| Changelog |
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.76-1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Thu May 28 2026 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.76
- assertions: add helper for validating integrity data
- assertions: drop incorrect/non-standard Ed25519 support
- confdb: allow only API admin read access to confdb secrets
- confdb: block concurrent confdb accesses
- confdb: block concurrent snapctl accesses to configuration
database
- confdb: check for ephemeral data when missing save-view hook on
commit
- confdb: ignore not-found errors in confdb-schema refreshes
- confdb: support --wait-for timeouts when accessing confdb
- core-initrd: add group referenced in udev rules
- core-initrd: add libbpf dependency to initramfs
- core-initrd: add missing libbpf dependency in 24.04 packaging
- core-initrd: ensure audio is a system group
- core-initrd: fix /boot/uboot mount with u-boot env in dedicated
partition
- core-initrd: increase mount burst from 5 to 128 for faster boot
- core-initrd: sync partition udev rules with the ones in core-base
- core-initrd: sync with latest upload to snappy-dev PPA
- core-initrd: synchronize changelogs with latest PPA upload
- core-initrd: update changelog with latest PPA upload
- LP: #2150773 core-initrd: add nfnetlink module to fix nf netlink
socket speed regression (Ubuntu Core only)
- cross-distro: allow snapd to manipulate systemd unit files in
SELinux policy
- cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch
- desktop: fix common ID selection with multiple desktop plugs
- FDE: allow user mode on core in secboot TPM handling
- FDE: bump go-efilib dependency
- FDE: bump secboot to rev cdcb64992e54 for FDE fixes
- FDE: deprecate check-pin/passphrase API endpoints
- LP: #2147606 FDE: give inactive state on classic
- FDE: improve tracing for OP-TEE probing
- FDE: move auto-repair logic to overlord/fdestate and provide state
- FDE: update secboot for TPM/FDE bug fixes including Intel HAP and
recovery key parsing
- FDE: use any primary key matching digest when adding a keyslot
- FDE: use ignore action for preinstall check in VM
- interfaces: bluez | drop explicit deny send_destination in D-Bus
configuration
- interfaces: conditionally deny /proc/self/mountinfo to suppress Go
1.25+ denials
- interfaces: custom-device | fix for-device validation panic on
non-string value
- interfaces: disallow auto-connect to parallel installs
- interfaces: docker | make plug implicit on classic systems
- interfaces: ignore errors in disconnect hooks during explicit snap
disconnect
- interfaces: mediatek-accel | add plug interface base declaration
- interfaces: microceph-support | suppress noisy sudo denial audit
logs
- interfaces: podman | add new interface for podman socket access
- interfaces: pulseaudio | fix security tag syntax inconsistency
- interfaces: raw-usb | allow USB device enumeration on Fairphone 5
with NexDock
- interfaces: restore auto-connections on failed refresh undo
- LP: #2148544 interfaces: bool-file | support deep SoC sysfs paths
for LED brightness
- LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17
compliant
- packaging: add cross-distro build script and instructions
- packaging: add openSUSE 16.0 spread support
- packaging: Debian build improvements
- packaging: default openSUSE to /var/lib/snapd/snap and sync from
downstream
- packaging: drop transitional packages only for Ubuntu 26.04
(Resolute)
- packaging: fix Launchpad FIPS build detection for snapd-fips job
- packaging: refactor and clean up snapd.mk, standardize test-data
directories
- packaging: switch to golang-github-chai2010-gettext-go-dev
- packaging: update bundled AppArmor 4.1.7 (snapd snap only)
- prompting: escape paths in prompt constraints
- prompting: improve API error handling and validation
- prompting: improve error message when no handler service is
present
- prompting: re-enable the prompting notice backend
- prompting: respond with full user-allowed permission set
- prompting: validate permissions while unmarshalling
- remote device management: implement dispatch-mgmt-messages task
with sequencing support
- LP: #2125344 snap: avoid empty channel forwarding message
- LP: #2150683 snap: clarify snap install help text for --classic
and --devmode
- LP: #2152908 snap: print complex attributes in snap interface
--attrs output
- snap: add run-inhibit hint and inhibit info when a snap is
disabled
- snap: allow removing a snap and its base at the same time
- snap: display detailed component information in snap info
- snap: extend AlreadyInstalledError to multiple snaps and
components
- snap: extend set-quota command options description with accepted
value formats
- snap: implement snap delta command for computing snap deltas
- snap: improve consistency for snap install when some snaps are
already installed
- snap: show hint in snap list that a snap has components
- snap-confine: allow inheriting unix sockets from snaps
- snap-confine: allow linking to libm in AppArmor profile
- snap-confine: fix out-of-bounds read in mountinfo parser for
partial escape sequences
- snap-confine: harden bpffs mount with nosuid, nodev, noexec flags
- snap-confine: remove experimental persistent per-user mount
namespace feature
- snap-confine: set FD_CLOEXEC on file descriptors returned by BPF
helpers
- snap-confine: support transparent_hugepage in AppArmor profile
- snap-confine: use strchr after NUL-terminating in infofile parser
- snap-update-ns: switch to a multi-pass process for constructing
and updating mount namespaces
- RemoveMountUnitFile now unmounts even if mount unit file is
missing
- Add explicit mount phase during single-reboot refresh to fix undo
of kernel refreshes
- Add security audit logging subsystem
- Add base prioritized AppArmmor snippets for strictly confined or
jailed snaps
- Allow openshell snap to use experimental daemon-scope: user
- Allow configuring mount unit options based on filesystem type
- Allow equals signs in uevent values in netlink parser
- Also bind-mount directories modified by kmod backend during
preseed
- Clean up potentially corrupted files during snap download undo
- Complete the bootloader environment implementation
- Copy integrity data files during snap install
- Create hook for seed refresh mode
- Create removal tasks for old seed-refresh seeds
- Dispatch systemctl commands asynchronously when calling Stop()
- Ensure /tmp/.X11-unix created inside mount namespace has correct
permissions
- Ensure exclusive changes conflict with refresh/revert
- Ensure existing snap confinement flags are not dropped when
installing or removing components
- Export ubuntu-boot-state filename constant from bootloader package
- Fix duplicate removal of apps under $SNAP_MOUNT_DIR/bin
- Fix integration between prerequisites task and seed-refresh mode
- Fix split-refresh overwriting provided lane
- Fix use of umask in GetListener for socket activation
- Ignore net.ErrClosed during daemon shutdown
- Implement ResolveValidationSetsEnforcementError in terms of one
call
- Improve snapctl install consistency when components are already
installed
- Inject seed creation tasks into snap refresh flow
- Introduce system options for custom certificates on Ubuntu Core
- Keep idle services with activation units stopped on reload
- List snap components in snap-debug-info via debug-tools
- Look at gadget.yaml instead of marker file to determine ubootpart
usage
- LP: #1966067 Skip redundant xdg-settings confirmation prompt when
setting is already correct
- LP: #2110368 Fix component installation for private snaps via
snapctl
- LP: #2110368 Fix download of private snap components by setting
UserID
- LP: #2144666 Fix mount namespace updates with synthetic bind
mounts on same target paths
- LP: #2146337 Improve handling of failed downloads and retain
partial files for resume
- LP: #2147207 Fix snap enable/disable cycle forgetting components
- Make run-inhibit hint for kill-snap-apps task based on kill reason
- Merge content-provider prerequisite updates into seed-refresh
- Move SortServices into Backend.StartServices
- Move state to client change conversion to ctlcmd package
- Omit misleading "try to refresh snapd" suggestion for ISA-related
errors
- Only create link-component tasks when needed during refresh to
existing revision
- Reconfigure piboot bootloader on gadget refreshes to preserve
os_prefix
- Reduce the number of AppArmor profile regenerations during snap
operations
- Refactor seed-refresh ownership to devicestate
- Regenerate certificate database on remodels
- Remove obsolete FIXME comment in VersionCompare
- Remove unused GenerateDmVerityData helper from snap/integrity
- Rename and document error type for ISA assumes flags
- Restart snapd from daemon.Stop to improve restart reliability
- Restart stopped services on error in stopSnapServices for
transactionality
- Simplify certificate-db updates on model-base refresh/installs
- Support racing Loop and Stop correctly in overlord
- Support sending file descriptors to systemd via sd_notify
- Unroll CPU-heavy recursive function in snap state handlers
- Update seccomp syscalls list for kernel 7.1.0
- Use change ID to prevent nested seed-refresh spawned by
prerequisites
- Validate content interface plug target directories exist for
core26+ snaps
- Validate layout paths exist in snap tree for snaps using bare or
core26+
* Fri Apr 17 2026 Katie May <katie.may@canonical.com>
- New upstream release 2.75.2
See NEWS file for details.
