/srv/irclogs.ubuntu.com/2024/07/30/#snappy.txt

Guest53Hello Since snapd v2.63 my journalctl is flooded by SECCOMP violations I don't know how to avoid each syscall to kernel space adding an entry to journalctl. Any help would be appreciate14:45
amurrayGuest53: can you provide any more details? 14:47
Guest53Sure !15:01
Guest53here's what return snappy-debug15:01
Guest53``` = Seccomp =15:02
Guest53Time: Jul 30 15:00:4915:02
Guest53Log: auid=4294967295 uid=0 gid=0 ses=4294967295 pid=1310 comm="MapperNode" exe="myapp" sig=0 arch=c00000b7 64(write) compat=0 ip=0xffff8c4539bc code=0x7ffc000015:02
Guest53Syscall: write15:02
Guest53It looks like since 2.63 version of snapd plugs and interfaces of each of myapp trigger a syscall that is catched by kauditd daemon whereas in previous version it was not the case15:05
amurrayif this is related to snapd shouldn't myapp be named snap.myapp at least?15:07
Guest53I can't show the real path of myapp due to industrial property I can't share but you are right the pas start with /snap/path_to_my_app15:12
Guest53the app is mainly a ROS application15:13
amurrayah righto - can you share what interfaces the snap is using?15:17
Guest53sorry it took me times to obfuscate:15:29
Guest53Interface               Plug                                Slot                                 Notes15:30
Guest53can-bus                 can-utils:can-bus                     :can-bus                             manual15:30
Guest53can-bus                 myapp-core:can-bus                    :can-bus                             manual15:30
Guest53content[configuration]  myapp-XX:cfg                          myapp-core:cfg                         manual15:30
Guest53content[configuration]  myapp-YY:cfg                          myapp-core:cfg                         manual15:30
Guest53content[statics]        myapp-core:control-center             myapp-control:control   manual15:30
Guest53content[librairies]     myapp-core:lib                        myapp-AC:lib                 manual15:30
Guest53content[librairies]     myapp-core:lib                        myapp-AP:lib                    manual15:30
Guest53content[librairies]     myapp-core:lib                        myapp-platform:lib                     manual15:30
Guest53content[librairies]     myapp-core:lib                        myapp-RP:lib                manual15:30
Guest53content[librairies]     myapp-core:lib                        myapp-SI:lib                   manual15:30
Guest53content[librairies]     myapp-core:lib                        myapp-SP:lib            manual15:30
Guest53content[librairies]     myapp-core:lib                        myapp-WS:lib                  manual15:30
Guest53content[statics]        myapp-core:MC                 myapp-MH:myapp-MH              manual15:30
Guest53content[packages]       myapp-core:pkg                        myapp-AC:pkg                 manual15:30
Guest53content[packages]       myapp-core:pkg                        myapp-AP:pkg                    manual15:30
Guest53content[packages]       myapp-core:pkg                        myapp-PF:pkg                     manual15:30
Guest53content[packages]       myapp-core:pkg                        myapp-RP:pkg                manual15:30
Guest53network                 myapp-timesync:network                :network                             -15:30
Guest53network-bind            can-utils:network-bind              :network-bind                        -15:30
Guest53network-bind            myapp-core:network-bind               :network-bind                        -15:30
Guest53network-bind            myapp-PF:network-bind           :network-bind                        -15:30
Guest53network-bind            myapp-RP:network-bind      :network-bind                        -15:30
Guest53network-bind            myapp-SP:network-bind  :network-bind                        -15:30
Guest53network-bind            myapp-timesync:network-bind           :network-bind                        -15:30
Guest53shutdown                myapp-core:shutdown                   :shutdown                            manual15:30
Guest53snapd-control           myapp-core:snapd-control              :snapd-control                       manual15:30
Guest53system-files            myapp-core:netplan-setup              :system-files                        manual15:30
Guest53system-observe          myapp-core:system-observe            :system-observe                      manual15:30
Guest53system-observe          snappy-debug:system-observe         :system-observe                      -15:30
Guest53time-control            myapp-core:time-control               :time-control                        manual15:30
Guest53time-control            myapp-timesync:time-control           :time-control                        manual15:30
Guest53timeserver-control      myapp-core:timeserver-control         :timeserver-control                  manual15:30
Guest53timeserver-control      myapp-timesync:timeserver-control     :timeserver-control                  manual15:30
Guest53timezone-control        myapp-core:timezone-control           :timezone-control                    manual15:30
Guest53timezone-control        myapp-timesync:timezone-control       :timezone-control                    manual15:30
Guest53amurray do you think I should connect all "faulty" snap to connect to system-files?15:47
amurrayoh wow that is a lot - so I am still a bit baffled by this - in general the base seccomp profile for snapd allows the write syscall - https://github.com/canonical/snapd/blob/master/interfaces/seccomp/template.go#L59315:49
amurrayso this shouldn't be happening15:50
amurrayoh you're not here anymore...15:50

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!