| mup | PR snapcraft#2954 closed: cli: enable config file for base snapcraft command <Created by cjp256> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/2954> | 06:08 |
|---|---|---|
| mup | PR snapcraft#2957 closed: go plugin: do not remove install /bin directory before build <Created by cjp256> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/2957> | 08:02 |
| zyga | jdstrand: EHLO | 10:38 |
| zyga | jdstrand: I have an idea to run by you | 10:38 |
| zyga | jdstrand: we discovered that some containers do not run udev (they have it installed but udevd is down) | 10:38 |
| zyga | jdstrand: this breaks interface setup | 10:39 |
| zyga | jdstrand: I patched it to skip the entire udev backend | 10:39 |
| zyga | jdstrand: and got feedback to write the files but not invoke udev as a safer way | 10:39 |
| zyga | jdstrand: now the question: | 10:39 |
| zyga | jdstrand: should we do that for all the backends, specifically apparmor | 10:39 |
| zyga | jdstrand: write the profiles and not load them | 10:39 |
| zyga | jdstrand: . | 10:39 |
| mup | PR snapd#8210 closed: wrappers: add mount unit dependency for snapd services on core devices <UC20> <Created by bboozzoo> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/8210> | 10:56 |
| ogra | hmm | 10:56 |
| ogra | ogra@localhost:~$ sudo ls -alh /root/snap/ | 10:56 |
| ogra | total 16K | 10:56 |
| ogra | drwxr-xr-x 4 root root 4.0K Mar 4 10:56 . | 10:56 |
| ogra | drwx------ 3 root root 4.0K Oct 3 12:09 .. | 10:56 |
| ogra | drwxr-xr-x 6 root root 4.0K Mar 2 08:39 mir-kiosk | 10:56 |
| ogra | drwxr-xr-x 4 root root 4.0K Oct 3 12:09 pc | 10:56 |
| ogra | why do i have a dir for the gadget in /root/snap ?? | 10:57 |
| zyga | ogra: because it runs as root and has HOME=/root/snap/$SNAP_NAME | 11:01 |
| ogra | zyga, "runs" ? | 11:02 |
| ogra | its a gadget :) | 11:02 |
| zyga | it must have a hook | 11:02 |
| ogra | or is that from some hook | 11:02 |
| ogra | ah | 11:02 |
| mup | PR snapd#8220 opened: interfaces/seccomp: allow passing an address to setgroups <Created by alfonsosanchezbeato> <https://github.com/snapcore/snapd/pull/8220> | 12:08 |
| mup | PR snapd#8216 closed: tests: add session-tool, a su / sudo replacement <Created by zyga> <Merged by zyga> <https://github.com/snapcore/snapd/pull/8216> | 12:42 |
| zyga | jdstrand: https://github.com/snapcore/snapd/pull/8220 is interesting | 12:46 |
| mup | PR #8220: interfaces/seccomp: allow passing an address to setgroups <Created by alfonsosanchezbeato> <https://github.com/snapcore/snapd/pull/8220> | 12:46 |
| zyga | jdstrand: https://github.com/snapcore/snapd/pull/8219 is a priority for 2.44 that came up during the sprint | 12:48 |
| mup | PR #8219: interfaces: use udev backend if udev socket exists <Security-High> <Created by zyga> <https://github.com/snapcore/snapd/pull/8219> | 12:48 |
| ogra | zyga, some cosmetics for you guys ... https://bugs.launchpad.net/ubuntu/+source/snapd/+bug/1866058 | 12:53 |
| mup | Bug #1866058: gadget hooks should not write to /root/snap by default <snapd (Ubuntu):New> <https://launchpad.net/bugs/1866058> | 12:53 |
| zyga | ogra: aha | 12:54 |
| zyga | ogra: hmmm | 12:54 |
| ogra | full of assumptions :) | 12:54 |
| ogra | if you think this is wrong, just close it though | 12:55 |
| zyga | ogra: I think it's interesting but I don't know what to do about HOME in such a case | 12:55 |
| zyga | ogra: I'll ask others for opinions | 12:55 |
| ogra | yeah ... it is purely cosmetic anyway | 12:55 |
| jdstrand | zyga: hey, ack. I'm going into a meeting but otoh not running the udev backend means the device cgroup isn't going to work right (too restrictive). disabling that results in degraded policy (some apparmor rules depend on the cgroup) which would mean PartialConfinement | 12:57 |
| zyga | jdstrand: I'll be in the call | 12:58 |
| jdstrand | not removing the cgroups should be 'ok' security-wise since it should just be too strict | 12:58 |
| zyga | jdstrand: note that without udev /deve is really not populated | 12:58 |
| jdstrand | but, I want to look at it more carefully and comment | 12:58 |
| zyga | jdstrand: sure | 12:58 |
| zyga | jdstrand: note that the PR has two approaches | 12:59 |
| zyga | jdstrand: prior approach removed udev backend | 12:59 |
| jdstrand | zyga: well, that is an assumption of container setup. what if this isn't a container and udev just happens to not be running, or a container in the same way | 12:59 |
