[ubuntu/noble-security] snapd 2.76+ubuntu24.04.1 (Accepted)
Eduardo Barretto
eduardo.barretto at canonical.com
Tue Jul 21 14:01:42 UTC 2026
snapd (2.76+ubuntu24.04.1) noble-security; urgency=medium
* SECURITY UPDATE: information disclosure
- interfaces/apparmor/template.go: don't grant access to systemd
userdb API sockets.
- CVE-2024-5300
* SECURITY UPDATE: Privilege escalation
- cmd/snap-confine: harden construction of bootstrap rootfs
- CVE-2026-8933
* SECURITY UPDATE: Privilege abuse
- interfaces/snap-confine: harden seccomp template
- CVE-2026-15226
snapd (2.76+ubuntu24.04) noble; urgency=medium
* New upstream release, LP: #2154498
- assertions: add helper for validating integrity data
- assertions: drop incorrect/non-standard Ed25519 support
- confdb: allow only API admin read access to confdb secrets
- confdb: block concurrent confdb accesses
- confdb: block concurrent snapctl accesses to configuration
database
- confdb: check for ephemeral data when missing save-view hook on
commit
- confdb: ignore not-found errors in confdb-schema refreshes
- confdb: support --wait-for timeouts when accessing confdb
- core-initrd: add group referenced in udev rules
- core-initrd: add libbpf dependency to initramfs
- core-initrd: add missing libbpf dependency in 24.04 packaging
- core-initrd: ensure audio is a system group
- core-initrd: fix /boot/uboot mount with u-boot env in dedicated
partition
- core-initrd: increase mount burst from 5 to 128 for faster boot
- core-initrd: sync partition udev rules with the ones in core-base
- core-initrd: sync with latest upload to snappy-dev PPA
- core-initrd: synchronize changelogs with latest PPA upload
- core-initrd: update changelog with latest PPA upload
- core-initrd: add nfnetlink module to fix nf netlink
socket speed regression (Ubuntu Core only)
- cross-distro: allow snapd to manipulate systemd unit files in
SELinux policy
- cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch
- desktop: fix common ID selection with multiple desktop plugs
- FDE: allow user mode on core in secboot TPM handling
- FDE: bump go-efilib dependency
- FDE: bump secboot to rev cdcb64992e54 for FDE fixes
- FDE: deprecate check-pin/passphrase API endpoints
- LP: #2147606 FDE: give inactive state on classic
- FDE: improve tracing for OP-TEE probing
- FDE: move auto-repair logic to overlord/fdestate and provide state
- FDE: update secboot for TPM/FDE bug fixes including Intel HAP and
recovery key parsing
- FDE: use any primary key matching digest when adding a keyslot
- FDE: use ignore action for preinstall check in VM
- interfaces: bluez | drop explicit deny send_destination in D-Bus
configuration
- interfaces: conditionally deny /proc/self/mountinfo to suppress Go
1.25+ denials
- interfaces: custom-device | fix for-device validation panic on
non-string value
- interfaces: disallow auto-connect to parallel installs
- interfaces: docker | make plug implicit on classic systems
- interfaces: ignore errors in disconnect hooks during explicit snap
disconnect
- interfaces: mediatek-accel | add plug interface base declaration
- interfaces: microceph-support | suppress noisy sudo denial audit
logs
- interfaces: podman | add new interface for podman socket access
- interfaces: pulseaudio | fix security tag syntax inconsistency
- interfaces: raw-usb | allow USB device enumeration on Fairphone 5
with NexDock
- interfaces: restore auto-connections on failed refresh undo
- interfaces: bool-file | support deep SoC sysfs paths
for LED brightness
- LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17
compliant
- packaging: add cross-distro build script and instructions
- packaging: add openSUSE 16.0 spread support
- packaging: Debian build improvements
- packaging: default openSUSE to /var/lib/snapd/snap and sync from
downstream
- packaging: fix Launchpad FIPS build detection for snapd-fips job
- packaging: refactor and clean up snapd.mk, standardize test-data
directories
- packaging: switch to golang-github-chai2010-gettext-go-dev
- packaging: update bundled AppArmor 4.1.7 (snapd snap only)
- prompting: escape paths in prompt constraints
- prompting: improve API error handling and validation
- prompting: improve error message when no handler service is
present
