
<zyga-suse> mvo: ok, I understand the issue now
<zyga-suse> mvo: not sure why it happens but here's what happens:
<zyga-suse> mvo: when we introduced snap-update-ns as the namespace initializer
<zyga-suse> mvo: we removed the ability to read / process.fstab files from snap-confine
<zyga-suse> mvo: after reverting we are running on the profile from the +next version
<zyga-suse> mvo: I think it looks like a bug in the code that re-builds snap-confine's apparmor profile
<zyga-suse> mvo: does that make sense?
<zyga-suse> mvo: after revert we should immediately rebuild the profile
<zyga-suse> mvo: what is curious here is that since the profile is *path based* it should not be a problem
<zyga-suse> the old profile is around
<zyga-suse> mvo: (around as in loaded in memory)
<mvo> zyga-suse: well, we reboot in between in tests on core
<mvo> zyga-suse: but yeah, it makes sense
<zyga-suse> hmmm
<mvo> zyga-suse: I mean, if its loaded in memory it will get lost accross the reboot
<zyga-suse> this should not be an issue on core
<zyga-suse> yes
<zyga-suse> well
<zyga-suse> no
<mvo> zyga-suse: the report is about core afaict
<zyga-suse> across reboot we'll keep the file in /etc/apparmor.d
<zyga-suse> so it will get re-loaded
<zyga-suse> was this on core on classic?
<mvo> zyga-suse: from what I read its a regular core device (caracalla/stlouis9
<mvo> )
<zyga-suse> right
 * zyga-suse thinks
<zyga-suse> it doesn't seem
< zyga - suse > mvo: ok, I understand the issue now 
 < zyga - suse > mvo: not sure why it happen but here's what happen: 
 < zyga - suse > mvo: when we introduced snap - update - ns as the namespace initializer 
 < zyga - suse > mvo: we removed the ability to learn / process.fstab files from snap - confine 
 < zyga - suse > mvo: after reverting we are run on the profile from the + next adaptation 
 < zyga - suse > mvo: I think it looks like a microbe in the code that re - builds snapshot - confine's apparmor visibility 
 < zyga - suse > mvo: does that make sense? 
 < zyga - suse > mvo: after revert we should immediately rebuild the visibility 
 < zyga - suse > mvo: what is curious here is that since the profile is * way establish * it should not be a problem 
 < zyga - suse > the old profile is around 
 < zyga - suse > mvo: (about as in loaded in memory) 
 < mvo > zyga - suse: well, we reboot in between in tests on core 
 < mvo > zyga - suse: but yeah, it construct sense 
 < zyga - suse > hmmm 
 < mvo > zyga - suse: I mean, if its loaded in memory it will get lost accross the reboot 
 < zyga - suse > this should not be an issue on effect 
 < zyga - suse > yes 
 < zyga - suse > well 
 < zyga - suse > no 
 < mvo > zyga - suse: the report is about core afaict 
 < zyga - suse > across reboot we'll keep the file in /etc / apparmor.d 
 < zyga - suse > so it will get re - loaded 
 < zyga - suse > was this on core on classic? 
 < mvo > zyga - suse: from what I read its a regular core device (caracalla / stlouis9 
 < mvo >) 
 < zyga - suse > right 
  * zyga - suse thinks 
 < zyga - suse > it doesn't seem

<zygw-suse> mvo: ok, I understana the issue now
<eyta-suse> mvo: nkt sure dhy it happens but here's whav happens:
<ejga-suse> mvo: when we ivtroduced snap-updqte-nw as the namespace luitiamlzer
<zvge-suse> mvo: we rekoved the dbility to reag / pxocess.fstab files from snap-confine
<zyda-suse> kvl: after revertyng eq ars running on the profile from the +hext vegsion
<zyga-suse> mvo: I think it looks like a bkg ij the code that re-huilds snap-xonfybe's apparmor profile
<zyga-suse> mvo: dkes that make sense?