* Wed Mar 18 2026 Zygmunt Krynicki <me@zygoon.pl> - 2.74.1-1
- Fix missing cap_sys_resource on snap-confine
* Fri Mar 13 2026 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.74.1
- FDE: measure DeployedMode and AuditMode variables if they appear
as disabled in the event log to avoid a potential reseal-failure
boot loop
- LP: #2139611 FDE: fix db updates by allowing multiple payloads
- LP: #2139300 snap-confine: add CAP_SYS_RESOURCE to allow raising
memory lock limit when required
- LP: #2139099 snap-confine: bump the max element count of the BPF
map used to store IDs of allowed/matched devices to 1000
- Interfaces: Added pidfd_open and memfd_secret to seccomp template
- Interfaces: camera | add locking permission for /dev/video
* Tue Feb 17 2026 Neal Gompa <ngompa@fedoraproject.org> - 2.72-4
- Default to vendored Go dependencies in Fedora
* Tue Feb 03 2026 Maxwell G <maxwell@gtmx.me> - 2.72-3
- Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.72-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Nov 13 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.72
- FDE: support replacing TPM protected keys at runtime via the
/v2/system-volumes endpoint
- FDE: support secboot preinstall check fix actions for 25.10+
hybrid installs via the /v2/system/{label} endpoint
- FDE: tweak polkit message to remove jargon
- FDE: ensure proper sealing with kernel command line defaults
- FDE: provide generic reseal function
- FDE: support using OPTEE for protecting keys, as an alternative to
existing fde-setup hooks (Ubuntu Core only)
- Confdb: 'snapctl get --view' supports passing default values
- Confdb: content sub-rules in confdb-schemas inherit their parent
rule's "access"
- Confdb: make confdb error kinds used in API more generic
- Confdb: fully support lists and indexed paths (including unset)
- Prompting: add notice backend for prompting types (unused for now)
- Prompting: include request cgroup in prompt
- Prompting: handle unsupported xattrs
- Prompting: add permission mapping for the camera interface
- Notices: read notices from state without state lock
- Notices: add methods to get notice fields and create, reoccur, and
deepcopy notice
- Notices: add notice manager to coordinate separate notice backends
- Notices: support draining notices from state when notice backend
registered as producer of a particular notice type
- Notices: query notice manager from daemon instead of querying
state for notices directly
- Packaging: Ubuntu | ignore .git directory
- Packaging: FIPS | bump deb Go FIPS to 1.23
- Packaging: snap | bump FIPS toolchain to 1.23
- Packaging: debian | sync most upstream changes
- Packaging: debian-sid | depends on libcap2-bin for postint
- Packaging: Fedora | drop fakeroot
- Packaging: snap | modify snapd.mk to pass build tags when running
unit tests
- Packaging: snap | modify snapd.mk to pass nooptee build tag
- Packaging: modify Makefile.am to fix snap-confine install profile
with 'make hack'
- Packaging: modify Makefile.am to fix out-of-tree use of 'make
hack'
- LP: #2122054 Snap installation: skip snap icon download when
running in a cloud or using a proxy store
- Snap installation: add timeout to http client when downloading
snap icon
- Snap installation: use http(s) proxy for icon downloads
- LP: #2117558 snap-confine: fix error message with /root/snap not
accessible
- snap-confine: fix non-suid limitation by switching to root:root to
operate v1 freezer
- core-initrd: do not use writable-paths when not available
- core-initrd: remove debian folder
- LP: #1916244 Interfaces: gpio-chardev | re-enable the gpio-chardev
interface now with the more robust gpio-aggregator configfs kernel
interface
- Interfaces: gpio-chardev | exclusive snap connections, raise a
conflict when both gpio-chardev and gpio are connected
- Interfaces: gpio-chardev | fix gpio-aggregator module load order
- Interfaces: ros-snapd-support | grant access to /v2/changes
- Interfaces: uda-driver-libs, egl-driver-libs, gbm-driver-libs,
opengl-driver-libs, opengles-driver-libs | new interfaces to
support nvidia driver components
- Interfaces: microstack-support | allow DPDK (hugepage related
permissions)
- Interfaces: system-observe | allow reading additional files in
/proc, needed by node-exporter
- Interfaces: u2f | add Cano Key, Thesis FIDO2 BioFP+ Security Key
and Kensington VeriMark DT Fingerprint Key to device list
- Interfaces: snap-interfaces-requests-control | allow shell API
control
- Interfaces: fwupd | allow access to Intel CVS sysfs
- Interfaces: hardware-observe | allow read access to Kernel
Samepage Merging (KSM)
- Interfaces: xilinx-dma | support Multi Queue DMA (QDMA) IP
- Interfaces: spi | relax sysfs permission rules to allow access to
SPI device node attributes
- Interfaces: content | introduce compatibility label
- LP: #2121238 Interfaces: do not expose Kerberos tickets for
classic snaps
- Interfaces: ssh-public-keys | allow ro access to public host keys
with ssh-key
- Interfaces: Modify AppArmor template to allow listing systemd
credentials and invoking systemd-creds
- Interfaces: modify AppArmor template with workarounds for Go 1.35
cgroup aware GOMAXPROCS
- Interfaces: modify seccomp template to allow landlock_*
- Prevent snap hooks from running while relevant snaps are unlinked
- Make refreshes wait before unlinking snaps if running hooks can be
affected
- Fix systemd unit generation by moving "WantedBy=" from section
"unit" to "install"
- Add opt-in logging support for snap-update-ns
- Unhide 'snap help' sign and export-key under Development category
- LP: #2117121 Cleanly support socket activation for classic snap
- Add architecture to 'snap version' output
- Add 'snap debug api' option to disable authentication through
auth.json
- Show grade in notes for 'snap info --verbose'
- Fix preseeding failure due to scan-disk issue on RPi
- Support 'snap debug api' queries to user session agents
- LP: #2112626 Improve progress reporting for snap install/refresh
- Drop legacy BAMF_DESKTOP_FILE_HINT in desktop files
- Fix /v2/apps error for root user when user services are present
- LP: #2114704 Extend output to indicate when snap data snapshot was
created during remove
- Improve how we handle emmc volumes
- Improve handling of system-user extra assertions
* Fri Oct 10 2025 Alejandro Sáez <asm@redhat.com> - 2.71-1
- rebuild