- prompting: re-enable the prompting notice backend
- prompting: respond with full user-allowed permission set
- prompting: validate permissions while unmarshalling
- remote device management: implement dispatch-mgmt-messages task
with sequencing support
- LP: #2125344 snap: avoid empty channel forwarding message
- snap: clarify snap install help text for --classic
and --devmode
- LP: #2152908 snap: print complex attributes in snap interface
--attrs output
- snap: add run-inhibit hint and inhibit info when a snap is
disabled
- snap: allow removing a snap and its base at the same time
- snap: display detailed component information in snap info
- snap: extend AlreadyInstalledError to multiple snaps and
components
- snap: extend set-quota command options description with accepted
value formats
- snap: implement snap delta command for computing snap deltas
- snap: improve consistency for snap install when some snaps are
already installed
- snap: show hint in snap list that a snap has components
- snap-confine: allow inheriting unix sockets from snaps
- snap-confine: allow linking to libm in AppArmor profile
- snap-confine: fix out-of-bounds read in mountinfo parser for
partial escape sequences
- snap-confine: harden bpffs mount with nosuid, nodev, noexec flags
- snap-confine: remove experimental persistent per-user mount
namespace feature
- snap-confine: set FD_CLOEXEC on file descriptors returned by BPF
helpers
- snap-confine: support transparent_hugepage in AppArmor profile
- snap-confine: use strchr after NUL-terminating in infofile parser
- snap-update-ns: switch to a multi-pass process for constructing
and updating mount namespaces
- RemoveMountUnitFile now unmounts even if mount unit file is
missing
- Add explicit mount phase during single-reboot refresh to fix undo
of kernel refreshes
- Add security audit logging subsystem
- Add base prioritized AppArmmor snippets for strictly confined or
jailed snaps
- Allow openshell snap to use experimental daemon-scope: user
- Allow configuring mount unit options based on filesystem type
- Allow equals signs in uevent values in netlink parser
- Also bind-mount directories modified by kmod backend during
preseed
- Clean up potentially corrupted files during snap download undo
- Complete the bootloader environment implementation
- Copy integrity data files during snap install
- Create hook for seed refresh mode
- Create removal tasks for old seed-refresh seeds
- Dispatch systemctl commands asynchronously when calling Stop()
- Ensure /tmp/.X11-unix created inside mount namespace has correct
permissions
- Ensure exclusive changes conflict with refresh/revert
- Ensure existing snap confinement flags are not dropped when
installing or removing components
- Export ubuntu-boot-state filename constant from bootloader package
- Fix duplicate removal of apps under $SNAP_MOUNT_DIR/bin
- Fix integration between prerequisites task and seed-refresh mode
- Fix split-refresh overwriting provided lane
- Fix use of umask in GetListener for socket activation
- Ignore net.ErrClosed during daemon shutdown
- Implement ResolveValidationSetsEnforcementError in terms of one
call
- Improve snapctl install consistency when components are already
installed
- Inject seed creation tasks into snap refresh flow
- Introduce system options for custom certificates on Ubuntu Core
- Keep idle services with activation units stopped on reload
- List snap components in snap-debug-info via debug-tools
- Look at gadget.yaml instead of marker file to determine ubootpart
usage
- LP: #1966067 Skip redundant xdg-settings confirmation prompt when
setting is already correct
- LP: #2110368 Fix component installation for private snaps via
snapctl
- LP: #2110368 Fix download of private snap components by setting
UserID
- LP: #2144666 Fix mount namespace updates with synthetic bind
mounts on same target paths
- LP: #2146337 Improve handling of failed downloads and retain
partial files for resume
- LP: #2147207 Fix snap enable/disable cycle forgetting components
- Make run-inhibit hint for kill-snap-apps task based on kill reason
- Merge content-provider prerequisite updates into seed-refresh
- Move SortServices into Backend.StartServices
- Move state to client change conversion to ctlcmd package
