| RingtailedFox | how do i compile snapd for a distro that doesn't have snap support? | 01:11 |
|---|---|---|
| === mup_ is now known as mup | ||
| mup | PR snapd#9538 closed: o/snapstate/catalogrefresh.go: don't refresh catalog in install mode uc20 <Simple 😃> <UC20> <Created by anonymouse64> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/9538> | 06:32 |
| === zyga_ is now known as zyga | ||
| zyga | jamesh, o/ | 06:56 |
| zyga | thank you for the review | 06:56 |
| zyga | amurray, jamesh: I would like to understand the status of .ICE-unix directory in the x11 interface | 06:56 |
| zyga | currently the ICE sockets are a part of the interface | 06:57 |
| zyga | should we change that? | 06:57 |
| jamesh | zyga: I would be in favour of removing them entirely | 06:58 |
| zyga | if amurray agrees we should just do it | 07:02 |
| zyga | I added ICE directory after your message on mattermost the other day | 07:02 |
| jamesh | My message there was more about reasons why we might _not_ want to include it | 07:03 |
| mborzecki | morning | 07:03 |
| zyga | :D | 07:03 |
| zyga | my mistake then | 07:03 |
| mborzecki | zyga: hey | 07:03 |
| zyga | hey mborzecki | 07:03 |
| mborzecki | zyga: heh, one kid at school, the other at home :/ | 07:04 |
| jamesh | zyga: see the "*Command" properties a client can set in https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html#Predefined_Properties | 07:04 |
| jamesh | in the default configuration, gnome-session does not try to save and restore sessions. That limits the potential damage | 07:05 |
| mvo | good morning mborzecki and zyga and jamesh | 07:06 |
| zyga | good morning mvo | 07:06 |
| zyga | jamesh, some of the messages have funny names | 07:07 |
| mborzecki | mvo: jamesh: hey | 07:07 |
| jamesh | hi mvo, mborzecki | 07:07 |
| jamesh | zyga: in short: when the session manager asks the app to "save yourself" before the session ends, the app should save its state somewhere and set an argv to restart the app with that state, and an argv to discard the state. | 07:09 |
| * zyga is sleepy | 07:17 | |
| zyga | I'll make one more coffee, check on the kids e-school and remove ICE-unix from the patch | 07:21 |
| amurray | zyga jamesh: I am in favour of ensuring that all interfaces follow the principle of least-privilege and hence present the minimum attack surface possible - so if /tmp/.ICE-unix is not generally necessary then I say it should not be included until a compelling use-case exists for it | 07:23 |
| amurray | I am not super familiar with why it exists in the first place but am currently trying to become more familiar with it so I can make a more informed comment but for now I would remove it | 07:23 |
| zyga | re | 07:47 |
| zyga | amurray, it's because we include the X abstraction | 07:47 |
| zyga | and it was simply there | 07:47 |
| amurray | zyga: I expect we include the X abstraction for convenience - and since we currently don't expose the host /tmp/.ICE-unix to the snap it isn't a problem - but if now we bind in the real one then we are providing more APIs to the snaps than was previously available when all we exposed was the abstract socket | 07:50 |
| zyga | amurray, isn't ICE also available over an abstract socket? | 07:58 |
| * zyga checks | 07:58 | |
| zyga | fortunately there is also the ICE authority file | 07:58 |
| zyga | u_str ESTAB 0 0 @/tmp/.ICE-unix/3052 72631 * 56991 | 07:59 |
| zyga | it seems we also have the abstract socket | 07:59 |
| amurray | hmmm that may be problematic... (out of interest where are you looking to see that?) | 08:00 |
| zyga | amurray, I used ss -x to see sockets | 08:01 |
| zyga | and I looked at /etc/apparmor.d/abstractions/X for the permissions | 08:02 |
| zyga | so we do seem to grant that | 08:02 |
| zyga | (feels like CVE) | 08:02 |
| zyga | we can ask the session to run whatever we want on "restore' | 08:02 |
| zyga | limited in scope as we seem to not support that part in practice anymore | 08:02 |