* Fri Aug 22 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.71
- FDE: auto-repair when recovery key is used
- FDE: revoke keys on shim update
- FDE: revoke old TPM keys when dbx has been updated
- FDE: do not reseal FDE hook keys every time
- FDE: store keys in the kernel keyring when installing from initrd
- FDE: allow disabled DMA on Core
- FDE: snap-bootstrap: do not check for partition in scan-disk on
CVM
- FDE: support secboot preinstall check for 25.10+ hybrid installs
via the /v2/system/{label} endpoint
- FDE: support generating recovery key at install time via the
/v2/systems/{label} endpoint
- FDE: update passphrase quality check at install time via the
/v2/systems/{label} endpoint
- FDE: support replacing recovery key at runtime via the new
/v2/system-volumes endpoint
- FDE: support checking recovery keys at runtime via the /v2/system-
volumes endpoint
- FDE: support enumerating keyslots at runtime via the /v2/system-
volumes endpoint
- FDE: support changing passphrase at runtime via the /v2/system-
volumes endpoint
- FDE: support passphrase quality check at runtime via the
/v2/system-volumes endpoint
- FDE: update secboot to revision 3e181c8edf0f
- Confdb: support lists and indexed paths on read and write
- Confdb: alias references must be wrapped in brackets
- Confdb: support indexed paths in confdb-schema assertion
- Confdb: make API errors consistent with options
- Confdb: fetch confdb-schema assertion on access
- Confdb: prevent --previous from being used in read-side hooks
- Components: fix snap command with multiple components
- Components: set revision of seed components to x1
- Components: unmount extra kernel-modules components mounts
- AppArmor Prompting: add lifespan "session" for prompting rules
- AppArmor Prompting: support restoring prompts after snapd restart
- AppArmor Prompting: limit the extra information included in probed
AppArmor features and system key
- Notices: refactor notice state internals
- SELinux: look for restorecon/matchpathcon at all known locations
rather than current PATH
- SELinux: update policy to allow watching cgroups (for RAA), and
talking to user session agents (service mgmt/refresh)
- Refresh App Awareness: Fix unexpected inotify file descriptor
cleanup
- snap-confine: workaround for glibc fchmodat() fallback and handle
ENOSYS
- snap-confine: add support for host policy for limiting users able
to run snaps
- LP: #2114923 Reject system key mismatch advise when not yet seeded
- Use separate lanes for essential and non-essential snaps during
seeding and allow non-essential installs to retry
- Fix bug preventing remodel from core18 to core18 when snapd snap
is unchanged
- LP: #2112551 Make removal of last active revision of a snap equal
to snap remove
- LP: #2114779 Allow non-gpt in fallback mode to support RPi
- Switch from using systemd LogNamespace to manually controlled
journal quotas
- Change snap command trace logging to only log the command names
- Grant desktop-launch access to /v2/snaps
- Update code for creating the snap journal stream
- Switch from using core to snapd snap for snap debug connectivity
- LP: #2112544 Fix offline remodel case where we switched to a
channel without an actual refresh
- LP: #2112332 Exclude snap/snapd/preseeding when generating preseed
tarball
- LP: #1952500 Fix snap command progress reporting
- LP: #1849346 Interfaces: kerberos-tickets | add new interface
- Interfaces: u2f | add support for Thetis Pro
- Interfaces: u2f | add OneSpan device and fix older device
- Interfaces: pipewire, audio-playback | support pipewire as system
daemon
- Interfaces: gpg-keys | allow access to GPG agent sockets
- Interfaces: usb-gadget | add new interface
- Interfaces: snap-fde-control, firmware-updater-support | add new
interfaces to support FDE
- Interfaces: timezone-control | extend to support timedatectl
varlink
- Interfaces: cpu-control | fix rules for accessing IRQ sysfs and
procfs directories
- Interfaces: microstack-support | allow SR-IOV attachments
- Interfaces: modify AppArmor template to allow snaps to read their
own systemd credentials
- Interfaces: posix-mq | allow stat on /dev/mqueue
- LP: #2098780 Interfaces: log-observe | add capability
dac_read_search
- Interfaces: block-devices | allow access to ZFS pools and datasets
- LP: #2033883 Interfaces: block-devices | opt-in access to
individual partitions
- Interfaces: accel | add new interface to support accel kernel
subsystem
- Interfaces: shutdown | allow client to bind on its side of dbus
socket
- Interfaces: modify seccomp template to allow pwritev2
- Interfaces: modify AppArmor template to allow reading
/proc/sys/fs/nr_open
- Packaging: drop snap.failure service for openSUSE
- Packaging: add SELinux support for openSUSE
- Packaging: disable optee when using nooptee build tag
- Packaging: add support for static PIE builds in snapd.mk, drop
pie.patch from openSUSE
- Packaging: add libcap2-bin runtime dependency for ubuntu-16.04
- Packaging: use snapd.mk for packaging on Fedora
- Packaging: exclude .git directory
- Packaging: fix DPKG_PARSECHANGELOG assignment
- Packaging: fix building on Fedora with dpkg installed
* Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 2.70-3
- Rebuild for golang-1.25.0
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.70-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Tue Jun 03 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.70
- FDE: Fix reseal with v1 hook key format
- FDE: set role in TPM keys
- AppArmor prompting (experimental): add handling for expired
requests or listener in the kernel
- AppArmor prompting: log the notification protocol version
negotiated with the kernel
- AppArmor prompting: implement notification protocol v5 (manually
disabled for now)
- AppArmor prompting: register listener ID with the kernel and
resend notifications after snapd restart (requires protocol v5+)
- AppArmor prompting: select interface from metadata tags and set
request interface accordingly (requires protocol v5+)
- AppArmor prompting: include request PID in prompt
- AppArmor prompting: move the max prompt ID file to a subdirectory
of the snap run directory
- AppArmor prompting: avoid race between closing/reading socket fd
- Confdb (experimental): make save/load hooks mandatory if affecting
ephemeral
- Confdb: clear tx state on failed load
- Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g.