- Omit misleading "try to refresh snapd" suggestion for ISA-related
errors
- Only create link-component tasks when needed during refresh to
existing revision
- Reconfigure piboot bootloader on gadget refreshes to preserve
os_prefix
- Reduce the number of AppArmor profile regenerations during snap
operations
- Refactor seed-refresh ownership to devicestate
- Regenerate certificate database on remodels
- Remove obsolete FIXME comment in VersionCompare
- Remove unused GenerateDmVerityData helper from snap/integrity
- Rename and document error type for ISA assumes flags
- Restart snapd from daemon.Stop to improve restart reliability
- Restart stopped services on error in stopSnapServices for
transactionality
- Simplify certificate-db updates on model-base refresh/installs
- Support racing Loop and Stop correctly in overlord
- Support sending file descriptors to systemd via sd_notify
- Unroll CPU-heavy recursive function in snap state handlers
- Update seccomp syscalls list for kernel 7.1.0
- Use change ID to prevent nested seed-refresh spawned by
prerequisites
- Validate content interface plug target directories exist for
core26+ snaps
- Validate layout paths exist in snap tree for snaps using bare or
core26+
snapd (2.75.2+ubuntu24.04) noble; urgency=medium
* New upstream release, LP: #2143882
- Interfaces: network-setup-*| allow running python binaries from
the base on UC26+
- Cross-distro: modify SELinux policy to allow mounting on
/var/snap/<snap>/<rev>
- Fix potential task deadlock by considering all tasks in a lane
that might be waiting for a reboot when processing delayed
security backend effects
snapd (2.75.1) xenial; urgency=medium
* New upstream release, LP: #2143882
- FDE: limit number of boot check log entries
- Allow a logged in user to refresh private snaps during a refresh
with multiple snaps
- Use precise prune pattern for tmpfiles (CVE-2026-3888)
snapd (2.75) xenial; urgency=medium
* New upstream release, LP: #2143882
- FDE: run early boot check only once per boot
- FDE: update secboot to revision 77bc2457cc76
- FDE: add degraded state for status API
- FDE: prevent resealing tasks from running together
- FDE: enable using keyslot tokens to store protected keys for UC26+
- FDE: early commit kcmdline config transaction in update-gadget-
cmdline to mitigate possible race condition
- FDE: ensure extra snapd kcmdline fragments are applied
- FDE: remove old secboot activation API calls
- LP: #2142130 update apparmor parser to 4.1.7
- LP: #2137543 disable translations in formatted output for snapctl
services
- LP: #2142655 improve snap size reporting precision in snap info
output
- LP: #2139664 snap-confine: remove race condition triggered by hat
profile
- LP: #2139065 skip 70-snap.*.rules when building dracut initramfs
- LP: #2002697 error early on removal without purge if home is in
NFS mount
- LP: #2141461 Intefaces: allow snap-update-ns to read
/proc/pid/auxv
- LP: #2138268 Interfaces: kerberos-tickets| new interface allow
access to kerberos tickets stored in /tmp
- Interfaces: block-devices| allow Xen block devices
- Interfaces: u2f-devices| add Tokey 3 FIDO
- Interfaces: devlxd| new interface allowing acccess to LXD devlxd
socket and APIs
- Interfaces: browser-support| allow reading pressure stall info
information
- Interfaces: network-setup-control| allow additional netplan files
access
- Interfaces: desktop| allow access kvantum, lxqt, and gtk4
configuration files
- Interfaces: system-observe| allow fdinfo access for GPU monitoring
- Interfaces: ubuntu-pro-control| allow access to Ubuntu Advantage
client configuration
- Prompting: add API endpoint to ask whether application should have
access
- Prompting: add support for audio-record prompting via API endpoint
- Prompting: store snap name instead of apparmor label in requests
- Prompting: respond with 503 to API requests when prompting
subsystem is shutting down
- Prompting: generalize prompting subsystem to support requests from
outside AppArmor
- Confdb: unset data for missing paths in set request
- Confdb: return 400 for API requests with missing filter
constraints
- Confdb: return 400 for API requests with unmatched filter
constraints
- Confdb: support typed constraints in confdb filtering
