ELBA-2026-604105

ELBA-2026-604105 - snapd Bug Fix update

Type:	BUG
Impact:	NA
Release Date:	2026-10-01

Description

* Wed Sep 02 2026 Ernest Lotter
- New upstream release 2.77.1
- Fix undo of unlink-component after its snap revision was discarded
- interfaces: power-control | allow reading all battery state files

* Fri Jul 24 2026 Sergio Cazzolato
- New upstream release 2.77
- Account for differences in names of the binaries in the snapd FIPS
build
- Add code to calculate canonical subject name hash
- Add commands for debugging or accessing snap mount namespaces
- Add helpers for listing and iterating device mediation groups
- Add package ebpf with helpers wrapping eBPF exposed objects with
dependency on github.com/cilium/ebpf
- Add secondary prerequisites task that acts as the synchronization
point, which ensures that a snap's prerequisites are available
before it's installed
- Add support for shell conditional syntax in envs
- Added /usr/share/{man,help,info} to system-packages-doc
- asserts: add validation-sets confdb-schema builtin
- asserts: ensure that compatibility labels are strings
- asserts: extend on-classic constraints to accept 'distro/variant',
'distro/*', and 'distro/' under a new snap-declaration format 7
- asserts: validate serial in newDeviceIDFromString
- Bump github.com/canonical/go-efilib to v1.8.0 to include fixes for
efivars probe
- confdb: add validation-sets handler and fix data loss when writing
to new schemas or accounts
- confdb: fix bug on reading uneven lists
- confdb: literal subkeys are sorted after placeholders
- confdb: run observe-view-* hooks after commit
- confdb: support Encode/Decode for builtins
- confdb: support sign-only external keypair backends
- core-initrd: add missing libbpf and systemd dlopen dependencies,
and increase mount burst
- Drop task logs for delayed effects
- During snap removal, clear-snap task errors early if there are
user mounts in snap data dirs
- Enable reverts to trigger a seed refresh
- Ensure profiles are setup before running prepare-{slot, plug}*
hooks
- Ensure that prereqs created by initial refresh run before create-
recovery-system
- Exclude Georgian from translation linting
- experimental features: graduate layouts, classic-preserves-xdg-
runtime-dir, refresh-app-awareness, and dbus-activation features
- experimental features: warn when setting graduated or default-
enabled experimental features and do not store settings for
graduated features
- Expose individual certs as well as c_rehash emulation
- Extend autogen with explicit --sysconfdir
- External keypair manager: add shared external key manager
implementation
- External keypair manager: refactor GPG and external keypair
managers to use extKeypairMgrImpl
- External keypair manager: support external OPENPGP signing in
ExternalKeypairManager
- FDE: add post install actions API
- FDE: add reprovision API
- FDE: add reprovision recovery key generation API
- FDE: add reseal check after snapd refresh
- FDE: allow reprovision without factory reset
- FDE: change makebootable part of the boot package to not take
install observers as parameters
- FDE: extend storage-encrypted system information
- FDE: make reprovision only seal
- FDE: remove all tmp keyslots on error
- FDE: remove check for unchanged authentication options
- FDE: run post install checks during auto repair
- Filter seed-refresh based on model and seed presence
- Fix failing snap remove when there are snapctl created mounts
under snap global data dirs
- Fix postNotices to validate before locking state
- Guard the ensure check from running on classic
- Implement remodeling fully in terms of updates
- Implement ShutDown for HookManager
- Include variables SNAP_APP_NAME, and when applicable
SNAP_APP_COMMON_ID, SNAP_APP_DESKTOP_FILE and SNAP_APP_BUS_NAME in
snap application environments
- interfaces: add xdg-portal-permission-store interface
- interfaces: allow gtk css in subdirectories
- interfaces: allow systemd networkd link property changes via D-Bus
- interfaces: allow the systemd networkctl command
- interfaces: allow Wine to execute files accessed via the Document
Portal
- interfaces: apparmor-observe | add interface
- interfaces: attempt to fix content with parallel installs
- interfaces: devlxd | fix access for LXD containers
- interfaces: docker | allow connecting to system-wide docker on
classic
- interfaces: grant default access to memory.high in a snap's cgroup
- interfaces: iscsi-initiator | allow access to /var/lib/iscsi/nodes
- interfaces: kernel-sched-ext-control | add the kernel sched-ext
control interface implementation