confdb-schema)
- Confdb: add NestedEphemeral to confdb schemas
- Confdb: add early concurrency checks
- Simplify building Arch package
- Enable snapd.apparmor on Fedora
- Build snapd snap with libselinux
- Emit snapd.apparmor warning only when using apparmor backend
- When running snap, on system key mismatch e.g. due to network
attached HOME, trigger and wait for a security profiles
regeneration
- Avoid requiring state lock to get user, warnings, or pending
restarts when handling API requests
- Start/stop ssh.socket for core24+ when enabling/disabling the ssh
service
- Allow providing a different base when overriding snap
- Modify snap-bootstrap to mount snapd snap directly to /snap
- Modify snap-bootstrap to mount /lib/{modules,firmware} from snap
as fallback
- Modify core-initrd to use systemctl reboot instead of /sbin/reboot
- Copy the initramfs 'manifest-initramfs.yaml' to initramfs file
creation directory so it can be copied to the kernel snap
- Build the early initrd from installed ucode packages
- Create drivers tree when remodeling from UC20/22 to UC24
- Load gpio-aggregator module before the helper-service needs it
- Run 'systemctl start' for mount units to ensure they are run also
when unchanged
- Update godbus version to 'v5 v5.1.0'
- Add support for POST to /v2/system-info with system-key-mismatch
indication from the client
- Add 'snap sign --update-timestamp' flag to update timestamp before
signing
- Add vfs support for snap-update-ns to use to simulate and evaluate
mount sequences
- Add refresh app awareness debug logging
- Add snap-bootstrap scan-disk subcommand to be called from udev
- Add feature to inject proxy store assertions in build image
- Add OP-TEE bindings, enable by default in ARM and ARM64 builds
- Fix systemd dependency options target to go under 'unit' section
- Fix snap-bootstrap reading kernel snap instead of base resulting
in bad modeenv
- Fix a regression during seeding when using early-config
- LP: #2107443 reset SHELL to /bin/bash in non-classic snaps
- Make Azure kernels reboot upon panic
- Fix snap-confine to not drop capabilities if the original user is
already root
- Fix data race when stopping services
- Fix task dependency issue by temporarily disable re-refresh on
prerequisite updates
- Fix compiling against op-tee on armhf
- Fix dbx update when not using FDE
- Fix potential validation set deadlock due to bases waiting on
snaps
- LP: #2104066 Only cancel notices requests on stop/shutdown
- Interfaces: bool-file | fix gpio glob pattern as required for
'[XXXX]*' format
- Interfaces: system-packages-doc | allow access to
/usr/local/share/doc
- Interfaces: ros-snapd-support interface | added new interface
- Interfaces: udisks2 | allow chown capability
- Interfaces: system-observe | allow reading cpu.max
- Interfaces: serial-port | add ttyMAXX to allowed list
- Interfaces: modified seccomp template to disallow
'O_NOTIFICATION_PIPE'
- Interfaces: fwupd | add support for modem-manager plugin
- Interfaces: gpio-chardev | make unsupported and remove
experimental flag to hide this feature until gpio-aggregator is
available
- Interfaces: hardware-random | fix udev match rule
- Interfaces: timeserver-control | extend to allow timedatectl
timesync commands
- Interfaces: add symlinks backend
- Interfaces: system key mismatch handling
* Tue Apr 08 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.69
- FDE: re-factor listing of the disks based on run mode model and
model to correctly resolve paths
- FDE: run snapd from snap-failure with the correct keyring mode
- Snap components: allow remodeling back to an old snap revision
that includes components
- Snap components: fix remodel to a kernel snap that is already
installed on the system, but not the current kernel due to a
previous remodel.
- Snap components: fix for snapctl inputs that can crash snapd
- Confdb (experimental): load ephemeral data when reading data via
snapctl get
- Confdb (experimental): load ephemeral data when reading data via
snap get
- Confdb (experimental): rename {plug}-view-changed hook to observe-
view-{plug}
- Confdb (experimental): rename confdb assertion to confdb-schema
- Confdb (experimental): change operator grouping in confdb-control
assertion
- Confdb (experimental): add confdb-control API
- AppArmor: extend the probed features to include the presence of
files, as well as directories
- AppArmor prompting (experimental): simplify the listener
- AppArmor metadata tagging (disabled): probe parser support for
tags
- AppArmor metadata tagging (disabled): implement notification
protocol v5
- Confidential VMs: sysroot.mount is now dynamically created by
snap-bootstrap instead of being a static file in the initramfs
- Confidential VMs: Add new implementation of snap integrity API
- Non-suid snap-confine: first phase to replace snap-confine suid
with capabilities to achieve the required permissions
- Initial changes for dynamic security profiles updates
- Provide snap icon fallback for /v2/icons without requiring network
access at runtime
- Add eMMC gadget update support
- Support reexec when using /usr/libexec/snapd on the host (Arch
Linux, openSUSE)
- Auto detect snap mount dir location on unknown distributions
- Modify snap-confine AppArmor template to allow all glibc HWCAPS
subdirectories to prevent launch errors
- LP: #2102456 update secboot to bf2f40ea35c4 and modify snap-
bootstrap to remove usage of go templates to reduce size by 4MB
- Fix snap-bootstrap to mount kernel snap from
/sysroot/writable/system-data
- LP: #2106121 fix snap-bootstrap busy loop
- Fix encoding of time.Time by using omitzero instead of omitempty
(on go 1.24+)
- Fix setting snapd permissions through permctl for openSUSE
- Fix snap struct json tags typo
- Fix snap pack configure hook permissions check incorrect file mode
- Fix gadget snap reinstall to honor existing sizes of partitions
- Fix to update command line when re-executing a snapd tool
- Fix 'snap validate' of specific missing newline and add error on
missed case of 'snap validate --refresh' without another action
- Workaround for snapd-confine time_t size differences between
architectures
- Disallow pack and install of snapd, base and os with specific
configure hooks
- Drop udev build dependency that is no longer required and add
missing systemd-dev dependency
- Build snap-bootstrap with nomanagers tag to decrease size by 1MB
- Interfaces: polkit | support custom polkit rules
- Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is
confined by AppArmor
- Interfaces: log-observe | add missing udev rule
- Interfaces: hostname-control | fix call to hostnamectl in core24
- Interfaces: network-control | allow removing created network
namespaces
- Interfaces: scsi-generic | re-enable base declaration for scsi-
generic plug
- Interfaces: u2f | add support for Arculus AuthentiKey
* Wed Apr 02 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.68.4
- Snap components: LP: #2104933 workaround for classic 24.04/24.10
models that incorrectly specify core22 instead of core24
- Update build dependencies
* Mon Mar 10 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.68.3
- FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to
old keyring path
- Fix Plucky snapd deb build issue related to /var/lib/snapd/void
permissions
- Fix snapd deb build complaint about ifneq with extra bracket
* Thu Feb 27 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.68.2
- FDE: use boot mode for FDE hooks
- FDE: add snap-bootstrap compatibility check to prevent image
creation with incompatible snapd and kernel snap
- FDE: add argon2 out-of-process KDF support
- FDE: have separate mutex for the sections writing a fresh modeenv
- FDE: LP: #2099709 update secboot to e07f4ae48e98
- Confdb: support pruning ephemeral data and process alternative
types in order
- core-initrd: look at env to mount directly to /sysroot
- core-initrd: prepare for Plucky build and split out 24.10
(Oracular)
- Fix missing primed packages in snapd snap manifest
- Interfaces: posix-mq | fix incorrect clobbering of global variable
and make interface more precise
- Interfaces: opengl | add more kernel fusion driver files
* Mon Feb 24 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.68.1
- Fix snap-confine type specifier type mismatch on armhf
* Thu Feb 13 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.68
- FDE: add support for new and more extensible key format that is
unified between TPM and FDE hook
- FDE: add support for adding passphrases during installation
- FDE: update secboot to 30317622bbbc
- Snap components: make kernel components available on firstboot
after either initramfs or ephemeral rootfs style install
- Snap components: mount drivers tree from initramfs so kernel
modules are available in early boot stages
- Snap components: support remodeling to models that contain
components
- Snap components: support offline remodeling to models that contain
components
- Snap components: support creating new recovery systems with
components
- Snap components: support downloading components with 'snap
download' command
- Snap components: support sideloading asserted components
- AppArmor Prompting(experimental): improve version checks and
handling of listener notification protocol for communication with