- Confdb: fixed unmarshalling transaction with placeholder path in
deltas
- Confdb: refresh confdb-schema assertions during manual refresh
- Remote device management (experimental): add skeleton device
management manager
- Remote device management (experimental): add message exchange loop
- Components: add snap component command, include component summary
in snap info output
- Components: enforce validation sets when installing components
- Configuration: add system.motd configuration option to customize
message of the day (motd)
- packaging: remove dependencies libbrotli1, libfreetype6, and
libpng16-16 from snap
- snap-bootstrap: use libblkid for disk information to speed up boot
- snap-confine: improve data handling error
- snap-confine: use ld cache from the app base for core26+
- snap: add riscv ISA detection for snaps
- squashfs: reduce memory footprint of single file extraction
- Add experimental snap delta format
- Enable early download of seed snaps during refresh
- Enable parallel downloads of essential snaps during refresh
- Disallow removing components required by validation sets
- Make snap prepare-image fail on --validation=ignore if model has
enforced validation-sets
- Fix correctly handling interrupted snap downloads
- Fix handling of store throttling for refresh-app-awareness
monitored snaps
- Stop removed "endure" services on refresh
- Install by default from the initramfs for UC26+, removing the need
for a reboot after installation
- Keep minidebuginfo in snapd snap
- Make snap-specific systemd cgroup mandatory for snaps using core26
and later, improve messaging for failure scenarios
- Preserve stale connections of broken snaps
- Remove enforce-validation-sets need for network
- Opportunistic discarding of mount namespace when updating slot
providers
- Support for delaying updates of snap mount namespaces when
refreshing slot providers
- Use application CommonID as default source for desktop ID
snapd (2.74.1) xenial; urgency=medium
* New upstream release, LP: #2138629
- FDE: measure DeployedMode and AuditMode variables if they appear
as disabled in the event log to avoid a potential reseal-failure
boot loop
- LP: #2141328 FDE: reuse preinstall check context during install to
account for user-ignored errors
- LP: #2139611 FDE: fix db updates by allowing multiple payloads
- LP: #2139300 snap-confine: add CAP_SYS_RESOURCE to allow raising
memory lock limit when required
- LP: #2139099 snap-confine: bump the max element count of the BPF
map used to store IDs of allowed/matched devices to 1000
- LP: #2141607 Desktop: revert change that caused user daemons
declaring the desktop plug to implicitly depend on graphical-
session.target
- Interfaces: Added pidfd_open and memfd_secret to seccomp template
- Interfaces: camera | add locking permission for /dev/video
snapd (2.74) xenial; urgency=medium
* New upstream release, LP: #2138629
- FDE: use new activation API from secboot
- FDE: use activation API also with non keydata keys
- FDE: ignore internal recovery key expiration during install
- FDE: support adding/removing PINs post-installation
- FDE: support changing PINs post-installation
- FDE: support adding a recovery key post-installation
- FDE: provide activation status via new endpoint v2/system-
info/storage-encrypted
- FDE: support sealing and resealing using the preinstall check
result
- FDE: disable passphrase support during install
- FDE: add keyboard configuration helpers
- FDE: lazily inject keyboard layout configuration in kernel cmdline
- FDE: enable pin tries and limits PIN entry attempts to 3
- FDE: extend secureboot endpoint to accept DB, KEK, and PK
- FDE: simplify /v2/system-volumes keyslots handling by allowing
name-only entries, implicitly expanding to all system containers
- FDE: support extra non-system key slot names to support agents
such as Landscape to set dedicated recovery keys
- FDE: initialize fde state after device state
- FDE: use device node to find the storage container and keys
- FDE: provide user visible name for disk based on ID_MODEL
- FDE: update secboot in snapd with latest additions and fixes
- core-initrd: add systemd service for setting plymouth keyboard
layout and X11 keyboard layouts