| amurray | yup.... well all it takes is a session manager to exist on the host which does support it... | 08:03 |
| zyga | yes | 08:03 |
| zyga | amurray, I can follow up with that | 08:04 |
| zyga | er | 08:04 |
| zyga | sorry | 08:04 |
| zyga | I was thinking about something | 08:04 |
| zyga | I can follow up with removal of ICE permissions | 08:04 |
| amurray | zyga: (you mean for this PR or for snapd in general with the abstract socket?) | 08:05 |
| zyga | in a separate PR, change x11 to deny ICE sockets | 08:05 |
| zyga | over abstract namespace | 08:05 |
| pstolowski | morning | 08:06 |
| amurray | zyga: thanks... I think we should do an LP bug for it as well and we can explore the security impact in that | 08:06 |
| zyga | amurray, I'll file one shortly | 08:06 |
| amurray | zyga: thanks | 08:07 |
| zyga | thank you guys! | 08:07 |
| mvo | pstolowski: good morning | 08:09 |
| mvo | pstolowski: 9522 has a conflict now | 08:09 |
| mvo | pstolowski: also one comment there from zyga that is probably worth exploring | 08:10 |
| pstolowski | mvo: ok, looking | 08:10 |
| mvo | pstolowski: thank you! | 08:11 |
| pstolowski | mvo: oh yes, the warnings, will do | 08:11 |
| mvo | pstolowski: just to clarify, not urgent, just noticing while going over the state-of-things :) | 08:11 |
| mvo | (and a nice improvement) | 08:11 |
| amurray | zyga: one quick question - it looks like this creates a new shared writable space for snaps to 'collaborate' (ie they could directly drop files at /tmp/.X11-unix) - could we instead make /tmp/X11-unix read-only and only give rw to /tmp/X11-unix/X[0-9]+ instead? | 08:15 |
| zyga | I've updated https://github.com/snapcore/snapd/pull/9530 | 08:16 |
| mup | PR #9530: interfaces: share /tmp/.X11-unix/ from host or provider <Needs security review> <âš Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/9530> | 08:16 |
| zyga | amurray, the bind mount is read only | 08:17 |
| zyga | so it can only be a one way comms space (server to client) | 08:17 |
| zyga | I think we can lock it down though, that's not a bad idea :) | 08:17 |
| zyga | hmm | 08:17 |
| zyga | actuall | 08:18 |
| zyga | actually* | 08:18 |
| zyga | this doesn't give any more permissions than before | 08:18 |
| amurray | oh I thought I saw rw, there - I am still planning to take a closer look but that will have to wait till tomorrow, it's getting to dinner time | 08:18 |
| zyga | the rw, perm is for snap-update-ns | 08:18 |
| zyga | not for snaps | 08:18 |
| amurray | ahh I see - we give it rw, perms but the actual mount is done ro - gotch | 08:19 |
| amurray | *gotcha | 08:19 |
| zyga | yeah, snap-update-ns needs to create the directory | 08:19 |
| zyga | but apps won't have any more permissions | 08:19 |
| zyga | amurray, jamesh: https://bugs.launchpad.net/snapd/+bug/1901489 | 08:27 |
| mborzecki | anyone seen this on master? https://paste.ubuntu.com/p/q4Z2hdkKhX/ | 08:31 |
| mvo | mborzecki: I have not, that's strange | 08:35 |
| zyga | huh? | 08:35 |
| zyga | what's the difference? | 08:35 |
| zyga | ah | 08:35 |
| zyga | one hour | 08:35 |
| zyga | mborzecki, I know | 08:36 |
| zyga | mborzecki, daylight saving time | 08:36 |
| zyga | :D | 08:36 |
| zyga | what else! | 08:36 |
| mborzecki | haha, so the test will fails for half a year? :P | 08:36 |
| zyga | yep | 08:36 |
| mborzecki | ehh | 08:36 |
| mvo | lol | 08:36 |
| mup | PR snapd#9542 opened: interfaces: deny connected x11 plugs access to ICE <Bug> <âš Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/9542> | 08:38 |
| zyga | mvo, https://github.com/snapcore/snapd/pull/9542 | 08:38 |
| mup | PR #9542: interfaces: deny connected x11 plugs access to ICE <Bug> <âš Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/9542> | 08:38 |
| mvo | zyga: just saw it | 08:42 |
| pedronis | what's the regresssion potential for that? | 08:42 |
| mborzecki | heh, so test mocks a snapshot with date one month in the past, ofc crossing daylight saving change | 08:44 |
| mborzecki | so in march we'll have 29d23h i guess | 08:45 |
