Merge lp://qastaging/~jdstrand/snap-confine/ubuntu-core-launcher.pts into lp://qastaging/~snappy-dev/snap-confine/trunk
Proposed by
Jamie Strandboge
Status: | Merged |
---|---|
Merged at revision: | 100 |
Proposed branch: | lp://qastaging/~jdstrand/snap-confine/ubuntu-core-launcher.pts |
Merge into: | lp://qastaging/~snappy-dev/snap-confine/trunk |
Prerequisite: | lp://qastaging/~jdstrand/snap-confine/ubuntu-core-launcher.nnp-off |
Diff against target: |
80 lines (+41/-0) 3 files modified
debian/changelog (+2/-0) debian/usr.bin.ubuntu-core-launcher (+2/-0) src/main.c (+37/-0) |
To merge this branch: | bzr merge lp://qastaging/~jdstrand/snap-confine/ubuntu-core-launcher.pts |
Related bugs: |
Reviewer | Review Type | Date Requested | Status |
---|---|---|---|
Seth Arnold | Approve | ||
Review via email: mp+289686@code.qastaging.launchpad.net |
This proposal supersedes a proposal from 2016-03-21.
Description of the change
Setup private /dev/pts
To post a comment you must log in.
This looks good with a few caveats:
- AppArmor "ought to" support something like "options= newinstance" so that
we can reject any mounts that may violate our expectations. "Ought to"
since it looks like the parser and kernel were written with this in mind
but I can't figure out how to make it work.
- We really shouldn't be afraid to modify our startup routines to do the
right thing. We can either adjust now and deal with the fallout or we
can continue to live on the assumption that no one will ever screw up,
ever. Setting -o newinstance on the very first mount sounds like the
best way to reduce our long-term technical debt.
- I'm not sure the gid=5 is correct if a gid map is in place pid/guid_ map). I can't find documentation on this one way or
(/proc/
another. I thought I'd call this out in case things don't look correct
elsewhere (say, gids are wrong in containers) then this may be recalled.
Thanks