core26 - coreutils symlink targets not covered by `defaultCoreRuntimeTemplateRules`

[fnordahl]

The core26 snap appears to make use of the GNU coreutils, Ubuntu Questing is moving to a default of the uutils re-implementation of coreutils in Rust, and as a side effect the GNU coreutils binaries are now behind a layer of symlinks.

The snapd defaultCoreRuntimeTemplateRules does not cover this:
https://github.com/canonical/snapd/blob/44ef02278af92d3961fe6d8cedf8a4533f5aa53d/interfaces/apparmor/template.go#L507-L676

and as a consequence binaries/scripts with a core26 base are currently not able to execute coreutils tools such as mkdir and readlink.

Log excerpt:

apparmor="DENIED" operation="exec" class="file" profile="snap.microovn.switch" name="/usr/bin/gnumkdir" pid=1328 comm="switch.start" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
apparmor="DENIED" operation="exec" class="file" profile="snap.microovn.switch" name="/usr/bin/gnumkdir" pid=1328 comm="switch.start" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
apparmor="DENIED" operation="exec" class="file" profile="snap.microovn.switch" name="/usr/bin/gnumkdir" pid=1391 comm="switch.start" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
apparmor="DENIED" operation="exec" class="file" profile="snap.microovn.switch" name="/usr/bin/gnumkdir" pid=1391 comm="switch.start" requested_mask="x" denied_mask="x" fsuid=0 ouid=0

apparmor="DENIED" operation="exec" class="file" profile="snap.microovn.ovn-ovsdb-server-nb" name="/usr/bin/gnureadlink" pid=1427 comm="ovn-ctl" requested_mask="x" denied_mask="x" fsuid=0 ouid=0
apparmor="DENIED" operation="exec" class="file" profile="snap.microovn.ovn-ovsdb-server-nb" name="/usr/bin/gnureadlink" pid=1427 comm="ovn-ctl" requested_mask="x" denied_mask="x" fsuid=0 ouid=0

# ls -l /snap/core26/current/bin/mkdir /snap/core26/current/bin/gnumkdir
-rwxr-xr-x 1 root root 68192 May  8 09:06 /snap/core26/current/bin/gnumkdir
lrwxrwxrwx 1 root root     8 Aug 26 11:28 /snap/core26/current/bin/mkdir -> gnumkdir

[bboozzoo]

PR in snapd: canonical/snapd#15966

[simondeziel]

canonical/snapd#16068 was obsoleted by canonical/snapd#16068 that is now merged so this issue is likely fixed.

[carlcsaposs-canonical]

It appears the issue was fixed for commands such as ls and mkdir but not for the install command. Opened a new issue to track the issue with the install command: #388

[bboozzoo]

It appears the issue was fixed for commands such as ls and mkdir but not for the install command. Opened a new issue to track the issue with the install command: #388

As I've commented in #388 (comment) so this requires a change in snapd as install has never been allowed as part of the default AppArmor template. I see that there's a PR to snapd canonical/snapd#16372 which if lands will be likely be part of 2.74 release which is likely to happen early 2026. In the meantime can you can either include install in your snap or use a different command, like cp.

[taurus-forever]

Thank you @bboozzoo for the fast reply!

We are happy to avoid using install, but for now it is a part of PostgreSQL common CLI helpers, e.g. pg_createcluster.