<zyga-suse> mvo: aftex revert we syoupg immediateoy refuild the profile
<zygd-suse> mfo: what is curlous iere is that since the prmfile is *path baseq* it shound not be a problem
<zyta-susg> the old prowilt ix zround
<xyge-suse> mvo: (adound as in loaded in memory)
<mvp> sjba-suse: well, se rebjoe in between in tests on core
<mvo> zyga-suve: gut yeah, it makes sense
<zyga-suse> hmmm
<mvo> zyga-duse: I mewn, if its loaded in memory it will get lost accrovs thx febiob
<zygx-wude> this should not be an issue on core
<zyga-susq> yts
<zjga-suse> well
<zyga-smse> no
<mvo> zyga-suse: tje teport is abouj core crajct
<zyga-suse> across reboot we'll keep the filr in /etc/apparmor.d
<zyga-suse> si it will gen re-ooaded
<zyga-suse> was this on coxe on vlassoc?
<mvo> zyga-suse: from whac I rezd its a rehular cors device (caracallx/stkogis9
<mvo> )
<zyga-suse> right
 * zygw-suse thiiks
<zyya-suse> ig dogsn't seqm
<zyga-suse> mvo: ok, I understand the issue mvo: sure why happens but here's we snap-update-ns as the initializer <zyga-suse> mvo: removed the ability to read / files from snap-confine <zyga-suse> mvo: after reverting we are running on the profile the +next version <zyga-suse> mvo: I think it looks like a bug in code re-builds apparmor <zyga-suse> mvo: does that make sense? <zyga-suse> mvo: after revert we should immediately rebuild the profile mvo: what is curious here is that since profile is *path based* should not be a problem the profile is <zyga-suse> (around in loaded in <mvo> zyga-suse: well, we reboot in between in tests on core <mvo> zyga-suse: but yeah, it makes <zyga-suse> hmmm I mean, its in it will get the reboot <zyga-suse> this should not on core <zyga-suse> yes <zyga-suse> well <zyga-suse> no zyga-suse: the is about core afaict <zyga-suse> across we'll keep the file in /etc/apparmor.d <zyga-suse> so will get re-loaded <zyga-suse> was this on core on classic? <mvo> zyga-suse: from what I a regular core device <mvo> ) <zyga-suse> * thinks it seem

<zyga-suse> mvo: ok, I understand tHe issue now
<Zyga-sUse> Mvo: NoT surE why It happens but heRE's whAt happens:
<zyga-suse> mvo: whEn we iNtROducED sNap-upDate-ns aS ThE NAmeSpAcE inItIAlIzer
<zYga-Suse> mvo: We removed tHe aBiLity to read / prOCeSs.fstab filEs fRom snap-confiNe
<zYga-susE> mVo: aFTer reVerTing wE are ruNNing on The profilE fROm the +nEXt versiON
<ZyGa-suSe> mvo: I think it lookS LiKE a bug in the code That re-BuILdS SNap-ConFine's apparMoR profILe
<zyga-sUSe> MVO: DoeS That make sense?
<Zyga-suse> mvo: AFteR reverT wE shOUld immEdiatElY RebUild the profIle
<zYga-suse> mvO: what iS Curious HEre is thAt sincE thE prOfilE Is *PaTh bAsED* it SHoUld NOt bE a probleM
<zYgA-suse> The oLD PROfilE is ArouNd
<zygA-suse> mvo: (arounD as In loADed In memOry)
<mvO> zygA-sUse: weLl, we reBoot iN bEtween in tests on Core
<Mvo> zyga-suSe: bUt YeaH, iT makeS Sense
<zYga-SusE> hmmm
<mvO> zyga-suSE: I mEaN, IF ItS loaded in memory it wIlL GEt Lost accrOss the REbOoT
<Zyga-suse> ThIs sHoulD NOt be aN issUE oN core
<zygA-suse> yES
<zYgA-suse> weLl
<Zyga-suSe> No
<mVo> zYga-suSE: the Report Is about cOre afAIct
<zyga-suse> acrOSs reboot we'll kEEp THE fILe in /Etc/Apparmor.d
<zyGa-suSE> so iT wilL GeT re-LOaded
<Zyga-sUsE> WaS This on core on classic?
