treewide: Ubuntu Touch enablement for graphics & Docker

cmd: Begin implementation of libhybris graphics driver support

snap-confine: Additional AppArmor rules for proper libhybris functionality in snap-confine

interfaces: Add libhybris AppArmor paths & udev rules to opengl

Tested working on the Pixel 3a (Android 9, Qualcomm).

snap-confine: Set up hybris environment variables if appropriate

Hybris needs the linker and EGL platform paths properly set up
to allow running graphical applications using Android drivers.

interfaces/opengl: Tag binder & hwbinder appropriately

Required to grant access to the respective devices in /dev.

cmd/snap-confine: Address review comments

- Use PATH_MAX
- Commonalize shared functions between NVIDIA & libhybris
- Unify and use SC_HYBRIS_PROPERTY_FILE appropriately

cmd/snap-confine: Only use one temp buffer for hybris sprintfs

interfaces/opengl: Allow AppArmor path for querying Qualcomm driver/gpu model

Newer Qualcomm devices (like the Fairphone 4) seem to have their userspace GL
libraries query the kernel-mode driver for the respective GPU model.

cmd/snap-confine: Unconditionally allow cgroup access to binder devices

binder and hwbinder are devices residing in their own filesystem.
In order to allow access to them they need to be unconditionally
allowed in the cgroup for libhybris drivers to work accordingly.

Note that binderfs is checked before binder in order to distinguish
between an Android 11+ and lower kernels since newer ones place
a compatibility symlink at the old and familiar path.

interfaces/builtin: Additionally allow loading Android's i18n APEX

As required by some devices, this allows loading i18n APEX into the process
in order to allow certain bionic libraries to work properly.

Additionally explain the use and necessity for libtls-padding inclusion.

interfaces/opengl: Reduce libhybris property context area access to read-only

The property area is set up by Halium, confined snaps might merely read it.

interfaces/opengl: Ensure hostfs path for libtls-padding.so on hybris

The confined snap can only load libs from directories prefixed with
/var/lib/snapd/hostfs, so ensure libtls-padding that resides there
is mappable into the process.

snap-confine: interfaces: Address review comments

- Cleanup and remove TLS-padding permit from AppArmor rules
- Only allow binder access on Halium/libhybris systems
- Die in case the Halium environment cannot be mounted into the target
- Restructure binder device mount operation to iterate through a list of
  allowed device paths

release: Add OnTouch as a variant of OnClassic

Ubuntu Touch is powered by a similar mechanism to Core for mounting writable paths,
though uses a classic filesystem layout and has other expected behavior from Core.

To enable Touch having more extensive Snap support just add another bool to determine
whether the running system is a Touch image based on a new VARIANT_ID called "touch".

This in turn will provide the basis for further Touch enablement like extrausers support.

overlord/snapstate: Enable extrausers support on Ubuntu Touch

Since Touch also has the group and user databases read-only, with the extrausers databases
being the exception, just enforce behavior to match that of Core where it works similarly.

cmd: hybris-support: Mount hybris rootfs in all cases

Mountpoints are created after the check is fulfillable.

cmd: Always allow libhybris support for release.OnTouch

The points cross here, needs OnTouch in a way to distinguish
needs for libhybris-based devices, and enable them appropriately.

cmd: snap-exec: libhybris detection based on SC_EXTRA_LIB setup

Set the environment variables required to handle libhybris in a
confined environment, with libhybris bionic linker and EGL_PLATFORM
implementations available through environment variables.

Defaults to wayland for libhybris' libEGL. libgbm support should stay
untouched with these variables setting up the linker paths).

Tested on Halium-enabled Pixel 3a using Halium (Ubuntu Touch 20.04).

Tested Snaps:
- Tide IDE (classic Snap running with libhybris on the host)
- Gnome Mahjongg (with GDK_DEBUG=gl-disable)
- QML Creator (with Wayland QPA)
- Yamagi Quake 2 (with SDL & GLES Renderer)

interfaces: docker_support: Make it work on Ubuntu Touch

For reasons currently unknown Ubuntu Touch port kernels do not work with the
set of rules generated by default.

Due to not following the requirement of "devmode snaps running other snaps",
just check whether it is running OnTouch and avoid filling out the template.

interfaces/builtin: Include missing release package in opengl

interfaces/builtin: Only set up Android udev tags OnTouch

These are giving a lot of permissions to binder and friends, which may
not be appropriate for other targets running snapd. So just conditionally
enable it when release.OnTouch is set.

release: Allow mocking OnTouch environment

For future use.

release: Fix up MockOnTouch comment

daemon, overlord: Enable release.OnTouch in more places

Sets up Ubuntu Touch to handle users in a way similar to Core & Core Desktop.

cmd/snap-confine: Remove pass-through of host libraries into Snap environment on hybris

Also call mount function again, and clean up.

cmd/snap-confine: mount-support-hybris: Update Copyright year

interfaces: Fix missing change_profiles required for Docker

These were missing due to us skipping the AAREExclusionPattern processing.
Add regular change_profile directives when running on Ubuntu Touch.

