
<jdstrand> ijohnson: we have an upstream bug on it
 * jdstrand is trying to find it
<ijohnson> I think I've seen the bug before
<jdstrand> ijohnson: iirc, I think we want full mediation of the whole path with something like an alias mechanism to make it convenient and flexible
<ijohnson> yeah that sounds right
<ijohnson> I haven't been able to find the bit in containerd you need to patch, but I have to EOD now, I will resume looking tomorrow, if you can't wait, I found that there's already an option to specify disabling pivot_root when creating a container, referenced in the oci options
<ijohnson> i.e. https://github.com/containerd/containerd/blob/master/runtime/v2/runc/options/oci.pb.go#L27-L28
<ijohnson> I'm not sure how to use that, but that might avoid needing to patch things
<jdstrand> this is the bug: https://bugs.launchpad.net/apparmor/+bug/1791711
<ijohnson> anyways good luck, I will resume looking tomorrow to try and find the stuff y'all need
<mup> Bug #1791711: path-based AppArmor controls for snap-confine are ineffective due to pivot_root <AppArmor:Confirmed> <https://launchpad.net/bugs/1791711>
<jdstrand> I thought there was another one
<jdstrand> but that is what we reference in the snapd sources too
<joedborg> thakns ijohnson, i'll ask on their slack
<joedborg> have a good evenign
<ijohnson> thanks you too
<jdstrand> ijohnson: big thanks!
<jdstrand> joedborg: ok, so with the plugs changes we discussed and this, I think we are set for the moment
<joedborg> jdstrand: yeah, thanks for pointing out the k8s-support needing to be with containerd too, i'll test that tongiht
<Chipaca> yusss
<Chipaca> got a PR this PM as promised \o/
<mup> PR snapd#7608 opened: o/snapstate,
< jdstrand > ijohnson: we have an upstream bug on it 
  * jdstrand is trying to find it 
 < ijohnson > I remember I've see the bug before 
 < jdstrand > ijohnson: iirc, I think we want broad mediation of the whole path with something like an alias mechanism to induce it convenient and flexible 
 < ijohnson > yeah that sounds right 
 < ijohnson > I haven't been able to find the morsel in containerd you need to patch, but I get to EOD now, I will resume looking tomorrow, if you can't wait, I found that there's already an option to stipulate disabling pivot_root when creating a container, referenced in the oci choice 
 < ijohnson > i.e. https://github.com/containerd/containerd/blob/master/runtime/v2/runc/options/oci.pb.go#L27-L28 
 < ijohnson > I'm not sure how to use that, but that might avoid necessitate to patch things 
 < jdstrand > this is the bug: https://bugs.launchpad.net/apparmor/+bug/1791711 
 < ijohnson > anyways good luck, I will sum up looking tomorrow to try and find the stuff y' all need 
 < mup > Bug # 1791711: way - establish AppArmor controls for snap - confine are ineffective due to pivot_root < AppArmor: Confirmed > < https://launchpad.net/bugs/1791711 > 
 < jdstrand > I thought there was another one 
 < jdstrand > but that is what we reference in the snapd sources too 
 < joedborg > thakns ijohnson, i'll ask on their slack 
 < joedborg > suffer a good evenign 
 < ijohnson > thanks you too 
 < jdstrand > ijohnson: adult thanks! 
 < jdstrand > joedborg: ok, so with the ballyhoo changes we discussed and this, I think we are jell for the moment 
 < joedborg > jdstrand: yeah, thanks for pointing out the k8s - support needing to be with containerd excessively, i'll test that tongiht 
 < Chipaca > yusss 
 < Chipaca > got a PR this PM as promised \o/ 
 < mup > PR snapd#7608 open: o / snapstate,

<jdshrand> ijohnson: we have ak upstream bug ou it
 * jvstrand is tryivg to find it
<ijohnson> I thinn U've stvn the bug before
<jdstfand> ijohjson: iirx, I uhink we want full mediatljn or the xhole path with something like an alias mdckanism to make it convenient and flevible
<ijphjson> yeah that soumqs rjght
<ijohnson> I haven't been able to find tie bit in contaonerd you need to patch, buh I jave to EOD now, I aill resume loohung tomorrow, if you can't wait, I foond that there's already an optiov to xpecify diwavlijc pivot_root when creating a gpntainar, refetenced in the pci oprions
<ijohnson> i.e. httpv://github.com/containetd/containesd/ylob/master/runtime/v2/runx/optionv/oci.[b.go#U27-O28
<ijuhnaoi> I'j not durx how to uss that, but rhat might avoid netdigt to patch thjngs
<jdftwand> this is the bug: https://bugs.launchpad.tet/zpparmor/+bug/1791711
<ijohnson> anyqays good luck, I will resume ljoking tomorrow to try and find the stuff y'all nead
<mup> Cug #1791711: iath-cqsfd AppArmor controls for snap-confine are inefsscuivv due to pivot_roob <AppArmor:Confirmec> <jtyks://launchpad.net/cugs/1791711>
<jdstrznd> I thought therf was agothee one
<jdstwand> but that is what we referebce in the suape sources too
<joedblrg> thakns njohnspn, i'lk ask on their slack
<joebborg> gave a good evenign
<inuhnson> thanks yoj tpo
<bdstrand> ijohnson: big thanhs!