- interfaces: make polkit and upower implicit on Core systems only
- interfaces: open-iscsi | add missing state paths
- interfaces: opengl | expose wsl libraries
- interfaces: u2f-devices | add atkey PID and relative VID support
- List dir contents on failure to remove snap base data dir
- List non-snapctl mounts in snap data dirs
- LP: #2072331 Validate map keys in JSON config values
- LP: #2110510 Interfaces: allow reading of /proc/self/smaps_rollup
- LP: #2143934 Interfaces: network-control, network-manager | allow
missing resolve1 link setters
- LP: #2160691 Security logging: strip trailing whitespace from
audit netlink message payload
- LP: #2161982 Interfaces: vsock | add interface for VM guest
services
- Make arguments of debug mount-namespace consistent with other
debug commands
- Make bootloader logging less verbose
- Make cert manager garbage check run after symlink migration
- Make secondary prerequisite synchronization task handle same-
change retries
- mkversion.sh: do describe in worktrees too
- multi-entry snapd: merge snap and snapd binaries
- multi-entry snapd: move debug device-cgroup implementation file
under cmd/snapd/cli
- multi-entry snapd: move snap-gpio-helper sources around before
transitioning to multi-entry dispatch
- multi-entry snapd: move snapd-apparmor sources to a dedicated tool
location
- multi-entry snapd: move source files around in preparation for
snapd/snap merge
- multi-entry snapd: move the snap-preseed sources around in
preparation
- multi-entry snapd: move the sources of snapctl and snap-exec in
preparation for the multi-entry dispatch
- Never create seed refresh tasks during a remodel
- packaging: assign a default label for /tmp/snap-private-tmp and
set it during installation
- packaging: build deb with Go 1.23 for noble and jammy, Go 1.22 for
focal
- packaging: drop SNAP_TAGS
- packaging: drop symlinks for opensuse 15.5/15.6 packaging
- packaging: fix service startup during install and session-agent
socket handling on Ubuntu 26.04+
- packaging: fix stderr redirection
- packaging: restore gbp.conf output directory for Ubuntu 26.04
builds
- packaging: switch to apparmor 5.x with 5 ABI
- packaging: update bundled AppArmor to 5.0.2 and accept the 5.0 ABI
when running as deb
- packaging: use a relative symlink for snapctl and update steam-
support udev rules
- Preserve component in hook security tags
- Prevent removal of seed-refresh snaps when seed-refresh is enabled
- Refactor base-declaration into 1st class builtin assertion
- Refactor how the is-originating-from-snap-command advisory check
works
- Refactor prerequisites task handler to enable proper seed-refresh
integration
- Reintroduce fdstore helpers
- remote device management: add task to validate request messages
- remote device management: apply management messages, queue
response messages, and improve sequencing and redelivery handling
- Remove osutil unused AtomicWriteFollow flag
- Remove xerrors dependency
- Reuse existing seed-refresh implementation for free during single-
path installation
- Rework how SnapSetup.SnapPath is used
- seccomp: allow rseq_slice_yield
- security logging: add seclog API for administrative actions and
token create/remove events
- security logging: add security logging for adding, updating and
removing a snapd user
- Set target hostname from install-mode
- snap-confine: improve loading of BPF programs, retry on failures
to collect verifier logs
- snap-confine: use profile and flags= in snap-confine and snap-
update-ns' AppArmor profiles
- snap-confine: work around kernel mnt_ns_loop() ordering bug on
6.18.x
- snap: add debug command for listing currently mediated devices for
a given snap
- snap: fix self-managed cgroup support checks
- snap: report hidden file access for paths allowed by home when
prompting is active
- snap: report read-only file access for paths allowed by system-
package-doc
- snapctl async support: add --format json to snap tasks to be
consistent with snapctl
- snapctl async support: add snapctl tasks command
- snapctl async support: async feature negotiation between snap
client and daemon
- snapctl async support: fix snapctl is-ready exit codes
- snapctl async support: re-enable snapctl async functionality
- snapshots: restore preserves snapctl created mounts
- snapshots: save excludes all mount points
- Support ca-certificate.crt only systems like core26
- Turn on quota-groups by default
- Use 0755 for certificate generation directories
- Use CreateTemp for NewAtomicFile tmp file creation
- Verify cached downloads in the do path and detect obvious
corruption

