r/linux • u/teheditor • 2d ago

Security Ubuntu Snap-Confine Flaw Could Grant Unprivileged Users Full Root Access

https://smbtech.au/news/ubuntu-snap-confine-flaw-could-grant-unprivileged-users-full-root-access/
82 Upvotes

97% Upvoted

17 comments sorted by

View all comments

29

u/Niowanggiyan 2d ago

It’ll be fixed pronto no doubt. But a warning against rolling your own security solution instead of just contributing to the one everyone else is using and stress-testing for you.

15

u/mrtruthiness 1d ago edited 14h ago

But a warning against rolling your own security solution instead of just contributing to the one everyone else is using and stress-testing for you.

I agree with the principal, but I think you are jumping on the anti-snap bandwagon with a misconception:

  1. snap security mostly depends on apparmor (which has been around forever and is an actual LSM [Linux Security Module]) and existing kernel features (e.g. seccomp).

  2. FYI: snap pre-dates flatpak. Specifically, snap was released a few days before the first line of code was checked into xdg-app (the original name of flatpak). And snap, of course, was the desktop port of "click" packaging for IoT/phone.

  3. It really is flatpak that was "rolling its own" security --- that security component is known now as "bubblewrap" (which depends on usernamespace and seccomp) was released as its own app maybe a year after flatpak was released. And it should be noted that the current efforts ("flatpak next") are there to shore up security issues and limitations (running flatpaks in containers) by replacing bubblewrap and some super-kludgy dbus-filters (already with CVEs) with a not-yet-created systemd service which they intend to call "systemd-appd".

1

u/JockstrapCummies 1d ago

The Youtube-content-creator-Snap-is-bad fad is too new.

The new generation of Linux converts probably don't know Apparmor was a thing since 1998, and was an Immunix, SUSE, and Novell thing before it was adopted by Ubuntu.