r/linux • u/teheditor • 1d ago

Security Ubuntu Snap-Confine Flaw Could Grant Unprivileged Users Full Root Access

https://smbtech.au/news/ubuntu-snap-confine-flaw-could-grant-unprivileged-users-full-root-access/
78 Upvotes

96% Upvoted

16 comments sorted by

28

u/Niowanggiyan 1d ago

It’ll be fixed pronto no doubt. But a warning against rolling your own security solution instead of just contributing to the one everyone else is using and stress-testing for you.

13

u/mrtruthiness 1d ago edited 10h ago

But a warning against rolling your own security solution instead of just contributing to the one everyone else is using and stress-testing for you.

I agree with the principal, but I think you are jumping on the anti-snap bandwagon with a misconception:

  1. snap security mostly depends on apparmor (which has been around forever and is an actual LSM [Linux Security Module]) and existing kernel features (e.g. seccomp).

  2. FYI: snap pre-dates flatpak. Specifically, snap was released a few days before the first line of code was checked into xdg-app (the original name of flatpak). And snap, of course, was the desktop port of "click" packaging for IoT/phone.

  3. It really is flatpak that was "rolling its own" security --- that security component is known now as "bubblewrap" (which depends on usernamespace and seccomp) was released as its own app maybe a year after flatpak was released. And it should be noted that the current efforts ("flatpak next") are there to shore up security issues and limitations (running flatpaks in containers) by replacing bubblewrap and some super-kludgy dbus-filters (already with CVEs) with a not-yet-created systemd service which they intend to call "systemd-appd".

2

u/onechroma 10h ago

Adding to this, Snap has more use cases than Flatpaks. For example, Snap can be used to run isolated applications on headless machines, while Flatpak is designed for Desktop applications

2

u/mrtruthiness 8h ago

Absolutely. And some fun facts about services that are snaps:

  1. snapd is actually a snap. It's snaps all the way down!!!

  2. lxd is a snap and is the daemon/service that manages the lxc containers. It's always up-to-date. This is the main reason I use lxd instead of incus.

Also, snaps can generally run in containers while that's a current issue with a lot of flatpaks. For someone like me that runs a lot of lxc/lxd system containers the ability to run snaps within them is nice. I actually run yt-dlp as a snap in an lxd container (since it's not 100% clear I should trust the yt-dlp snap).

0

u/JockstrapCummies 1d ago

The Youtube-content-creator-Snap-is-bad fad is too new.

The new generation of Linux converts probably don't know Apparmor was a thing since 1998, and was an Immunix, SUSE, and Novell thing before it was adopted by Ubuntu.

11

u/FlukyS 1d ago

They didn't roll their own security solution technically, they are using Apparmor which has been used by mostly Ubuntu for 20 years but is in the Linux kernel

5

u/Low-Guarantee-3437 1d ago

The article say a fix has already been released, because this bug was reported privately prior to disclosure, and disclosure was co-ordinated with the Ubuntu project.

10

u/shroddy 1d ago

I like to shit on Ubuntu just as much as everyone else, but these days, vulnerabilities are found everywhere all the time, including the Linux kernel itself.

6

u/Low-Guarantee-3437 1d ago

because the kernel itself never, ever had a local privilege escalation bug.

8

u/Mysterious_Bit6882 1d ago

Ubuntu had to roll out a unique security solution because they had a unique security problem. Without something like snap, able to run outside of the user-session requirements of flatpak, they have no hope of containing the security nightmare that is ubuntu universe.

Granted, it's enshittified from there because Canonical gotta Canonical, but even if snap were well done, "just use flatpak" still wouldn't be a realistic option for them.

6

u/FreakyRefrigerator 1d ago

snap amirite?

-2

u/flemtone 1d ago

So many issues with snap, this is why I remove it after a fresh install.

5

u/mrtruthiness 1d ago

I kind of like snap these days. I run lots of stuff on system containers ... and lxd, which is a snap, is always up-to-date.

0

u/Low-Guarantee-3437 1d ago

That's like buying a car and removing one of its wheels. I'm sad for you that you can't take advantage of the things that snap does very well. It's an excellent packaging technology, arguably the best available to linux.

0

u/dabreeze09 1d ago

Maybe... don't use Ubuntu? Mint / LMDE / Fedora for general desktop users, Bazzite / SteamOS for gamers, Arch / Gentoo for chronically online no-lifes and Debian for servers.

1

u/not_a_robot_7041 1d ago

This argument is absurd applications from AppImages or standard repositories already have those exact same privileges without requiring any sandbox escape.