* Thu May 28 2026 Ernest Lotter
- New upstream release 2.76
- assertions: add helper for validating integrity data
- assertions: drop incorrect/non-standard Ed25519 support
- confdb: allow only API admin read access to confdb secrets
- confdb: block concurrent confdb accesses
- confdb: block concurrent snapctl accesses to configuration
database
- confdb: check for ephemeral data when missing save-view hook on
commit
- confdb: ignore not-found errors in confdb-schema refreshes
- confdb: support --wait-for timeouts when accessing confdb
- core-initrd: add group referenced in udev rules
- core-initrd: add libbpf dependency to initramfs
- core-initrd: add missing libbpf dependency in 24.04 packaging
- core-initrd: ensure audio is a system group
- core-initrd: fix /boot/uboot mount with u-boot env in dedicated
partition
- core-initrd: increase mount burst from 5 to 128 for faster boot
- core-initrd: sync partition udev rules with the ones in core-base
- core-initrd: sync with latest upload to snappy-dev PPA
- core-initrd: synchronize changelogs with latest PPA upload
- core-initrd: update changelog with latest PPA upload
- LP: #2150773 core-initrd: add nfnetlink module to fix nf netlink
socket speed regression (Ubuntu Core only)
- cross-distro: allow snapd to manipulate systemd unit files in
SELinux policy
- cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch
- desktop: fix common ID selection with multiple desktop plugs
- FDE: allow user mode on core in secboot TPM handling
- FDE: bump go-efilib dependency
- FDE: bump secboot to rev cdcb64992e54 for FDE fixes
- FDE: deprecate check-pin/passphrase API endpoints
- LP: #2147606 FDE: give inactive state on classic
- FDE: improve tracing for OP-TEE probing
- FDE: move auto-repair logic to overlord/fdestate and provide state
- FDE: update secboot for TPM/FDE bug fixes including Intel HAP and
recovery key parsing
- FDE: use any primary key matching digest when adding a keyslot
- FDE: use ignore action for preinstall check in VM
- interfaces: bluez | drop explicit deny send_destination in D-Bus
configuration
- interfaces: conditionally deny /proc/self/mountinfo to suppress Go
1.25+ denials
- interfaces: custom-device | fix for-device validation panic on
non-string value
- interfaces: disallow auto-connect to parallel installs
- interfaces: docker | make plug implicit on classic systems
- interfaces: ignore errors in disconnect hooks during explicit snap
disconnect
- interfaces: mediatek-accel | add plug interface base declaration
- interfaces: microceph-support | suppress noisy sudo denial audit
logs
- interfaces: podman | add new interface for podman socket access
- interfaces: pulseaudio | fix security tag syntax inconsistency
- interfaces: raw-usb | allow USB device enumeration on Fairphone 5
with NexDock
- interfaces: restore auto-connections on failed refresh undo
- LP: #2148544 interfaces: bool-file | support deep SoC sysfs paths
for LED brightness
- LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17
compliant
- packaging: add cross-distro build script and instructions
- packaging: add openSUSE 16.0 spread support
- packaging: Debian build improvements
- packaging: default openSUSE to /var/lib/snapd/snap and sync from
downstream
- packaging: drop transitional packages only for Ubuntu 26.04
(Resolute)
- packaging: fix Launchpad FIPS build detection for snapd-fips job
- packaging: refactor and clean up snapd.mk, standardize test-data
directories
- packaging: switch to golang-github-chai2010-gettext-go-dev
- packaging: update bundled AppArmor 4.1.7 (snapd snap only)
- prompting: escape paths in prompt constraints
- prompting: improve API error handling and validation
- prompting: improve error message when no handler service is
present
- prompting: re-enable the prompting notice backend
- prompting: respond with full user-allowed permission set
- prompting: validate permissions while unmarshalling
- remote device management: implement dispatch-mgmt-messages task
with sequencing support
- LP: #2125344 snap: avoid empty channel forwarding message
- LP: #2150683 snap: clarify snap install help text for --classic
and --devmode
- LP: #2152908 snap: print complex attributes in snap interface
--attrs output
- snap: add run-inhibit hint and inhibit info when a snap is
disabled
- snap: allow removing a snap and its base at the same time
- snap: display detailed component information in snap info
- snap: extend AlreadyInstalledError to multiple snaps and
components
- snap: extend set-quota command options description with accepted
value formats
- snap: implement snap delta command for computing snap deltas
