Dropping AppArmor Kernel Patches

craigtoyoracer

Excellent decision for the Team and Users. Too bad you still have 6 months to go. 🙂

the only good snap is, a Ginger or sweet pea.

BuzzPCSOS

Please excuse if this is a stupid question.
For users who don't use snap, is it reasonable to manually uninstall Snap and AppArmor now using Discover/Software Centre or CLI ?
Always concerned about breaking the install when it comes to removing stuff that Solus comes with.

alfisya

BuzzPCSOS I would wait until all migration phase has been worked out clearly. It is not like it is hindering my system in anyway.

stalebrim

How does this affect end user's security other than Snaps? I see no mention of switching to SELinux in the OP.

brent

stalebrim I see no mention of switching to SELinux in the OP.

SELinux is the one word I was hoping not to see in this discussion. I thought it was mediocre when I have used it, (fedora) and buggy. Good question to ask though.

craigtoyoracer

stalebrim It would not effect anything else. This is only about Snaps. Once gone, the Team will save time and effort, as Flatpak is a better option for users.

Snaps vs Flatpak reminds me of Beta vs VHS

ermo

stalebrim How does this affect end user's security other than Snaps? I see no mention of switching to SELinux in the OP.

The integrated kernel AppArmor support could potentially stay enabled, though I am not aware if this is currently the case. EDIT: It is still enabled.

Personally, I'd rather not have to deal with SELinux if I can avoid it.

ermo

stalebrim How does this affect end user's security other than Snaps? I see no mention of switching to SELinux in the OP.

AppArmor support is still enabled in the kernel; it's only the Ubuntu-specific patchset necessary for snap confinement that has been dropped from my reading of the situation.

JTCPingas

ermo I haven't come across any problems with SELinux, perse. But in Fedora I have to apply a workaround to whitelist L4D2 so that main menu music and other pieces of select music play properly in the game.

https://github.com/ValveSoftware/Source-1-Games/issues/2734#issuecomment-1363552623

stalebrim

ermo Thanks. This was the clarification I was looking for.

JTCPingas

I guess my question is what benefits does apparmor provide over selinux?

ermo

JTCPingas I guess my question is what benefits does apparmor provide over selinux?

... the most obvious answer I can think of is that "It's not SELinux".

EbonJaeger

Heya folks! We just made a new blog post about kernel AppArmor patches and Snap support. Check it out!

brent

EbonJaeger
"Not applying the patches means that we can generate ISO images on our own infrastructure. Right now, ISOs can only be generated on systems using the Solus kernel, due to our AppArmor hooks. This means that every week, someone on the team has to use their system to build all the images and then upload around 10GB of ISOs to the download server for our OpenCollective backers. The same goes for full Solus releases. By dropping the AppArmor patches, we can skip all of that and generate images on the server directly."

how liberating and time-saving, this is great news.

Teggs

I took the initial posts on this issue to mean that Solus was effectively downstream to Ubuntu, which seemed odd and a bit disturbing. I am glad that is no longer the case. Dependency aside, there are some things it can be worth carrying a large patch set for (I remember what Nautilus looked like with and without the Solus patches), but for Snaps... I guess the chosen answer was the same, actually: stop carrying the patch set and use a better alternative, when one exists.

zmaint

I'm sure this has already been answered and I most likely missed it.. When snap is removed, is the migration going to remove any apps that may be installed? Or is that something I need to do manually? I got most of my users migrated (friends and family) away from snaps ages ago, but curious if there's anything I need to do for cleanup prior?

brent

this did not got go un-noticed and was featured at the top of Jesse's weekly (bi-weekly) Linux News report of 7/15.

AlphaElwedritsch

Link please

brent

AlphaElwedritsch https://distrowatch.com/dwres.php?resource=showheadline&story=18410

Sebastian

I am not sure whether deinstallation of installed snaps will happen automatically.
But i kind of remind having read somewhere that there is a helper tool for this involved named unsnap. If I remember right this script or whatever it is aims to detect installed snaps, tries to find the flatpak alternative and offers to replace the snap with the flatpak.
At least, that is my understanding.
I further believe we have unsnap already in the repo.