kernel AppArmor
- AppArmor Prompting(experimental): make prompt replies idempotent,
and have at most one rule for any given path pattern, with
potentially mixed outcomes and lifespans
- AppArmor Prompting(experimental): timeout unresolved prompts after
a period of client inactivity
- AppArmor Prompting(experimental): return an error if a patch
request to the API would result in a rule without any permissions
- AppArmor Prompting(experimental): warn if there is no prompting
client present but prompting is enabled, or if a prompting-related
error occurs during snapd startup
- AppArmor Prompting(experimental): do not log error when converting
empty permissions to AppArmor permissions
- Confdb(experimental): rename registries to confdbs (including API
/v2/registries => /v2/confdb)
- Confdb(experimental): support marking confdb schemas as ephemeral
- Confdb(experimental): add confdb-control assertion and feature
flag
- Refresh App Awareness(experimental): LP: #2089195 prevent
possibility of incorrect notification that snap will quit and
update
- Confidential VMs: snap-bootstrap support for loading partition
information from a manifest file for cloudimg-rootfs mode
- Confidential VMs: snap-bootstrap support for setting up cloudimg-
rootfs as an overlayfs with integrity protection
- dm-verity for essential snaps: add support for snap-integrity
assertion
- Interfaces: modify AppArmor template to allow owner read on
@{PROC}/@{pid}/fdinfo/*
- Interfaces: LP: #2072987 modify AppArmor template to allow using
setpriv to run daemon as non-root user
- Interfaces: add configfiles backend that ensures the state of
configuration files in the filesystem
- Interfaces: add ldconfig backend that exposes libraries coming
from snaps to either the rootfs or to other snaps
- Interfaces: LP: #1712808 LP: 1865503 disable udev backend when
inside a container
- Interfaces: add auditd-support interface that grants audit_control
capability and required paths for auditd to function
- Interfaces: add checkbox-support interface that allows
unrestricted access to all devices
- Interfaces: fwupd | allow access to dell bios recovery
- Interfaces: fwupd | allow access to shim and fallback shim
- Interfaces: mount-control | add mount option validator to detect
mount option conflicts early
- Interfaces: cpu-control | add read access to /sys/kernel/irq/
- Interfaces: locale-control | changed to be implicit on Ubuntu Core
Desktop
- Interfaces: microstack-support | support for utilizing of AMD SEV
capabilities
- Interfaces: u2f | added missing OneSpan device product IDs
- Interfaces: auditd-support | grant seccomp setpriority
- Interfaces: opengl interface | enable parsing of nvidia driver
information files
- Allow mksquashfs 'xattrs' when packing snap types os, core, base
and snapd as part of work to support non-root snap-confine
- Upstream/downstream packaging changes and build updates
- Improve error logs for malformed desktop files to also show which
desktop file is at fault
- Provide more precise error message when overriding channels with
grade during seed creation
- Expose 'snap prepare-image' validation parameter
- Add snap-seccomp 'dump' command that dumps the filter rules from a
compiled profile
- Add fallback release info location /etc/initrd-release
- Added core-initrd to snapd repo and fixed issues with ubuntu-core-
initramfs deb builds
- Remove stale robust-mount-namespace-updates experimental feature
flag
- Remove snapd-snap experimental feature (rejected) and it's feature
flag
- Changed snap-bootstrap to mount base directly on /sysroot
- Mount ubuntu-seed mounted as no-{suid,exec,dev}
- Mapping volumes to disks: add support for volume-assignments in
gadget
- Fix silently broken binaries produced by distro patchelf 0.14.3 by
using locally build patchelf 0.18
- Fix mismatch between listed refresh candidates and actual refresh
due to outdated validation sets
- Fix 'snap get' to produce compact listing for tty
- Fix missing store-url by keeping it as part of auxiliary store
info
- Fix snap-confine attempting to retrieve device cgroup setup inside
container where it is not available
- Fix 'snap set' and 'snap get' panic on empty strings with early
error checking
- Fix logger debug entries to show correct caller and file
information
- Fix issue preventing hybrid systems from being seeded on first
boot
- LP: #1966203 remove auto-import udev rules not required by deb
package to avoid unwanted syslog errors
- LP: #1886414 fix progress reporting when stdout is on a tty, but
stdin is not
* Wed Jan 22 2025 Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
- The changelog date and author have been modified to maintain linearity.
- Drop 0001-data-selinux-remove-timedatex.patch - applied upstream.
- New upstream release 2.67
- AppArmor prompting (experimental): allow overlapping rules
- Registry view (experimental): Changes to registry data (from both
users and snaps) can be validated and saved by custodian snaps
- Registry view (experimental): Support 'snapctl get --pristine' to
read the registry data excluding staged transaction changes
- Registry view (experimental): Put registry commands behind
experimental feature flag
- Components: Make modules shipped/created by kernel-modules
components available right after reboot
- Components: Add tab completion for local component files
- Components: Allow installing snaps and components from local files
jointly on the CLI
- Components: Allow 'snapctl model' command for gadget and kernel
snaps
- Components: Add 'snap components' command
- Components: Bug fixes
- eMMC gadget updates (WIP): add syntax support in gadget.yaml for
eMMC schema
- Support for ephemeral recovery mode on hybrid systems
- Support for dm-verity options in snap-bootstrap
- Support for overlayfs options and allow empty what argument for
tmpfs
- Enable ubuntu-image to determine the size of the disk image to
create
- Expose 'snap debug' commands 'validate-seed' and 'seeding'
- Add debug API option to use dedicated snap socket /run/snapd-
snap.socket
- Hide experimental features that are no longer required
(accepted/rejected)
- Mount ubuntu-save partition with no{exec,dev,suid} at install, run
and factory-reset
- Improve memory controller support with cgroup v2
- Support ssh socket activation configurations (used by ubuntu
22.10+)
- Fix generation of AppArmor profile with incorrect revision during
multi snap refresh
- Fix refresh app awareness related deadlock edge case
- Fix not caching delta updated snap download
- Fix passing non root uid, guid to initial tmpfs mount
- Fix ignoring snaps in try mode when amending
- Fix reloading of service activation units to avoid systemd errors
- Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS
updates PPA
- Make killing of snap apps best effort to avoid possibility of
malicious failure loop
- Alleviate impact of auto-refresh failure loop with progressive
delay
- Dropped timedatex in selinux-policy to avoid runtime issue
- Fix missing syscalls in seccomp profile
- Modify AppArmor template to allow using SNAP_REEXEC on arch
systems
- Modify AppArmor template to allow using vim.tiny (available in
base snaps)
- Modify AppArmor template to add read-access to debian_version
- Modify AppArmor template to allow owner to read
@{PROC}/@{pid}/sessionid
- {common,personal,system}-files interface: prohibit trailing @ in
filepaths
- {desktop,shutdown,system-observe,upower-observe} interface:
improve for Ubuntu Core Desktop
- custom-device interface: allow @ in custom-device filepaths
- desktop interface: improve launch entry and systray integration
with session
- desktop-legacy interface: allow DBus access to
com.canonical.dbusmenu
- fwupd interface: allow access to nvmem for thunderbolt plugin
- mpris interface: add plasmashell as label
- mount-control interface: add support for nfs mounts
- network-{control,manager} interface: add missing dbus link rules
- network-manager-observe interface: add getDevices methods
- opengl interface: add Kernel Fusion Driver access to opengl
- screen-inhibit-control interface: improve screen inhibit control
for use on core
- udisks2 interface: allow ping of the UDisks2 service
- u2f-devices interface: add Nitrokey Passkey
* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.66.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Jan 15 2025 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.67.1
- Fix apparmor permissions to allow snaps access to kernel modules
and firmware on UC24, which also fixes the kernel-modules-control
interface on UC24
- AppArmor prompting (experimental): disallow /./ and /../ in path
patterns
- Fix 'snap run' getent based user lookup in case of bad PATH
- Fix snapd using the incorrect AppArmor version during undo of an
refresh for regenerating snap profiles
- Add new syscalls to base templates
- hardware-observe interface: allow riscv_hwprobe syscall
- mount-observe interface: allow listmount and statmount syscalls
* Tue Dec 03 2024 Orion Poplawski <orion@nwra.com>
- Drop RestartMode from snapd.service on EL8 (rhbz#2315759)
* Fri Nov 29 2024 Zygmunt Krynicki <me@zygoon.pl>
- Re-cherry pick fix for SELinux timedatex problem from upstream
as it was not released in 2.66.1, sorry.