| mvo | zyga: 9446 is in ! iirc you had some followups lined up, those are ready now | 08:46 |
| mup | PR snapd#9446 closed: overlord,usersession: initial notifications of pending refreshes <Created by zyga> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/9446> | 08:48 |
| mup | PR snapd#9531 closed: tests: add a unit test for UpdateMany where a single snap fails <Created by stolowski> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/9531> | 08:48 |
| * zyga-mbp changed hosts | 08:50 | |
| mup | PR snapd#9543 opened: cmd/snap: do not hardcode snapshot age value <Simple 😃> <Skip spread> <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/9543> | 08:58 |
| mborzecki | mvo: zyga: ^^ | 09:02 |
| mvo | mborzecki: \o/ | 09:04 |
| mborzecki | mvo: force pushed a little tweak that lists possible formatted values | 09:05 |
| pstolowski | mvo: updated | 09:07 |
| pstolowski | mvo: not sure if you saw it, but i posted the final conclusion re presseeding failure to the preseed channel | 09:08 |
| * mvo is in a meeting fwiw | 09:10 | |
| mvo | pstolowski: oh, nice! did not see that, will check after the meeting | 09:17 |
| mvo | pstolowski: final conclusion on pre-seeding failure was that there is no snapd deb in the chroot, is that right? | 09:51 |
| zyga | mborzecki, looking | 09:53 |
| zyga | mvo, thanks, I'll open the follow ups in a moment | 09:53 |
| zyga | mborzecki, fun stuff | 09:54 |
| zyga | +1 | 09:54 |
| zyga | amurray, jamesh: could you please review https://github.com/snapcore/snapd/pull/9542 | 09:54 |
| mup | PR #9542: interfaces: deny connected x11 plugs access to ICE <Bug> <âš Critical> <Created by zyga> <https://github.com/snapcore/snapd/pull/9542> | 09:54 |
| zyga | mvo, first follow-up: https://github.com/snapcore/snapd/pull/9544 | 09:56 |
| mup | PR #9544: overlord/snapstate: stop warning about inhibited refreshes <Simple 😃> <Created by zyga> <https://github.com/snapcore/snapd/pull/9544> | 09:56 |
| mvo | zyga: \o/ | 09:56 |
| zyga | I have the next one waiting to open as well, it does some of the things you asked for as well | 09:57 |
| pstolowski | mvo: yes | 09:58 |
| mup | PR snapd#9543 closed: cmd/snap: do not hardcode snapshot age value <Simple 😃> <Skip spread> <Created by bboozzoo> <Merged by bboozzoo> <https://github.com/snapcore/snapd/pull/9543> | 09:58 |
| mup | PR snapd#9544 opened: overlord/snapstate: stop warning about inhibited refreshes <Simple 😃> <Created by zyga> <https://github.com/snapcore/snapd/pull/9544> | 09:58 |
| mvo | pstolowski: ta | 09:59 |
| mup | PR snapd#9545 opened: devicestate: keep log from install-mode on installed system <Created by mvo5> <https://github.com/snapcore/snapd/pull/9545> | 10:03 |
| zyga | everyone: please follow edge and enable refresh app awareness! | 10:11 |
| jamesh | zyga: I left a comment: I think the chance of regression is practically zero, since it looks like XSMP access would have started breaking in Ubuntu 19.10 | 10:11 |
| zyga | jamesh, that's great news | 10:11 |
| zyga | jamesh, I suspect xfce may support this but I didn't check yet | 10:11 |
| zyga | jamesh, but for actual app regressions, I think we are safe | 10:11 |
| mup | PR snapcraft#3337 opened: cli,plugins: assume that core22 base wants v2 plugins <Created by xnox> <https://github.com/snapcore/snapcraft/pull/3337> | 10:27 |
| * mvo needs to run some errands, bbiab | 10:52 | |
| om26er | Is there a way to set TMPDIR for snapd during build time ? We are running snapd on Poky (yocto), on that system /var/log and /var/tmp are symlinks to a tmpfs mount point. | 11:01 |
| om26er | So I guess we need to configure point snapd to an alternate location ? | 11:02 |
| om26er | related topic https://forum.snapcraft.io/t/yocto-snaps-wont-start-after-compiling-snapd-with-strict-confinement/20728/2 | 11:02 |
| om26er | @zyga Hey! what are your thoughts on that ? | 11:03 |
| zyga | re | 11:03 |
| zyga | hmmm | 11:04 |
| zyga | build time changes are not great IMO | 11:04 |
| zyga | could we just teach snap-confine (because I assume that is where it matters) to handle this case? | 11:04 |
