Skip to content

Commit

Permalink
snap-confine: Ensure lib64 biarch directory is respected
Browse files Browse the repository at this point in the history
This fixes a 2.28+ regression whereby snap-update-ns no longer works
due to the strict apparmor rules.

Signed-off-by: Ikey Doherty <ikey@solus-project.com>
  • Loading branch information
ikeydoherty committed Sep 27, 2017
1 parent 1d7d79c commit aad4f90
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions cmd/snap-confine/snap-confine.apparmor.in
Original file line number Diff line number Diff line change
Expand Up @@ -396,14 +396,14 @@
# from the distribution package. This is also the location used when using
# the core/base snap on all-snap systems. The variants here represent
# various locations of libexecdir across distributions.
/usr/lib{,exec}/snapd/snap-update-ns Cxr -> snap_update_ns,
/usr/lib{,exec,64}/snapd/snap-update-ns Cxr -> snap_update_ns,

# ...snap-confine is not, conceptually, re-executing and uses
# snap-update-ns from the distribution package but we are already inside
# the constructed mount namespace so we must traverse "hostfs". The
# variants here represent various locations of libexecdir across
# distributions.
/var/lib/snapd/hostfs/usr/lib{,exec}/snapd/snap-update-ns Cxr -> snap_update_ns,
/var/lib/snapd/hostfs/usr/lib{,exec,64}/snapd/snap-update-ns Cxr -> snap_update_ns,

# ..snap-confine is, conceptually, re-executing and uses snap-update-ns
# from the core snap. Note that the location of the core snap varies from
Expand Down

0 comments on commit aad4f90

Please sign in to comment.