- core-initrd: set plymouth cleartext toggle option
- core-initrd: fix plymouth missing font issue
- core-initrd: update dependency from libteec1 to libteec2
- core-initrd: add new dlopened libs
- LP: #2116949 Preseeding: add support for preseeding of hybrid
systems via the installer API$
- Preseeding: check whether a path is a mountpoint before remounting
- Confdb: support tagging paths as secret in storage schemas
- Confdb: support filtering on placeholder sub-keys
- Confdb: support filtering in API and confdbstate
- Confdb: support field filtering on reads
- Confdb: support "parameters" stanza and check filters against them
- Confdb: add support for '--with' contraints
- Confdb: parsing fixes and error handling improvements
- Assertions: restrict serials to new format in confdb-control
- Assertions: add verify signature function
- Remote device management: modify request-message assertion to
expose its time constraints for remote device management
- Remote device management: support polling of store messages
- Remote device management: add signing of response messages with
device key
- Prompting: enable notify protocol v5 and test prompt restoration
after snapd restart
- snap: change malformed '--channel=' warning to error
- snap: add 'snap report-issue' command to get the available contact
details for the specified snap
- snap: add 'snap version --verbose' flag to include information on
snap binaries origin
- snap: create the XDG_RUNTIME_DIR folder
- LP: #2068493 snap: add support for 'snap refresh --tracking'
- snapctl: add '--tracking' flag to 'snapctl refresh'
- Reexec: include the info filepath in the version compare debug log
- Reexec: add support for forcing reexec into and older snapd snap
by setting SNAP_REEXEC=force in the environment
- snap-confine: correct error message related to snap-confine group
policy validation
- snap-confine: ensure we only mount existing directories
- LP: #2134364 snap-confine: handle potential race when creating
/tmp/snap-private-tmp when lacking systemd-tmpfiles support
- snap-confine: filter plus characters from security tags
- Desktop: use desktop file IDs as desktop IDs
- Desktop: store the common ID in the desktop file
- Desktop: allow graphical daemons to show icons in the dock
- Desktop: change user daemons with desktop plug defined to depend
on graphical-session.target
- dm-verity for essential snaps: made change to prerequisite struct
- Cross-distro: modify SELinux profile to allow connecting to squid
proxy
- Cross-distro: add support for migrating snap mount directory
- Packaging: drop ubuntu-14.04 packaging
- Packaging: drop ubuntu-{14.04,16.04} transitional binary packages
- Packaging: remove desktop files and state lock file during snapd
purge
- Packaging: fix inhibition hint file being left behind on failed
unlink-current-snap
- Disallow timeouts < 1us in systemd units
- Add snap-store to the user-daemons support overrides
- Support for SuccessExitStatus= generation for systemd daemon
- Make standby output more verbose
- Add prepare-serial-request hook
- Try to discard snap mount namespaces when no processes are running
during snap updates
- Improve handling of snap downloads cache by introducing periodic
cleanup with more aggressive policy
- Interfaces: mediatek-accel | create new interface
- Interfaces: nvidia-video-driver-libs | create new interface
- Interfaces: *-driver-libs | accept component paths
- Interfaces: desktop-legacy, unity7 | remove workaround for slash
filtering in ibus address
- Interfaces: fwupd | allow writing reboot notification in /run
- Interfaces: add 'install' coreutil to base AppArmor template
- Interfaces: u2f-devices | add apparmor permissions to allow the
use of the libfido2 library in snaps
- Interfaces: u2f-devices | add support for Thetis security key
- Interfaces: add AppArmor workaround for mmap MAP_HUGETLB
- Interfaces: timeserver-control | manage per-link ntp settings via
systemd-networkd
Date: 2026-07-13 15:17:12.158219+00:00
Changed-By: Eduardo Barretto <eduardo.barretto at canonical.com>
https://launchpad.net/ubuntu/+source/snapd/2.76+ubuntu24.04.1
-------------- next part --------------
Sorry, changesfile not available.
More information about the noble-changes
mailing list