| zyga | I'm -1 on new build time change and +1 on a runtime detection | 11:05 |
| ogra | couldnt you just set en environment var in the systemd unit ? | 11:05 |
| ogra | or wont that trickle down to subsequent commands (i.e. snap-confine) | 11:05 |
| zyga | ogra, snap-confine re-sets some of that | 11:05 |
| ogra | ah, i feared that 🙂 | 11:05 |
| zyga | but for good reason | 11:06 |
| om26er | @zyga yeah, I guess that could help, should be able to cherry pick any patch that comes up | 11:06 |
| ogra | yeah | 11:06 |
| zyga | om26er, is /tmp a real directory? | 11:06 |
| om26er | yeah, /tmp is realy | 11:06 |
| zyga | one sec | 11:07 |
| zyga | let me finish something | 11:07 |
| zyga | then we can talk | 11:07 |
| om26er | OTH: getting snapd running with strict confinement wasn't really difficult, thanks to @ogra for pointing us to three kernel patches ;-) | 11:08 |
| om26er | @zyga, sure sounds good | 11:08 |
| ogra | 🙂 | 11:08 |
| zyga | pedronis, https://github.com/snapcore/snapd/pull/9546 | 11:10 |
| mup | PR #9546: overlord: add inert export manager <Created by zyga> <https://github.com/snapcore/snapd/pull/9546> | 11:10 |
| zyga | this adds an inert export manager | 11:10 |
| zyga | it's still close to 2200 lines but that's one reviewable chunk | 11:11 |
| zyga | om26er, let me read that thread | 11:11 |
| mup | PR snapd#9546 opened: overlord: add inert export manager <Created by zyga> <https://github.com/snapcore/snapd/pull/9546> | 11:13 |
| zyga | om26er, replied in the thread | 11:16 |
| * zyga posted https://forum.snapcraft.io/t/stepping-down-from-snapd-development/20754 | 11:21 | |
| zyga | ... value *errors.errorString = &errors.errorString{s:"cannot sign assertion: bad GPG produced signature: it does not verify: openpgp: invalid signature: RSA verification failure"} ("cannot sign assertion: bad GPG produced signature: it does not verify: openpgp: invalid signature: RSA verification failure") | 11:26 |
| zyga | hmmmm | 11:26 |
| zyga | I'd love to find out what is going on there | 11:26 |
| mborzecki | damn, snap-bootstrap test suite is a pita to work with | 11:39 |
| pedronis | zyga: it happens very rarely from time to time, nobody had time to dig | 11:48 |
| pedronis | so far | 11:48 |
| zyga | pedronis, yeah, I think the only hunch is that it happens in the azure hosted version of go | 11:49 |
| * zyga afk for small errand | 11:50 | |
| mup | PR snapcraft#3338 opened: Rename plugins keys <Created by xnox> <https://github.com/snapcore/snapcraft/pull/3338> | 11:52 |
| * pstolowski lunch | 12:07 | |
| mup | PR snapcraft#3335 closed: cli: remove spaces from progressive metrics <Created by sergiusens> <Merged by sergiusens> <https://github.com/snapcore/snapcraft/pull/3335> | 12:22 |
| cachio | zyga, hey | 12:47 |
| cachio | do you have the tumbleweed cloud images? | 12:47 |
| pstolowski | cachio: hey, do you have a moment for HO? | 13:02 |
| cachio | yes | 13:02 |
| cachio | pstolowski, in the standup one? | 13:03 |
| pstolowski | cachio: ok | 13:05 |
| ijohnson | man why does eu have to one-up the us and have their daylight savings time 1 week sooner | 13:08 |
| pedronis | pstolowski: hi, I also answered here: https://github.com/snapcore/snapd/pull/9535#discussion_r511951623 | 13:19 |
| mup | PR #9535: o/snapstate: generate snapd snap wrappers again after restart on refresh <Bug> <Needs Samuele review> <Created by stolowski> <https://github.com/snapcore/snapd/pull/9535> | 13:19 |
| pstolowski | pedronis: hi, thanks | 13:20 |
| ogra | ijohnson, if you country gives up its foot fetish for measuring distances and switches to celsius europe will switch to be in sync 😛 | 13:20 |
| zyga | cachio, re | 13:20 |
| zyga | cachio, yeah, let me find the link | 13:20 |
| cachio | zyga, tx | 13:21 |
| ijohnson | ogra: haha I would be on board with that switch :-) | 13:21 |
| zyga | ijohnson, that's it, we're moving to elbows | 13:23 |
| ijohnson | let's disappoint everybody and go back to measuring things based on individual hands, consistency be damned | 13:24 |