* Wed Nov 20 2024 Zygmunt Krynicki <me@zygoon.pl>
- Drop only patch, applied upstream.
* Fri Oct 25 2024 Zygmunt Krynicki <me@zygoon.pl>
- Cherry pick fix for SELinux timedatex problem from upstream
* Fri Oct 11 2024 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.66.1
- AppArmor prompting (experimental): Fix kernel prompting support
check
- Allow kernel snaps to have content slots
- Fix ignoring snaps in try mode when amending
* Fri Oct 04 2024 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.66
- AppArmor prompting (experimental): expand kernel support checks
- AppArmor prompting (experimental): consolidate error messages and
add error kinds
- AppArmor prompting (experimental): grant /v2/snaps/{name} via
snap-interfaces-requests-control
- AppArmor prompting (experimental): add checks for duplicate
pattern variants
- Registry views (experimental): add handlers that commit (and
cleanup) registry transactions
- Registry views (experimental): add a snapctl fail command for
rejecting registry transactions
- Registry views (experimental): allow custodian snaps to implement
registry hooks that modify and save registry data
- Registry views (experimental): run view-changed hooks only for
snaps plugging views affected by modified paths
- Registry views (experimental): make registry transactions
serialisable
- Snap components: handle refreshing components to revisions that
have been on the system before
- Snap components: enable creating Ubuntu Core images that contain
components
- Snap components: handle refreshing components independently of
snaps
- Snap components: handle removing components when refreshing a snap
that no longer defines them
- Snap components: extend snapd Ubuntu Core installation API to
allow for picking optional snaps and components to install
- Snap components: extend kernel.yaml with "dynamic-modules",
allowing kernel to define a location for kmods from component
hooks
- Snap components: renamed component type "test" to "standard"
- Desktop IDs: support installing desktop files with custom names
based on desktop-file-ids desktop interface plug attr
- Auto-install snapd on classic systems as prerequisite for any non-
essential snap install
- Support loading AppArmor profiles on WSL2 with non-default kernel
and securityfs mounted
- Debian/Fedora packaging updates
- Add snap debug command for investigating execution aspects of the
snap toolchain
- Improve snap pack error for easier parsing
- Add support for user services when refreshing snaps
- Add snap remove --terminate flag for terminating running snap
processes
- Support building FIPS complaint snapd deb and snap
- Fix to not use nss when looking up for users/groups from snapd
snap
- Fix ordering in which layout changes are saved
- Patch snapd snap dynamic linker to ignore LD_LIBRARY_PATH and
related variables
- Fix libexec dir for openSUSE Slowroll
- Fix handling of the shared snap directory for parallel installs
- Allow writing to /run/systemd/journal/dev-log by default
- Avoid state lock during snap removal to avoid delaying other snapd
operations
- Add nomad-support interface to enable running Hashicorp Nomad
- Add intel-qat interface
- u2f-devices interface: add u2f trustkey t120 product id and fx
series fido u2f devices
- desktop interface: improve integration with xdg-desktop-portal
- desktop interface: add desktop-file-ids plug attr to desktop
interface
- unity7 interface: support desktop-file-ids in desktop files rule
generation
- desktop-legacy interface: support desktop-file-ids in desktop
files rule generation
- desktop-legacy interface: grant access to gcin socket location
- login-session-observe interface: allow introspection
- custom-device interface: allow to explicitly identify matching
device in udev tagging block
- system-packages-doc interface: allow reading /usr/share/javascript
- modem-manager interface: add new format of WWAN ports
- pcscd interface: allow pcscd to read opensc.conf
- cpu-control interface: add IRQ affinity control to cpu_control
- opengl interface: add support for cuda workloads on Tegra iGPU in
opengl interface
* Thu Sep 12 2024 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.65.3
- Fix missing aux info from store on snap setup
* Fri Sep 06 2024 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.65.2
- Bump squashfuse from version 0.5.0 to 0.5.2 (used in snapd deb
only)
* Sat Aug 24 2024 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.65.1
- Support building snapd using base Core22 (Snapcraft 8.x)
- FIPS: support building FIPS complaint snapd variant that switches
to FIPS mode when the system boots with FIPS enabled
- AppArmor: update to latest 4.0.2 release
- AppArmor: enable using ABI 4.0 from host parser
- AppArmor: fix parser lookup
- AppArmor: support AppArmor snippet priorities
- AppArmor: allow reading cgroup memory.max file
- AppArmor: allow using snap-exec coming from the snapd snap when
starting a confined process with jailmode
- AppArmor prompting (experimental): add checks for prompting
support, include prompting status in system key, and restart snapd
if prompting flag changes
- AppArmor prompting (experimental): include prompt prefix in
AppArmor rules if prompting is supported and enabled
- AppArmor prompting (experimental): add common types, constraints,
and mappings from AppArmor permissions to abstract permissions
- AppArmor prompting (experimental): add path pattern parsing and
matching
- AppArmor prompting (experimental): add path pattern precedence
based on specificity
- AppArmor prompting (experimental): add packages to manage
outstanding request prompts and rules
- AppArmor prompting (experimental): add prompting API and notice
types, which require snap-interfaces-requests-control interface
- AppArmor prompting (experimental): feature flag can only be
enabled if prompting is supported, handler service connected, and
the service can be started
- Registry views (experimental): rename from aspects to registries
- Registry views (experimental): support reading registry views and
setting/unsetting registry data using snapctl
- Registry views (experimental): fetch and refresh registry
assertions as needed
- Registry views (experimental): restrict view paths from using a
number as first character and view names to storage path style
patterns
- Snap components: support installing snaps and components from
files at the same time (no REST API/CLI)
- Snap components: support downloading components related assertions
from the store
- Snap components: support installing components from the store
- Snap components: support removing components individually and
during snap removal
- Snap components: support kernel modules as components
- Snap components: support for component install, pre-refresh and
post-refresh hooks
- Snap components: initial support for building systems that contain
components
- Refresh app awareness (experimental): add data field for
/v2/changes REST API to allow associating each task with affected
snaps
- Refresh app awareness (experimental): use the app name from
.desktop file in notifications
- Refresh app awareness (experimental): give snap-refresh-observe
interface access to /v2/snaps/{name} endpoint
- Improve snap-confine compatibility with nvidia drivers
- Allow re-exec when SNAP_REEXEC is set for unlisted distros to
simplify testing
- Allow mixing revision and channel on snap install
- Generate GNU build ID for Go binaries
- Add missing etelpmoc.sh for shell completion
- Do not attempt to run snapd on classic when re-exec is disabled
- Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse
- Add snap debug API command to enable running raw queries
- Enable snap-confine snap mount directory detection
- Replace global seccomp filter with deny rules in standard seccomp
