From: Peter Michael Green Date: Sun, 26 Jul 2020 03:50:55 +0000 (+0000) Subject: Manual merge of version 2.44.1-2+rpi1 and 2.45.2-1 to produce 2.45.2-1+rpi1 X-Git-Tag: raspbian/2.45.2-1+rpi1 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=987c275c45819cf0963c7f86fe978e52fc868cba;p=snapd.git Manual merge of version 2.44.1-2+rpi1 and 2.45.2-1 to produce 2.45.2-1+rpi1 --- 61b0493b270c04372a2bee5ac98ae45250e6eca5 diff --cc debian/changelog index 601b54c9,999f51fe..aaaa1233 --- a/debian/changelog +++ b/debian/changelog @@@ -1,18 -1,463 +1,472 @@@ - snapd (2.44.1-2+rpi1) bullseye-staging; urgency=medium ++snapd (2.45.2-1+rpi1) bullseye-staging; urgency=medium + + [changes brought forward from 2.27.2-2+rpi1 by Peter Michael Green at Thu, 24 Aug 2017 17:53:18 +0000] + * Treat unknown derivatives the same as Debian. + * Disable testsuite. + * Fix clean target. + - -- Raspbian forward porter Mon, 13 Apr 2020 11:46:57 +0000 ++ -- Raspbian forward porter Sun, 26 Jul 2020 03:50:20 +0000 + - snapd (2.44.1-2) unstable; urgency=medium + snapd (2.45.2-1) unstable; urgency=high - * debian/not-installed: - - do not install usr/bin/snap-preseed on debian + * SECURITY UPDATE: sandbox escape vulnerability on snapctl xdg-open + implementation + - usersession/userd/launcher.go: remove XDG_DATA_DIRS environment + variable modification when calling the system xdg-open. Patch + thanks to James Henstridge + - packaging/ubuntu-16.04/snapd.postinst: ensure "snap userd" is + restarted. Patch thanks to Michael Vogt + - CVE-2020-11934 + * SECURITY UPDATE: arbitrary code execution vulnerability on core + devices with access to physical removable media + - devicestate: Disable/restrict cloud-init after seeding. + - CVE-2020-11933 - -- Michael Vogt Mon, 06 Apr 2020 08:27:11 +0200 + -- Michael Vogt Fri, 10 Jul 2020 20:06:29 +0200 + + snapd (2.45.1-1) unstable; urgency=medium + + * New upstream release, LP: #1875071 + - data/selinux: allow checking /var/cache/app-info + - cmd/snap-confine: add support for libc6-lse + - interfaces: miscellanious policy updates xlv + - snap-bootstrap: remove sealed key file on reinstall + - interfaces-ssh-keys: Support reading /etc/ssh/ssh_config.d/ + - gadget: make ext4 filesystems with or without metadata checksum + - interfaces/fwupd: allow bind mount to /boot on core + - tests: cherry-pick test fixes from master + - snap/squashfs: also symlink snap Install with uc20 seed snap dir + layout + - interfaces/serial-port: add NXP SC16IS7xx (ttySCX) to allowed + devices + - snap,many: mv Open to snapfile pkg to support add'l options to + Container methods + - interfaces/builtin/desktop: do not mount fonts cache on distros + with quirks + - devicestate, sysconfig: revert support for cloud.cfg.d/ in the + gadget + - data/completion, packaging: cherry-pick zsh completion + - state: log task errors in the journal too + - devicestate: do not report "ErrNoState" for seeded up + - interfaces/desktop: silence more /var/lib/snapd/desktop/icons + denials + - packaging/fedora: disable FIPS compliant crypto for static + binaries + - packaging: stop depending on python-docutils + + -- Michael Vogt Fri, 05 Jun 2020 15:13:49 +0200 + + snapd (2.45-1) unstable; urgency=medium + + * New upstream release, LP: #1875071 + - o/devicestate: support doing system action reboots from recover + mode + - vendor: update to latest secboot + - tests: not fail when boot dir cannot be determined + - configcore: only reload journald if systemd is new enough + - cmd/snap-bootstrap/initramfs-mounts: append uuid to ubuntu-data + when decrypting + - tests/lib/prepare.sh: delete patching of the initrd + - cmd/snap: coldplug auto-import assertions from all removable + devices + - cmd/snap: fix the order of positional parameters in help output + - c/snap-bootstrap: port mount state mocking to the new style on + master + - cmd/snap-bootstrap/initramfs-mounts: add sudoers to dirs to copy + as well + - o/devicestate,cmd/snap-bootstrap: seal to recover mode cmdline, + unlock in recover mode initramfs + - progress: tweak multibyte label unit test data + - gadget: fix fallback device lookup for 'mbr' type structures + - progress: fix progress bar with multibyte duration units + - many: use /run/mnt/data over /run/mnt/ubuntu-data for uc20 + - many: put the sealed keys in a directory on seed for