cmd/snap-confine: handle potential race when creating /tmp/snap-private-tmp #16367
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bboozzoo
added
the
Needs security review
bboozzoo
force-pushed
the
bboozzoo/snap-confine-race-private-tmp
branch
from
87e8e0c to
763ab4a
Compare
|
Mon Dec 15 12:21:34 UTC 2025 Failures:Preparing:
Executing:
Restoring:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses a race condition in snap-confine when multiple instances concurrently attempt to create the /tmp/snap-private-tmp directory. The fix changes the approach from failing immediately when observing non-conforming directory attributes to attempting to fix the ownership and permissions, which may be in an intermediate state due to the race.
Key Changes
- Refactored the single ownership/permission validation into separate checks for type, ownership, and mode
- Added defensive code to attempt fixing ownership and mode if they don't match expected values
- Enhanced comments to explain the race condition and the two-stage directory creation process in
sc_ensure_mkdir()
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…te-tmp When /tmp/snap-private-tmp does not exist, it will be created at runtime by snap-confine. Specifically, when more than one instance of snap-confine is active, both race to create the directory. Commit canonical@ba1b2ff changed the code to use sc_ensure_mkdir() helper. The helper, creates the directory with 0000 mode bits, and proceeds to update its ownership and mode to match what was requested. It is possible that when one instance of snap-confine is in the middle of creating the directory, another instance may observe an intermediate state in which either the ownership or permissions have not yet been updated. Instead of failing, let the other instance attempt to amend the ownership and permissions. Related: SNAPDENG-36092 Fixes: LP#2134364 Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
bboozzoo
force-pushed
the
bboozzoo/snap-confine-race-private-tmp
branch
from
763ab4a to
2f35623
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #16367 +/- ##
==========================================
- Coverage 77.48% 77.47% -0.01%
==========================================
Files 1339 1338 -1
Lines 182935 182929 -6
Branches 2438 2442 +4
==========================================
- Hits 141740 141732 -8
- Misses 32610 32611 +1
- Partials 8585 8586 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
jslarraz
approved these changes
Dec 15, 2025
Contributor
jslarraz
left a comment
jslarraz
left a comment
There was a problem hiding this comment.
LGTM considering that all instances will be racing toward the same final state, and no intermediate change makes the state to diverge from the target
bboozzoo
added
the
Auto rerun spread
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When /tmp/snap-private-tmp does not exist, it will be created at runtime by snap-confine. Specifically, when more than one instance of snap-confine is active, both race to create the directory. Commit
ba1b2ff changed the code to use sc_ensure_mkdir() helper. The helper, creates the directory with 0000 mode bits, and proceeds to update its ownership
and mode to match what was requested. It is possible that when one instance of snap-confine is in the middle of creating the directory, another instance may observe an intermediate state in which either the ownership or permissions have not yet been updated. Instead of failing, let the other instance attempt to amend the ownership and permissions.
Related: SNAPDENG-36092
Fixes: LP#2134364
Thanks for helping us make a better snapd!
Have you signed the license agreement and read the contribution guide?