template
- Remove support for Ubuntu Core Launcher (superseded by snap-
confine)
- Support creating pending serial bound users after serial assertion
becomes available
- Support disabling cloud-init using kernel command-line
- In hybrid systems, apps can refresh without waiting for restarts
required by essential snaps
- Ship snap-debug-info.sh script used for system diagnostics
- Improve error messages when attempting to run non-existent snap
- Switch to -u UID:GID for strace-static
- Support enabling snapd logging with snap set system
debug.snapd.{log,log-level}
- Add options system.coredump.enable and system.coredump.maxuse to
support using systemd-coredump on Ubuntu Core
- Provide documentation URL for 'snap interface '
- Fix snapd riscv64 build
- Fix restarting activated services instead of their activator units
(i.e. sockets, timers)
- Fix potential unexpected auto-refresh of snap on managed schedule
- Fix potential segfault by guarding against kernel command-line
changes on classic system
- Fix proxy entries in /etc/environment with missing newline that
caused later manual entries to not be usable
- Fix offline remodelling by ignoring prerequisites that will
otherwise be downloaded from store
- Fix devmode seccomp deny regression that caused spamming the log
instead of actual denies
- Fix snap lock leak during refresh
- Fix not re-pinning validation sets that were already pinned when
enforcing new validation sets
- Fix handling of unexpected snapd runtime failure
- Fix /v2/notices REST API skipping notices with duplicate
timestamps
- Fix comparing systemd versions that may contain pre-release
suffixes
- Fix udev potentially starting before snap-device-helper is made
available
- Fix race in snap seed metadata loading
- Fix treating cloud-init exit status 2 as error
- Fix to prevent sending refresh complete notification if snap snap-
refresh-observe interface is connected
- Fix to queue snapctl service commands if run from the default-
configure hook to ensure they get up-to-date config values
- Fix stop service failure when the service is not actually running
anymore
- Fix parsing /proc/PID/mounts with spaces
- Add registry interface that provides snaps access to a particular
registry view
- Add snap-interfaces-requests-control interface to enable prompting
client snaps
- steam-support interface: remove all AppArmor and seccomp
restrictions to improve user experience
- opengl interface: improve compatibility with nvidia drivers
- home interface: autoconnect home on Ubuntu Core Desktop
- serial-port interface: support RPMsg tty
- display-control interface: allow changing LVDS backlight power and
brightness
- power-control interface: support for battery charging thesholds,
type/status and AC type/status
- cpu-control interface: allow CPU C-state control
- raw-usb interface: support RPi5 and Thinkpad x13s
- custom-device interface: allow device file locking
- lxd-support interface: allow LXD to self-manage its own cgroup
- network-manager interface: support MPTCP sockets
- network-control interface: allow plug/slot access to gnutls config
and systemd resolved cache flushing via D-Bus
- network-control interface: allow wpa_supplicant dbus api
- gpio-control interface: support gpiochip* devices
- polkit interface: fix "rw" mount option check
- u2f-devices interface: enable additional security keys
- desktop interface: enable kde theming support
* Fri Aug 23 2024 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.65
- Support building snapd using base Core22 (Snapcraft 8.x)
- FIPS: support building FIPS complaint snapd variant that switches
to FIPS mode when the system boots with FIPS enabled
- AppArmor: update to latest 4.0.2 release
- AppArmor: enable using ABI 4.0 from host parser
- AppArmor: fix parser lookup
- AppArmor: support AppArmor snippet priorities
- AppArmor: allow reading cgroup memory.max file
- AppArmor: allow using snap-exec coming from the snapd snap when
starting a confined process with jailmode
- AppArmor prompting (experimental): add checks for prompting
support, include prompting status in system key, and restart snapd
if prompting flag changes
- AppArmor prompting (experimental): include prompt prefix in
AppArmor rules if prompting is supported and enabled
- AppArmor prompting (experimental): add common types, constraints,
and mappings from AppArmor permissions to abstract permissions
- AppArmor prompting (experimental): add path pattern parsing and
matching
- AppArmor prompting (experimental): add path pattern precedence
based on specificity
- AppArmor prompting (experimental): add packages to manage
outstanding request prompts and rules
- AppArmor prompting (experimental): add prompting API and notice
types, which require snap-interfaces-requests-control interface
- AppArmor prompting (experimental): feature flag can only be
enabled if prompting is supported, handler service connected, and
the service can be started
- Registry views (experimental): rename from aspects to registries
- Registry views (experimental): support reading registry views and
setting/unsetting registry data using snapctl
- Registry views (experimental): fetch and refresh registry
assertions as needed
- Registry views (experimental): restrict view paths from using a
number as first character and view names to storage path style
patterns
- Snap components: support installing snaps and components from
files at the same time (no REST API/CLI)
- Snap components: support downloading components related assertions
from the store
- Snap components: support installing components from the store
- Snap components: support removing components individually and
during snap removal
- Snap components: support kernel modules as components
- Snap components: support for component install, pre-refresh and
post-refresh hooks
- Snap components: initial support for building systems that contain
components
- Refresh app awareness (experimental): add data field for
/v2/changes REST API to allow associating each task with affected
snaps
- Refresh app awareness (experimental): use the app name from
.desktop file in notifications
- Refresh app awareness (experimental): give snap-refresh-observe
interface access to /v2/snaps/{name} endpoint
- Improve snap-confine compatibility with nvidia drivers
- Allow re-exec when SNAP_REEXEC is set for unlisted distros to
simplify testing
- Allow mixing revision and channel on snap install
- Generate GNU build ID for Go binaries
- Add missing etelpmoc.sh for shell completion
- Do not attempt to run snapd on classic when re-exec is disabled
- Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse
- Add snap debug API command to enable running raw queries
- Enable snap-confine snap mount directory detection
- Replace global seccomp filter with deny rules in standard seccomp
template
- Remove support for Ubuntu Core Launcher (superseded by snap-
confine)
- Support creating pending serial bound users after serial assertion
becomes available
- Support disabling cloud-init using kernel command-line
- In hybrid systems, apps can refresh without waiting for restarts
required by essential snaps
- Ship snap-debug-info.sh script used for system diagnostics
- Improve error messages when attempting to run non-existent snap
- Switch to -u UID:GID for strace-static
- Support enabling snapd logging with snap set system
debug.snapd.{log,log-level}
- Add options system.coredump.enable and system.coredump.maxuse to
support using systemd-coredump on Ubuntu Core
- Provide documentation URL for 'snap interface '
- Fix restarting activated services instead of their activator units
(i.e. sockets, timers)
- Fix potential unexpected auto-refresh of snap on managed schedule
- Fix potential segfault by guarding against kernel command-line