- snap: improve consistency for snap install when some snaps are
already installed
- snap: show hint in snap list that a snap has components
- snap-confine: allow inheriting unix sockets from snaps
- snap-confine: allow linking to libm in AppArmor profile
- snap-confine: fix out-of-bounds read in mountinfo parser for
partial escape sequences
- snap-confine: harden bpffs mount with nosuid, nodev, noexec flags
- snap-confine: remove experimental persistent per-user mount
namespace feature
- snap-confine: set FD_CLOEXEC on file descriptors returned by BPF
helpers
- snap-confine: support transparent_hugepage in AppArmor profile
- snap-confine: use strchr after NUL-terminating in infofile parser
- snap-update-ns: switch to a multi-pass process for constructing
and updating mount namespaces
- RemoveMountUnitFile now unmounts even if mount unit file is
missing
- Add explicit mount phase during single-reboot refresh to fix undo
of kernel refreshes
- Add security audit logging subsystem
- Add base prioritized AppArmmor snippets for strictly confined or
jailed snaps
- Allow openshell snap to use experimental daemon-scope: user
- Allow configuring mount unit options based on filesystem type
- Allow equals signs in uevent values in netlink parser
- Also bind-mount directories modified by kmod backend during
preseed
- Clean up potentially corrupted files during snap download undo
- Complete the bootloader environment implementation
- Copy integrity data files during snap install
- Create hook for seed refresh mode
- Create removal tasks for old seed-refresh seeds
- Dispatch systemctl commands asynchronously when calling Stop()
- Ensure /tmp/.X11-unix created inside mount namespace has correct
permissions
- Ensure exclusive changes conflict with refresh/revert
- Ensure existing snap confinement flags are not dropped when
installing or removing components
- Export ubuntu-boot-state filename constant from bootloader package
- Fix duplicate removal of apps under /bin
- Fix integration between prerequisites task and seed-refresh mode
- Fix split-refresh overwriting provided lane
- Fix use of umask in GetListener for socket activation
- Ignore net.ErrClosed during daemon shutdown
- Implement ResolveValidationSetsEnforcementError in terms of one
call
- Improve snapctl install consistency when components are already
installed
- Inject seed creation tasks into snap refresh flow
- Introduce system options for custom certificates on Ubuntu Core
- Keep idle services with activation units stopped on reload
- List snap components in snap-debug-info via debug-tools
- Look at gadget.yaml instead of marker file to determine ubootpart
usage
- LP: #1966067 Skip redundant xdg-settings confirmation prompt when
setting is already correct
- LP: #2110368 Fix component installation for private snaps via
snapctl
- LP: #2110368 Fix download of private snap components by setting
UserID
- LP: #2144666 Fix mount namespace updates with synthetic bind
mounts on same target paths
- LP: #2146337 Improve handling of failed downloads and retain
partial files for resume
- LP: #2147207 Fix snap enable/disable cycle forgetting components
- Make run-inhibit hint for kill-snap-apps task based on kill reason
- Merge content-provider prerequisite updates into seed-refresh
- Move SortServices into Backend.StartServices
- Move state to client change conversion to ctlcmd package
- Omit misleading 'try to refresh snapd' suggestion for ISA-related
errors
- Only create link-component tasks when needed during refresh to
existing revision
- Reconfigure piboot bootloader on gadget refreshes to preserve
os_prefix
- Reduce the number of AppArmor profile regenerations during snap
operations
- Refactor seed-refresh ownership to devicestate
- Regenerate certificate database on remodels
- Remove obsolete FIXME comment in VersionCompare
- Remove unused GenerateDmVerityData helper from snap/integrity
- Rename and document error type for ISA assumes flags
- Restart snapd from daemon.Stop to improve restart reliability
- Restart stopped services on error in stopSnapServices for
transactionality
- Simplify certificate-db updates on model-base refresh/installs
- Support racing Loop and Stop correctly in overlord
- Support sending file descriptors to systemd via sd_notify
- Unroll CPU-heavy recursive function in snap state handlers
- Update seccomp syscalls list for kernel 7.1.0
- Use change ID to prevent nested seed-refresh spawned by
prerequisites
- Validate content interface plug target directories exist for
core26+ snaps
- Validate layout paths exist in snap tree for snaps using bare or
core26+