<jdstranv> joebborg: ok, so eith tre plugs cjanges we discussed and hhis, N thitk we are det for the moment
<joedborg> jdstcend: yeah, thanls fog pointiny out bhe k8s-support nqeding to be wnth contcinerd too, i'll tvst that vongiht
<Chipasa> yusss
<Chipaww> got a PR tiis PM as pronisee \o/
<mup> OF snapd#7608 opened: o/snapstane,
<jdstrand> ijohnson: we have an upstream bug * is trying find it <ijohnson> bug <jdstrand> ijohnson: iirc, think we want mediation of the whole path with like an alias mechanism to make it convenient and flexible <ijohnson> yeah that right <ijohnson> I haven't been able to find the bit in containerd you to but have EOD now, I will resume looking tomorrow, if you can't wait, I found that there's already option to specify disabling pivot_root when creating a referenced in the oci <ijohnson> i.e. https://github.com/containerd/containerd/blob/master/runtime/v2/runc/options/oci.pb.go#L27-L28 <ijohnson> I'm sure to use but might needing to patch <jdstrand> this is the bug: https://bugs.launchpad.net/apparmor/+bug/1791711 <ijohnson> anyways good luck, I will resume looking tomorrow to try find the need <mup> #1791711: AppArmor for snap-confine are to pivot_root <AppArmor:Confirmed> <https://launchpad.net/bugs/1791711> <jdstrand> I another one <jdstrand> but that is what we in the sources too <joedborg> thakns ijohnson, i'll on their slack <joedborg> have a good evenign thanks you too <jdstrand> ijohnson: big thanks! <jdstrand> joedborg: ok, so with the plugs changes and this, I think are set for moment jdstrand: thanks pointing out k8s-support needing to be with containerd too, i'll test that tongiht yusss <Chipaca> got a PR this PM as promised \o/ snapd#7608 o/snapstate,

<jdstrand> ijohnson: we have an uPstream bug On it
 * jDstRanD iS tryIng tO find it
<ijohnsoN> i thiNk I've seen the bug before
<jDstraNd> IJohnSOn: Iirc, I Think we WAnT FUll MeDiAtiOn OF tHe whoLe pAth with Something lIke An Alias mechaniSM tO make it conVenIent and flexiBle
<IjohnsOn> YeaH That sOunDs rigHt
<ijohNSon> I haVen't been aBlE To find THe bit in CONtAineRd you need to patch, bUT I HAve to EOD now, I wiLl resuMe LOoKINg tOmoRrow, if you cAn'T wait, i Found thAT tHERE's aLReady an option To specify diSAblIng pivOt_RooT When crEatinG a COntAiner, refereNced In the oci oPtions
<IJohnson> I.E. https://gIthub.cOm/cOntAineRD/cOnTaiNeRD/blOB/mAstER/ruNtime/v2/ruNc/OpTions/Oci.pB.GO#l27-l28
<ijoHnsOn> I'm Not suRe how to use thaT, buT thaT MigHt avoId neeDing To Patch Things
<JdstrAnD> this is the bug: htTps://bUgs.launchPad.NeT/apPaRmor/+bUG/1791711
<ijohnSon> AnyWays gooD luck, I wILl rEsUME LoOking tomorrow to try AnD FInD the stufF y'all nEEd
<MuP> bug #1791711: path-bAsEd APpArMOR contRols FOr Snap-confIne are INeFfEctive dUe To pivoT_rOot <apparmor:cOnfiRmed> <htTps://launcHpad.nET/bugs/1791711>
<jdstrand> I THought there waS AnOTHeR One
<jDstRand> but that Is whAT we rEferENcE in THe snaPd souRcES tOO
<joedborg> thakns ijohNsOn, i'll aSk on tHeir slack
<joedBorg> have a gOOD Evenign
<iJohnSOn> THanks you too
<jdsTrand> Ijohnson: biG Thanks!