changes on classic system
- Fix proxy entries in /etc/environment with missing newline that
caused later manual entries to not be usable
- Fix offline remodelling by ignoring prerequisites that will
otherwise be downloaded from store
- Fix devmode seccomp deny regression that caused spamming the log
instead of actual denies
- Fix snap lock leak during refresh
- Fix not re-pinning validation sets that were already pinned when
enforcing new validation sets
- Fix handling of unexpected snapd runtime failure
- Fix /v2/notices REST API skipping notices with duplicate
timestamps
- Fix comparing systemd versions that may contain pre-release
suffixes
- Fix udev potentially starting before snap-device-helper is made
available
- Fix race in snap seed metadata loading
- Fix treating cloud-init exit status 2 as error
- Fix to prevent sending refresh complete notification if snap snap-
refresh-observe interface is connected
- Fix to queue snapctl service commands if run from the default-
configure hook to ensure they get up-to-date config values
- Fix stop service failure when the service is not actually running
anymore
- Fix parsing /proc/PID/mounts with spaces
- Add registry interface that provides snaps access to a particular
registry view
- Add snap-interfaces-requests-control interface to enable prompting
client snaps
- steam-support interface: remove all AppArmor and seccomp
restrictions to improve user experience
- opengl interface: improve compatibility with nvidia drivers
- home interface: autoconnect home on Ubuntu Core Desktop
- serial-port interface: support RPMsg tty
- display-control interface: allow changing LVDS backlight power and
brightness
- power-control interface: support for battery charging thesholds,
type/status and AC type/status
- cpu-control interface: allow CPU C-state control
- raw-usb interface: support RPi5 and Thinkpad x13s
- custom-device interface: allow device file locking
- lxd-support interface: allow LXD to self-manage its own cgroup
- network-manager interface: support MPTCP sockets
- network-control interface: allow plug/slot access to gnutls config
and systemd resolved cache flushing via D-Bus
- network-control interface: allow wpa_supplicant dbus api
- gpio-control interface: support gpiochip* devices
- polkit interface: fix "rw" mount option check
- u2f-devices interface: enable additional security keys
- desktop interface: enable kde theming support
* Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 2.63-3
- convert license to SPDX
* Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 2.63-2
- convert license to SPDX
* Wed Jul 24 2024 Ernest Lotter <ernest.lotter@canonical.com>
- New upstream release 2.64
- Support building snapd using base Core22 (Snapcraft 8.x)
- FIPS: support building FIPS complaint snapd variant that switches
to FIPS mode when the system boots with FIPS enabled
- AppArmor: update to AppArmor 4.0.1
- AppArmor: support AppArmor snippet priorities
- AppArmor prompting: add checks for prompting support, include
prompting status in system key, and restart snapd if prompting
flag changes
- AppArmor prompting: include prompt prefix in AppArmor rules if
prompting is supported and enabled
- AppArmor prompting: add common types, constraints, and mappings
from AppArmor permissions to abstract permissions
- AppArmor prompting: add path pattern parsing and matching
- Registry views (experimental): rename from aspects to registries
- Registry views (experimental): support reading registry views
using snapctl
- Registry views (experimental): restrict view paths from using a
number as first character and view names to storage path style
patterns
- Snap components: support installing snaps and components from
files at the same time (no REST API/CLI)
- Snap components: support downloading components related assertions
from the store
- Snap components: support installing components from the store (no
REST API/CLI)
- Snap components: support removing components (REST API, no CLI)
- Snap components: started support for component hooks
- Snap components: support kernel modules as components
- Refresh app awareness (experimental): add data field for
/v2/changes REST API to allow associating each task with affected
snaps
- Refresh app awareness (experimental): use the app name from
.desktop file in notifications
- Refresh app awareness (experimental): give snap-refresh-observe
interface access to /v2/snaps/{name} endpoint
- Allow re-exec when SNAP_REEXEC is set for unlisted distros to
simplify testing
- Generate GNU build ID for Go binaries
- Add missing etelpmoc.sh for shell completion
- Do not attempt to run snapd on classic when re-exec is disabled
- Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse
- Add snap debug api command to enable running raw queries
- Enable snap-confine snap mount directory detection
- Replace global seccomp filter with deny rules in standard seccomp
template
- Remove support for Ubuntu Core Launcher (superseded by snap-
confine)
- Support creating pending serial bound users after serial assertion
becomes available
- Support disabling cloud-init using kernel command-line
- In hybrid systems, apps can refresh without waiting for restarts
required by essential snaps
- Ship snap-debug-info.sh script used for system diagnostics
- Improve error messages when attempting to run non-existent snap
- Switch to -u UID:GID for strace-static
- Support enabling snapd logging with snap set system
debug.snapd.{log,log-level}
- Fix restarting activated services instead of their activator units
(i.e. sockets, timers)
- Fix potential unexpected auto-refresh of snap on managed schedule
- Fix potential segfault by guarding against kernel command-line
changes on classic system
- Fix proxy entries in /etc/environment with missing newline that
caused later manual entries to not be usable
- Fix offline remodelling by ignoring prerequisites that will
otherwise be downloaded from store
- Fix devmode seccomp deny regression that caused spamming the log
instead of actual denies
- Fix snap lock leak during refresh
- Fix not re-pinning validation sets that were already pinned when
enforcing new validation sets
- Fix handling of unexpected snapd runtime failure
- Fix /v2/notices REST API skipping notices with duplicate
timestamps
- Fix comparing systemd versions that may contain pre-release
suffixes
- Fix udev potentially starting before snap-device-helper is made
available
- Fix race in snap seed metadata loading
- Fix treating cloud-init exit status 2 as error
- Fix to prevent sending refresh complete notification if snap snap-
refresh-observe interface is connected
- Fix to queue snapctl service commands if run from the default-
configure hook to ensure they get up-to-date config values
- Fix stop service failure when the service is not actually running
anymore
- Add registry interface that provides snaps access to a particular
registry view
- steam-support interface: relaxed AppArmor and seccomp restrictions
to improve user experience
- home interface: autoconnect home on Ubuntu Core Desktop
- serial-port interface: support RPMsg tty
- display-control interface: allow changing LVDS backlight power and
brightness
- power-control interface: support for battery charging thesholds,
type/status and AC type/status
- cpu-control interface: allow CPU C-state control
- raw-usb interface: support RPi5 and Thinkpad x13s
- custom-device interface: allow device file locking
- lxd-support interface: allow LXD to self-manage its own cgroup
- network-manager interface: support MPTCP sockets
- network-control interface: allow plug/slot access to gnutls config
and systemd resolved cache flushing via D-Bus
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.63-1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