| zyga | cachio, try https://software.opensuse.org/distributions/tumbleweed and click on jeOS | 13:24 |
| zyga | cachio, then kvm and xen | 13:25 |
| cachio | zyga, got it, thanks | 13:27 |
| mborzecki | need to run an errand, left a note in the standup docs, bbl | 13:27 |
| pedronis | pstolowski: I reviewed #9535, looks good but left some suggestions | 13:35 |
| mup | PR #9535: o/snapstate: generate snapd snap wrappers again after restart on refresh <Bug> <Needs Samuele review> <Created by stolowski> <https://github.com/snapcore/snapd/pull/9535> | 13:35 |
| pstolowski | thanks | 13:35 |
| mup | PR snapd#9547 opened: Add `tmpfs-mount` interface <Created by fnordahl> <https://github.com/snapcore/snapd/pull/9547> | 14:24 |
| zyga | mvo, cachio: https://www.digitalocean.com/blog/easily-transfer-snapshots-between-accounts/ | 14:26 |
| zyga | we can just snapshot the machine and pass it over | 14:26 |
| zyga | that should be entirely effortless, just remove my ssh keys later | 14:26 |
| mvo | ta | 14:31 |
| zyga | onto those tests! | 14:39 |
| mup | PR snapcraft#3339 opened: tests: stub job to get autokpgtest for edge <Created by sergiusens> <https://github.com/snapcore/snapcraft/pull/3339> | 14:48 |
| mup | PR snapd#9544 closed: overlord/snapstate: stop warning about inhibited refreshes <Simple 😃> <Created by zyga> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/9544> | 14:49 |
| mup | PR snapd#9548 opened: overlord/snapstate: refactor ihibitRefresh <Created by zyga> <https://github.com/snapcore/snapd/pull/9548> | 14:54 |
| mborzecki | re | 15:20 |
| ijohnson | mborzecki: could you join the uc20 status meeting quick ? | 15:22 |
| mborzecki | ijohnson: sure, joining | 15:22 |
| * cachio lunch | 15:23 | |
| mup | PR core20#92 opened: Make the version number date-based <Created by sil2100> <https://github.com/snapcore/core20/pull/92> | 16:02 |
| mup | PR snapd#9548 closed: overlord/snapstate: refactor ihibitRefresh <Created by zyga> <Merged by mvo5> <https://github.com/snapcore/snapd/pull/9548> | 16:30 |
| * zyga walk | 16:34 | |
| mup | Bug #1901575 opened: Option to disable compression on mounted snaps <Snappy:New> <https://launchpad.net/bugs/1901575> | 16:53 |
| mup | Bug #1901575 changed: Option to disable compression on mounted snaps <Snappy:New> <https://launchpad.net/bugs/1901575> | 17:02 |
| mup | Bug #1901575 opened: Option to disable compression on mounted snaps <Snappy:Triaged> <https://launchpad.net/bugs/1901575> | 17:05 |
| mborzecki | ijohnson: can you take a look at https://github.com/snapcore/snapd/pull/9528 ? | 17:36 |
| mup | PR #9528: cmd/snap-bootstrap: mount ubuntu-save during boot if present <Run nested> <UC20> <Created by bboozzoo> <https://github.com/snapcore/snapd/pull/9528> | 17:36 |
| ijohnson | mborzecki sure will take a look this afternoon | 17:41 |
| mborzecki | ijohnson: thanks! | 17:41 |
| mup | PR pc-amd64-gadget#51 closed: gadget: add ubuntu-save <question> <Created by bboozzoo> <Merged by xnox> <https://github.com/snapcore/pc-amd64-gadget/pull/51> | 18:23 |
| mup | PR core20#92 closed: Make the version number date-based <Created by sil2100> <Merged by xnox> <https://github.com/snapcore/core20/pull/92> | 19:17 |
| mup | PR snapd#9549 opened: many: update to secboot v1 (part 1) <UC20> <Created by cmatsuoka> <https://github.com/snapcore/snapd/pull/9549> | 20:06 |
| mup | PR snapd#9534 closed: many: update to secboot v1 <UC20> <Created by cmatsuoka> <Closed by cmatsuoka> <https://github.com/snapcore/snapd/pull/9534> | 20:11 |
| mup | PR snapd#9550 opened: osutil/disks/mockdisk: panic if same mountpoint shows up again with diff opts <Simple 😃> <Test Robustness> <Created by anonymouse64> <https://github.com/snapcore/snapd/pull/9550> | 20:31 |
| * cachio afk | 20:57 | |
| mup | PR snapcraft#3339 closed: tests: stub job to get autokpgtest for edge <Created by sergiusens> <Closed by sergiusens> <https://github.com/snapcore/snapcraft/pull/3339> | 22:34 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!