* Fri Apr 17 2026 Katie May
- New upstream release 2.75.2
See NEWS file for details.

[2.74.1-2]
- Add cap_setgid and cap_setuid to snap-confine to restore support for
cgroup-v1 systems.

[2.74.1-1]
- Fix missing cap_sys_resource on snap-confine

* Fri Mar 13 2026 Ernest Lotter
- New upstream release 2.74.1
- FDE: measure DeployedMode and AuditMode variables if they appear
as disabled in the event log to avoid a potential reseal-failure
boot loop
- LP: #2139611 FDE: fix db updates by allowing multiple payloads
- LP: #2139300 snap-confine: add CAP_SYS_RESOURCE to allow raising
memory lock limit when required
- LP: #2139099 snap-confine: bump the max element count of the BPF
map used to store IDs of allowed/matched devices to 1000
- Interfaces: Added pidfd_open and memfd_secret to seccomp template
- Interfaces: camera | add locking permission for /dev/video

[2.72-4]
- Default to vendored Go dependencies in Fedora

[2.72-3]
- Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26

[2.72-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	snapd-2.77.1-0.el8.src.rpm	a7607452ed3100b947d95dc56a820217f5c2b41604dd712df29fa02cd386b53d	-	ol8_aarch64_developer_EPEL
	snap-confine-2.77.1-0.el8.aarch64.rpm	6e89dfb398cc483a30a3f3bf1e1d2d524f284a4ca4f6e8a18949aaf7c611a1c7	-	ol8_aarch64_developer_EPEL
	snapd-2.77.1-0.el8.aarch64.rpm	000269049c5dc7aea325be941af24ac14d2a2fc6081e31dd44f7a822eff1e944	-	ol8_aarch64_developer_EPEL
	snapd-devel-2.77.1-0.el8.noarch.rpm	c4f5730fa994cdef146de084bb5caff4b1fd608d3ff183b7e9ce8d93ce13dc6f	-	ol8_aarch64_developer_EPEL
	snapd-selinux-2.77.1-0.el8.noarch.rpm	c165e422c3520647aa5bbf74a0912eaff07961fd745370a60ec96a3b1e2d26a7	-	ol8_aarch64_developer_EPEL
Oracle Linux 8 (x86_64)	snapd-2.77.1-0.el8.src.rpm	a7607452ed3100b947d95dc56a820217f5c2b41604dd712df29fa02cd386b53d	-	ol8_x86_64_developer_EPEL
	snap-confine-2.77.1-0.el8.x86_64.rpm	31323c8df7f0a58074ba978b22951f09ff81deaa25e0dc6005f53c8cee13ae4f	-	ol8_x86_64_developer_EPEL
	snapd-2.77.1-0.el8.x86_64.rpm	a6b0b905b31287ab9197636406f7d181febb6de9e5db7067b411b91b6834fdf4	-	ol8_x86_64_developer_EPEL
	snapd-devel-2.77.1-0.el8.noarch.rpm	c4f5730fa994cdef146de084bb5caff4b1fd608d3ff183b7e9ce8d93ce13dc6f	-	ol8_x86_64_developer_EPEL
	snapd-selinux-2.77.1-0.el8.noarch.rpm	c165e422c3520647aa5bbf74a0912eaff07961fd745370a60ec96a3b1e2d26a7	-	ol8_x86_64_developer_EPEL

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team