| zyga | jdstrand: and we changed that to avoid interacting with the system-key | 12:59 |
| zyga | jdstrand: it's a container configured not to run udev (buildd) even if installed (we do install it as a snapd dependency) | 12:59 |
| zyga | jdstrand: we are ready with the call | 13:00 |
| jdstrand | zyga: but the code afaics isn't checking any of that | 13:00 |
| zyga | jdstrand: can you clarify what is not being checked? | 13:31 |
| jdstrand | zyga: well, so, I haven't read the PR closely, but the problem statement includes 'some containers don't have udev' but the PR will fire on 'any system that doesn't have udev' | 13:32 |
| jdstrand | zyga: we aren't limiting the solution to containers in other words. I am not saying we should, but that is what I meant by 'not being checked' | 13:33 |
| === ppd1990 is now known as ppd | ||
| === ppd is now known as ppd1990 | ||
| mborzecki | jamesh: commenting out the line that loads from local cache makes the fonts look ok, so mabe the cache format did change, just that now i'm skippinng my real $HOME/.cache/fontconfig ? | 13:46 |
| jamesh | mborzecki: But if your default font came from /usr/share/fonts, you'd have the same problem with caches in /var/cache/fontconfig | 13:47 |
| jamesh | it's not just the user's home dir | 13:47 |
| mborzecki | jamesh: i think i need to run the bisect again, with adding the xdg path to the ~/.fonts.conf | 13:58 |
| sil2100 | ogra: hey! So I merged the --disable-console-conf change - one thing worth remembering though is to adjust it for uc20 once it's a thing | 14:19 |
| sil2100 | So that it always does what it's intended to | 14:19 |
| ogra | yeah ... i havent tried UC20 at all yet but will roll an UC18 image to test and verify | 14:20 |
| sil2100 | ogra: it should land in edge soonish | 14:20 |
| ogra | and my team owes you $BEER .) | 14:20 |
| ogra | yeah | 14:20 |
| === ppd1990 is now known as ppd | ||
| zyga | jdstrand: I think this is fine, I only meant to say "we saw a system, namely a container, that didn't use udev" | 15:01 |
| jdstrand | zyga: I'm looking at it now | 15:06 |
| zyga | jdstrand: thank you | 15:15 |
| zyga | jdstrand: that's correct | 15:23 |
| zyga | ah | 15:23 |
| zyga | sorry, my backlog moved | 15:23 |
| zyga | I read your response from two hours ago | 15:23 |
| mup | PR snapcraft#2960 opened: specification: base plugin and plugins for core20 <Created by sergiusens> <https://github.com/snapcore/snapcraft/pull/2960> | 16:03 |
| mup | PR snapcraft#2927 closed: requirements: uprev lxml to 4.5.0 <Created by cjp256> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/2927> | 16:13 |
| mup | PR snapcraft#2942 closed: pluginhandler: do not search installdir or stagedir for dependencies <Created by cjp256> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/2942> | 16:16 |
| mborzecki | jamesh: so this is the commit that broke stuff: https://gitlab.freedesktop.org/fontconfig/fontconfig/commit/c4324f54ee16e648ba91f3e9c66af13ab3b1754c | 16:18 |
| mborzecki | jamesh: feels like we've been there already | 16:18 |
| mborzecki | jamesh: we were https://forum.snapcraft.io/t/snapped-app-not-loading-fonts-on-fedora-and-arch/12484/30 | 16:30 |
| jamesh | mborzecki: weirdly, the fontconfig inside the platform snap is from before all the UUID nonsense. I would have thought that change effectively reverted to the old behaviour | 16:31 |
| jamesh | mborzecki: thinking about it some more, the incompatibility is probably further back: it's just that the versions before that commit produce cache files the snap can't see | 16:32 |
| jdstrand | zyga: ok, I spent a lot of time on PR 8219 and I wasn't thinking about it correctly up above. please see my PR comments | 17:17 |
| mup | PR #8219: interfaces: use udev backend if udev socket exists <Security-High> <Created by zyga> <https://github.com/snapcore/snapd/pull/8219> | 17:17 |
| zyga | jdstrand: ack, thank you | 17:19 |
| cjp256 | does the snap search cache get updated intermittently? | 17:30 |
| cjp256 | i search `flutter-gallery` and get no hits, but it installs fine | 17:31 |
| mup | PR core20#26 opened: Disable emergency.target & debug-shell, unless kernel cmdline is dangerous <Created by xnox> <https://github.com/snapcore/core20/pull/26> | 20:32 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!