \
    "$pkgdir/usr/lib/snapd/etelpmoc.sh"
  # Install zsh completion
  install -Dm644 data/completion/zsh/_snap \
    "$pkgdir/usr/share/zsh/site-functions/_snap"

  # Install systemd units, dbus services and a script for environment variables
  make -C data/ install \
     DBUSSERVICESDIR=/usr/share/dbus-1/services \
     BINDIR=/usr/bin \
     SYSTEMDSYSTEMUNITDIR=/usr/lib/systemd/system \
     SNAP_MOUNT_DIR=/var/lib/snapd/snap \
     DESTDIR="$pkgdir"
  # no tweaks for sudo are needed
  rm -rfv "$pkgdir/etc/sudoers.d"

  # Install polkit policy
  install -Dm644 data/polkit/io.snapcraft.snapd.policy \
    "$pkgdir/usr/share/polkit-1/actions/io.snapcraft.snapd.policy"

  # Install executables
  install -Dm755 "$srcdir/go/bin/snap" "$pkgdir/usr/bin/snap"
  install -Dm755 "$srcdir/go/bin/snapctl" "$pkgdir/usr/lib/snapd/snapctl"
  install -Dm755 "$srcdir/go/bin/snapd" "$pkgdir/usr/lib/snapd/snapd"
  install -Dm755 "$srcdir/go/bin/snap-seccomp" "$pkgdir/usr/lib/snapd/snap-seccomp"
  install -Dm755 "$srcdir/go/bin/snap-failure" "$pkgdir/usr/lib/snapd/snap-failure"
  install -Dm755 "$srcdir/go/bin/snap-update-ns" "$pkgdir/usr/lib/snapd/snap-update-ns"
  install -Dm755 "$srcdir/go/bin/snap-exec" "$pkgdir/usr/lib/snapd/snap-exec"
  # Ensure /usr/bin/snapctl is a symlink to /usr/libexec/snapd/snapctl
  ln -s /usr/lib/snapd/snapctl "$pkgdir/usr/bin/snapctl"

  # pre-create directories
  install -dm755 "$pkgdir/var/lib/snapd/snap"
  install -dm755 "$pkgdir/var/cache/snapd"
  install -dm755 "$pkgdir/var/lib/snapd/apparmor"
  install -dm755 "$pkgdir/var/lib/snapd/assertions"
  install -dm755 "$pkgdir/var/lib/snapd/dbus-1/services"
  install -dm755 "$pkgdir/var/lib/snapd/dbus-1/system-services"
  install -dm755 "$pkgdir/var/lib/snapd/desktop/applications"
  install -dm755 "$pkgdir/var/lib/snapd/device"
  install -dm755 "$pkgdir/var/lib/snapd/hostfs"
  install -dm755 "$pkgdir/var/lib/snapd/mount"
  install -dm755 "$pkgdir/var/lib/snapd/seccomp/bpf"
  install -dm755 "$pkgdir/var/lib/snapd/snap/bin"
  install -dm755 "$pkgdir/var/lib/snapd/snaps"
  install -dm755 "$pkgdir/var/lib/snapd/inhibit"
  install -dm755 "$pkgdir/var/lib/snapd/lib/gl"
  install -dm755 "$pkgdir/var/lib/snapd/lib/gl32"
  install -dm755 "$pkgdir/var/lib/snapd/lib/vulkan"
  install -dm755 "$pkgdir/var/lib/snapd/lib/glvnd"
  # these dirs have special permissions
  install -dm111 "$pkgdir/var/lib/snapd/void"
  install -dm700 "$pkgdir/var/lib/snapd/cookie"
  install -dm700 "$pkgdir/var/lib/snapd/cache"

  make -C cmd install DESTDIR="$pkgdir/"

  # Install man file
  mkdir -p "$pkgdir/usr/share/man/man8"
  "$srcdir/go/bin/snap" help --man > "$pkgdir/usr/share/man/man8/snap.8"

  # Install the "info" data file with snapd version
  install -m 644 -D "$srcdir/go/src/${_gourl}/data/info" \
          "$pkgdir/usr/lib/snapd/info"

  # Remove snappy core specific units
  rm -fv "$pkgdir/usr/lib/systemd/system/snapd.system-shutdown.service"
  rm -fv "$pkgdir/usr/lib/systemd/system/snapd.autoimport.service"
  rm -fv "$pkgdir/usr/lib/systemd/system/snapd.recovery-chooser-trigger.service"
  rm -fv "$pkgdir"/usr/lib/systemd/system/snapd.snap-repair.*
  rm -fv "$pkgdir"/usr/lib/systemd/system/snapd.core-fixup.*
  # and scripts
  rm -fv "$pkgdir/usr/lib/snapd/snapd.core-fixup.sh"
  rm -fv "$pkgdir/usr/bin/ubuntu-core-launcher"
  rm -fv "$pkgdir/usr/lib/snapd/system-shutdown"
}

@bboozzoo: Thank you. Maybe this issue will be more motivating. https://bugs.archlinux.org/task/68943

@dmp1ce thanks for checking. I see that they already closed a task because AUR was mentioned, that's very useful (as always).

If you care enough about Arch you could try filing a new bug, attaching the snippet I provided, include the version of apparmor, linux, linux-lts, and preferrably strace -vf ./a.out too. IMO it's most likely a bug in libapparmor. This is unrelated to snapd or AUR.

david@bar:/tmp/apparmor_test$ gcc a.c -lapparmor
david@bar:/tmp/apparmor_test$ ls
a.c  a.out
david@bar:/tmp/apparmor_test$ ./a.out 
aa_getcon: Invalid argument
1 david@bar:/tmp/apparmor_test$ uname -a
Linux bar 5.4.82-1-lts #1 SMP Tue, 08 Dec 2020 12:10:59 +0000 x86_64 GNU/Linux

$ ./a.out 
david@bar:/tmp/apparmor_test$ gcc a.c -lapparmor
david@bar:/tmp/apparmor_test$ ls
a.c  a.out
david@bar:/tmp/apparmor_test$ ./a.out 
label: unconfined
mode: (null)   
david@bar:/tmp/apparmor_test$ uname -a
Linux bar 5.9.13-arch1-1 #1 SMP PREEMPT Tue, 08 Dec 2020 12:09:55 +0000 x86_64 GNU/Linux

@dmp1ce sorry, I meant this gist: https://gist.github.com/bboozzoo/840cdbd066ab81ca438fab6b0b75ea1b build it with gcc a.c -lapparmor. Does it run?

I posted an issue but I have a feeling it will be rejected because of snapd being from the AUR. https://bugs.archlinux.org/task/68938

@bboozzoo: aa-status seems to work on LTS. The other command didn't find the file. I'll try the snippet, but the snippet you provided looks like my error output. Is it the right gist?

david@bar:~$ cat /proc/slef/attr/apparmor/current                                                                                                                                                                                             
cat: /proc/slef/attr/apparmor/current: No such file or directory                                                                                                                                                                              
1 david@bar:~$ sudo cat /proc/slef/attr/apparmor/current                                                                                                                                                                                      
[sudo] password for david:                                                                                                                                                                                                                    
cat: /proc/slef/attr/apparmor/current: No such file or directory

@dmp1ce so it may be a case when the new libapparmor does not handle old kernels too well. I would suggest you try to build the snippet I provided: https://gist.github.com/dmp1ce/8a321608fbcf4c3ea61fce134e1f0b0d and if that fails on the LTS kernel, you should most likely file a bug for the apparmor package.