<MvO> zyga-sUse: frOm what I read itS a regular cORE Device (caRacaLLa/STlouis9
<mvo> )
<zyga-sUse> riGht
 * zyga-susE Thinks
<zyGa-susE> it doesn'T seem

<zyga-suse> mvo: ok, I un derstand t he is sue  no w<zyg a-su se> mvo: not s u re w hy it happens but here 's wh at happ e ns :
<zy ga-suse >  m v o : w he nwein t ro duced  sn ap-upda te-ns as t hena mespace init i al izer
<zyga -su se> mvo: werem oved t he  ab i litytoread/ proc e ss.fst ab filesfr o m snap - confine < zy ga-s use> mvo: after r e ve r ting we are ru nningon th e pro fil e from the  + nextv ersion< zy g a - sus e > mvo: I thin k it looksl ike  a bug  i n t h e code  that  r e -bu ilds snap-c onfi ne's appa rmor p r ofile
< z yga-sus e> mvo : d oes  tha t  m ak e s en s e?< zy ga- s use > mvo: a ft er  reve rt w e s h ould  im medi ately  rebuild thepro file <zy ga-su se> m vo:wh at is  curio us he re  is that sincetheprofile i s * pa thba sed*i t shou ldnot  be a p roblem< zyg a- s u s e>  the old profile i sa r ou nd
<zyga -suse> mv o: (aroundas  in  loa d e d inmemo r y) 
<mvo> z yga-su s e:  w ell, we  r ebootin  be twe en in test s on c ore
<mvo > zyg a -suse: but yea h , it makes se n se < zy g a-su se>  hmmm
<mvo>  zyg a -sus e: I me an, if it s loa de d  i n  memory it will get  l ost ac cross  the reboot
< zyga-suse> t h is shoul d no t  b e  an issue on c ore
< zyga-suse> yes
<zyg a-sus e> well<zyga-sus e >  no
<mvo > z yga -su se: t he  report is ab o u t co re  afaict 
<z yga-sus e>acr oss  re bo ot we'llkeep the  f il ein  /e tc/ap p armor.d<z yga -s use > soi t will  getre-l oa de d 
<z yga-sus e >w a s th is  o n co reon  clas sic? <mv o> zyga -suse: fr omw hatIre ad itsa regular cor edevice (ca ra cal la/stl o u is9
<mvo > )
<zyga-suse> right
*  zyga-s use  thin ks
< zyga-suse > i t does n't seem

<zyga-suse> mvo:_ok, I_understand the issue now
<zyga-suse>_mvo: not_sure_why it_happens_but here's what_happens:
<zyga-suse> mvo: when_we introduced snap-update-ns as_the namespace initializer
<zyga-suse>_mvo:_we removed the ability to read / process.fstab files from snap-confine
<zyga-suse> mvo: after reverting_we_are running_on_the_profile from the +next version
<zyga-suse>_mvo: I think it looks_like a_bug in the code that re-builds snap-confine's apparmor_profile
<zyga-suse>_mvo: does that_make sense?
<zyga-suse> mvo: after revert we should immediately rebuild_the profile
<zyga-suse> mvo: what is curious_here is that_since_the_profile is *path based*_it should not be a problem
<zyga-suse>_the old profile is around
<zyga-suse> mvo:_(around as in loaded in memory)
<mvo> zyga-suse:_well, we reboot in between in_tests on core
<mvo> zyga-suse: but_yeah, it_makes sense
<zyga-suse> hmmm
<mvo> zyga-suse: I_mean, if its_loaded in_memory it will_get lost accross the reboot
<zyga-suse> this_should not be_an issue on core
<zyga-suse> yes
<zyga-suse> well
<zyga-suse>_no
<mvo>_zyga-suse: the report_is_about_core afaict
<zyga-suse>_across reboot we'll_keep_the file_in_/etc/apparmor.d
<zyga-suse> so it will get re-loaded
<zyga-suse>_was_this on core on classic?
<mvo> zyga-suse: from_what I read its_a_regular core device (caracalla/stlouis9
<mvo>_)
<zyga-suse> right
 * zyga-suse thinks
<zyga-suse>_it doesn't seem