tidiness + - cmd/snap-bootstrap: measure epoch and model before unlocking + encrypted data + - o/configstate: core config handler for persistent journal + - bootloader/uboot: use secondary ubootenv file boot.sel for uc20 + - packaging: add "$TAGS" to dh_auto_test for debian packaging + - tests: ensure $cache_dir is actually available + - secboot,cmd/snap-bootstrap: add model to pcr protection profile + - devicestate: do not use snap-boostrap in devicestate to install + - tests: fix a typo in nested.sh helper + - devicestate: add support for cloud.cfg.d config from the gadget + - cmd/snap-bootstrap: cleanups, naming tweaks + - testutil: add NewDBusTestConn + - snap-bootstrap: lock access to sealed keys + - overlord/devicestate: preserve the current model inside ubuntu- + boot + - interfaces/apparmor: use differently templated policy for non-core + bases + - seccomp: add get_tls, io_pg* and *time64/*64 variants for existing + syscalls + - cmd/snap-bootstrap/initramfs-mounts: mount ubuntu-seed first, + other misc changes + - o/snapstate: tweak "waiting for restart" message + - boot: store model model and grade information in modeenv + - interfaces/firewall-control: allow -legacy and -nft for core20 + - boot: enable makeBootable20RunMode for EnvRefExtractedKernel + bootloaders + - boot/bootstate20: add EnvRefExtractedKernelBootloader bootstate20 + implementation + - daemon: fix error message from `snap remove-user foo` on classic + - overlord: have a variant of Mock that can take a state.State + - tests: 16.04 and 18.04 now have mediating pulseaudio (again) + - seed: clearer errors for missing essential snapd or core snap + - cmd/snap-bootstrap/initramfs-mounts: support + EnvRefExtractedKernelBootloader's + - gadget, cmd/snap-bootstrap: MBR schema support + - image: improve/adjust DownloadSnap doc comment + - asserts: introduce ModelGrade.Code + - tests: ignore user-12345 slice and service + - image,seed/seedwriter: support redirect channel aka default + tracks + - bootloader: use binary.Read/Write + - tests: uc20 nested suite part II + - tests/boot: refactor to make it easier for new + bootloaderKernelState20 impl + - interfaces/openvswitch: support use of ovs-appctl + - snap-bootstrap: copy auth data from real ubuntu-data in recovery + mode + - snap-bootstrap: seal and unseal encryption key using tpm + - tests: disable special-home-can-run-classic-snaps due to jenkins + repo issue + - packaging: fix build on Centos8 to support BUILDTAGS + - boot/bootstate20: small changes to bootloaderKernelState20 + - cmd/snap: Implement a "snap routine file-access" command + - spread.yaml: switch back to latest/candidate for lxd snap + - boot/bootstate20: re-factor kernel methods to use new interface + for state + - spread.yaml,tests/many: use global env var for lxd channel + - boot/bootstate20: fix bug in try-kernel cleanup + - config: add system.store-certs.[a-zA-Z0-9] support + - secboot: key sealing also depends on secure boot enabled + - httputil: fix client timeout retry tests + - cmd/snap-update-ns: handle EBUSY when unlinking files + - cmd/snap/debug/boot-vars: add opts for setting dir and/or uc20 + vars + - secboot: add tpm support helpers + - tests/lib/assertions/developer1-pi-uc20.model: use 20/edge for + kernel and gadget + - cmd/snap-bootstrap: switch to a 64-byte key for unlocking + - tests: preserve size for centos images on spread.yaml + - github: partition the github action workflows + - run-checks: use consistent "Checking ..." style messages + - bootloader: add efi pkg for reading efi variables + - data/systemd: do not run snapd.system-shutdown if finalrd is + available + - overlord: update tests to work with latest go + - cmd/snap: do not hide debug boot-vars on core + - cmd/snap-bootstrap: no error when not input devices are found + - snap-bootstrap: fix partition numbering in create-partitions + - httputil/client_test.go: add two TLS version tests + - tests: ignore user@12345.service hierarchy + - bootloader, gadget, cmd/snap-bootstrap: misc cosmetic things + - tests: rewrite timeserver-control test + - tests: fix racy pulseaudio tests + - many: fix loading apparmor profiles on Ubuntu 20.04 with ZFS + - tests: update snap-preseed --reset logic to accommodate for 2.44 + change + - cmd/snap: don't wait for system key when stopping + - sandbox/cgroup: avoid making arrays we don't use + - osutil: mock proc/self/mountinfo properly everywhere + - selinux: export MockIsEnforcing; systemd: use in tests + - tests: add 32 bit machine to GH actions + - tests/session-tool: kill cron session, if any + - asserts: it should be possible to omit many snap-ids if allowed, + fix + - boot: cleanup more things, simplify code + - github: skip spread jobs when corresponding label is set + - dirs: don't depend on osutil anymore, mv apparmor vars to apparmor + pkg + - tests/session-tool: add session-tool --dump + - github: allow cached debian downloads to restore + - tests/session-tool: session ordering is non-deterministic + - tests: enable unit tests on debian-sid again + - github: move spread to self-hosted workers + - secboot: import secboot on ubuntu, provide dummy on !ubuntu + - overlord/devicestate: support for recover and run modes + - snap/naming: add validator for snap security tag + - interfaces: add case for rootWritableOverlay + NFS + - tests/main/uc20-create-partitions: tweaks, renames, switch to + 20.04 + - github: port CLA check to Github Actions + - interfaces/many: miscellaneous policy updates xliv + - configcore,tests: fix setting watchdog options on UC18/20 + - tests/session-tool: collect information about services on startup + - tests/main/uc20-snap-recovery: unbreak, rename to uc20-create- + partitions + - state: add state.CopyState() helper + - tests/session-tool: stop anacron.service in prepare + - interfaces: don't use the owner modifier for files shared via + document portal + - systemd: move the doc comments to the interface so they are + visible + - cmd/snap-recovery-chooser: tweaks + - interfaces/docker-support: add overlayfs file access + - packaging: use debian/not-installed to ignore snap-preseed + - travis.yml: disable unit tests on travis + - store: start splitting store.go and store_test.go into subtopic + files + - tests/session-tool: stop cron/anacron from meddling + - github: disable fail-fast as spread cannot be interrupted + - github: move static checks and spread over + - tests: skip "/etc/machine-id" in "writablepaths" test + - snap-bootstrap: store encrypted partition recovery key + - httputil: increase testRetryStrategy max timelimit to 5s + - tests/session-tool: kill leaking closing session + - interfaces: allow raw access to USB printers + - tests/session-tool: reset failed session-tool units + - httputil: increase httpclient timeout in + TestRetryRequestTimeoutHandling + - usersession: extend timerange in TestExitOnIdle + - client: increase timeout in client tests to 100ms + - many: disentagle release and snapdenv from sandbox/* + - boot: simplify modeenv mocking to always write a modeenv + - snap-bootstrap: expand data partition on install + - o/configstate: add backlight option for core config + - cmd/snap-recovery-chooser: add recovery chooser + - features: enable robust mount ns updates + - snap: improve TestWaitRecovers test + - sandbox/cgroup: add ProcessPathInTrackingCgroup + - interfaces/policy: fix comment in recent new test + - tests: make session tool way more robust + - interfaces/seccomp: allow passing an address to setgroups + - o/configcore: introduce core config handlers (3/N) + - interfaces: updates to login-session-observe, network-manager and + modem-manager interfaces + - interfaces/policy/policy_test.go: add more tests'allow- + installation: false' and we grant based on interface attributes + - packaging: detect/disable broken seed in the postinst + - cmd/snap-confine/mount-support-nvidia.c: add libnvoptix as nvidia + library + - tests: remove google-tpm backend from spread.yaml + - tests: install dependencies with apt using --no-install-recommends + - usersession/userd: add zoommtg url support + - snap-bootstrap: fix disk layout sanity check + - snap: add `snap debug state --is-seeded` helper + - devicestate: generate warning if seeding fails + - config, features: move and rename config.GetFeatureFlag helper to + features.Flag + - boot, overlord/devicestate, daemon: implement requesting boot + into a given recovery system + - xdgopenproxy: forward requests to the desktop portal + - many: support immediate reboot + - store: search v2 tweaks + - tests: fix cross build tests when installing dependencies + - daemon: make POST /v2/systems/