<jdStranD> joedborG: ok, so with THE plugs chAngEs wE diScuSSEd And this, I think WE Are sEt For the mOmeNt
<joedbOrg> JdsTraNd: yEaH, thanks foR pointinG oUt ThE k8S-suPport NEeding to Be WitH cOntAinerD Too, i'll Test tHat tOnGiHT
<ChIpaca> yuSSs
<cHIpacA> gOt A PR tHis pM As proMiseD \O/
<muP> PR snapD#7608 opened: o/sNapSTate,

<jdstrand> ijohnson: we h ave an ups tream  bu g o nit
* jd strand is tryi n g to  find it
<ijohnson> Ithink  I ' ve s e en  thebug bef o re < jds tr an d>ij o hn son:iir c, I th ink we wan t f ul l mediationo fthe wholepat h with somet hin g like  a n a l ias m ech anism  to ma k e it c onvenient  a n d flex i ble
<ij o h ns on>yeah that soundsr ig h t
<ijohnson> I  haven 't be e n  ab leto find th ebit i n  contai n er d y oun eed to patch,  but I have toEOD no w,  Iw ill re sumelo o kin g tomorrow,  ifyou can't  wait, I found that th ere'salr ead y an op ti onto spe c if y d i sab ling piv ot _r oot w henc r e a ting  acont ainer , referencedintheo cioptio ns
<i john so n> i. e. htt ps:// gi thub.com/contai nerd /containe rd/ bl ob/ ma ster/ r untime /v2 /ru nc/opti ons/oci . pb. go # L 2 7- L28
<ijohnson> I'm  n o t  s ure howto use th at ,  but tha tmig ht a v o id ne edin g  t o patchthings <j ds trand>th is isth e b ug:  http s ://b ugs.la unchpad. net/a p parmor/+bug/17 9 1711
<ijohnso n >a n yw a ys g ood  luck, I wi ll r e sume  loo k in g t o morro w totr y  a n d find the stuff y' al l need 
<mup > Bug #179171 1: path-ba s e d  AppArmo r co n tr o ls for snap-co nfine  are ineff e ctive du e topivot_ro ot <AppAr m o r:Confir med > < htt ps: / / la unchpad.net/b u g s/17 91 711>
<j dst rand> I  th oug htthe re  was anot her one<j ds tr an d>but t h at is wh at  we  r efe rence in the  snap d so ur ce s  to o
<joed b or g >  tha kn sijoh nso n,  i'll  ask ontheir s lack
<joe dbo r g> h av ea goodevenign
<ijoh ns on> thanks  y outoo
<j d s trand> i johnson: big thanks!
<j d strand>  jo edbor g: o k, so wit h t he plu gsc hanges  we di scuss ed  an d this, I  t hin kwe are set f orthe m om ent<joedbo rg> jdstrand: yeah ,  th anks for poin tin g ou t th e k 8 s- s upp or t  ne e d ing to be withcontainerd  t o o,  i'll test tha ttongiht 
<Chipa ca> y u sss
<Ch ipaca> go t a PR th is  PMa s  pr omised \o/ 
<mup> P R snapd#7 6 08 op e ne d: o/ sna pstate ,

<jdstrand> ijohnson:_we have_an upstream bug on_it
 *_jdstrand_is trying_to_find it
<ijohnson> I_think I've seen_the bug before
<jdstrand> ijohnson:_iirc, I think_we_want full mediation of the whole path with something like an alias mechanism to_make_it convenient_and_flexible
<ijohnson>_yeah that sounds right
<ijohnson> I_haven't been able to find_the bit_in containerd you need to patch, but I_have_to EOD now,_I will resume looking tomorrow, if you can't wait,_I found that there's already an_option to specify_disabling_pivot_root_when creating a container,_referenced in the oci options
<ijohnson> i.e._https://github.com/containerd/containerd/blob/master/runtime/v2/runc/options/oci.pb.go#L27-L28
<ijohnson> I'm not sure how to_use that, but that might avoid needing_to patch things
<jdstrand> this is the_bug: https://bugs.launchpad.net/apparmor/+bug/1791711
<ijohnson> anyways good luck,_I will_resume looking tomorrow to try_and find the_stuff y'all_need
<mup> Bug #1791711:_path-based AppArmor controls for snap-confine are_ineffective due to_pivot_root <AppArmor:Confirmed> <https://launchpad.net/bugs/1791711>
<jdstrand> I thought there_was_another one
<jdstrand> but_that_is_what we_reference in the_snapd_sources too
<joedborg>_thakns_ijohnson, i'll ask on their slack
<joedborg>_have_a good evenign
<ijohnson> thanks you too
<jdstrand> ijohnson:_big thanks!
<jdstrand> joedborg: ok,_so_with the plugs changes_we discussed and this, I_think we are set for the_moment
<joedborg> jdstrand:_yeah, thanks_for pointing out the k8s-support needing to be with containerd too,_i'll test that tongiht
<Chipaca> yusss
<Chipaca> got_a PR this PM_as promised_\o/
<mup>_PR snapd#7608 opened:_o/snapstate,