Author: fredldotme

cmd/Makefile.am

@@ -269,6 +269,8 @@ snap_confine_snap_confine_SOURCES = \
 	snap-confine/cookie-support.h \
 	snap-confine/mount-support-nvidia.c \
 	snap-confine/mount-support-nvidia.h \
+	snap-confine/mount-support-hybris.c \
+	snap-confine/mount-support-hybris.h \
 	snap-confine/mount-support.c \
 	snap-confine/mount-support.h \
 	snap-confine/ns-support.c \

cmd/snap-confine/mount-support-hybris.c

@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2025 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "config.h"
+#include "mount-support-hybris.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <glob.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <stdint.h>
+#include <unistd.h>
+/* POSIX version of basename() and dirname() */
+#include <libgen.h>
+
+#include "../libsnap-confine-private/classic.h"
+#include "../libsnap-confine-private/cleanup-funcs.h"
+#include "../libsnap-confine-private/string-utils.h"
+#include "../libsnap-confine-private/utils.h"
+#include "mount-support.h"
+
+#define SC_LIBGL_DIR   SC_EXTRA_LIB_DIR "/gl"
+#define SC_VULKAN_DIR  SC_EXTRA_LIB_DIR "/vulkan"
+#define SC_GLVND_DIR  SC_EXTRA_LIB_DIR "/glvnd"
+
+#define SC_HYBRIS_ROOTFS "/android"
+#define SC_HYBRIS_SYSTEM_SYMLINK "/system"
+#define SC_HYBRIS_VENDOR_SYMLINK "/vendor"
+#define SC_HYBRIS_ODM_SYMLINK "/odm"
+#define SC_HYBRIS_APEX_SYMLINK "/apex"
+#define SC_HYBRIS_SYSTEM_SYMLINK_TARGET "/android/system"
+#define SC_HYBRIS_VENDOR_SYMLINK_TARGET "/android/vendor"
+#define SC_HYBRIS_ODM_SYMLINK_TARGET "/android/odm"
+#define SC_HYBRIS_APEX_SYMLINK_TARGET "/android/apex"
+
+static void sc_hybris_mount_android_rootfs(const char *rootfs_dir)
+{
+	// Bind mount a tmpfs on $rootfs_dir/$tgt_dir (i.e. /var/lib/snapd/lib/gl)
+	char path_buf[PATH_MAX] = { 0 };
+	sc_must_snprintf(path_buf, sizeof(path_buf), "%s%s", rootfs_dir, SC_HYBRIS_ROOTFS);
+	const char *android_rootfs_dir = path_buf;
+
+	int res = mkdir(android_rootfs_dir, 0755);
+	if (res != 0 && errno != EEXIST) {
+		die("cannot create bind-mount target %s", android_rootfs_dir);
+	}
+	if (res == 0 && (chown(android_rootfs_dir, 0, 0) < 0)) {
+		// Adjust the ownership only if we created the directory.
+		die("cannot change ownership of %s", android_rootfs_dir);
+	}
+
+	if (mount(SC_HYBRIS_ROOTFS, android_rootfs_dir, NULL, MS_BIND | MS_REC | MS_RDONLY, NULL)) {
+		die("Cannot mount Halium environment into target");
+	}
+
+	sc_must_snprintf(path_buf, sizeof(path_buf), "%s%s", rootfs_dir, SC_HYBRIS_SYSTEM_SYMLINK);
+	const char *android_system_symlink = path_buf;
+	if (symlink(SC_HYBRIS_SYSTEM_SYMLINK_TARGET, android_system_symlink)) {
+		die("Cannot set symlink for %s", SC_HYBRIS_SYSTEM_SYMLINK);
+	}
+
+	sc_must_snprintf(path_buf, sizeof(path_buf), "%s%s", rootfs_dir, SC_HYBRIS_VENDOR_SYMLINK);
+	const char *android_vendor_symlink = path_buf;
+	if (symlink(SC_HYBRIS_VENDOR_SYMLINK_TARGET, android_vendor_symlink)) {
+		die("Cannot set symlink for %s", SC_HYBRIS_VENDOR_SYMLINK);
+	}
+
+	sc_must_snprintf(path_buf, sizeof(path_buf), "%s%s", rootfs_dir, SC_HYBRIS_ODM_SYMLINK);
+	const char *android_odm_symlink = path_buf;
+	if (symlink(SC_HYBRIS_ODM_SYMLINK_TARGET, android_odm_symlink)) {
+		die("Cannot set symlink for %s", SC_HYBRIS_ODM_SYMLINK);
+	}
+
+	sc_must_snprintf(path_buf, sizeof(path_buf), "%s%s", rootfs_dir, SC_HYBRIS_APEX_SYMLINK);
+	const char *android_apex_symlink = path_buf;
+	if (symlink(SC_HYBRIS_APEX_SYMLINK_TARGET, android_apex_symlink)) {
+		die("Cannot set symlink for %s", SC_HYBRIS_APEX_SYMLINK);
+	}
+}
+
+void sc_mount_hybris_driver(const char *rootfs_dir, const char *base_snap_name)
+{
+	int res = sc_nonfatal_mkpath(SC_EXTRA_LIB_DIR, 0755, 0, 0);
+	if (res != 0) {
+		die("cannot create " SC_EXTRA_LIB_DIR);
+	}
+	if (res == 0 && (chown(SC_EXTRA_LIB_DIR, 0, 0) < 0)) {
+		// Adjust the ownership only if we created the directory.
+		die("cannot change ownership of " SC_EXTRA_LIB_DIR);
+	}
+
+	sc_hybris_mount_android_rootfs(rootfs_dir);
+}

cmd/snap-confine/mount-support-hybris.h

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2025 Canonical Ltd
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 3 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#ifndef SNAP_CONFINE_MOUNT_SUPPORT_HYBRIS_H
+#define SNAP_CONFINE_MOUNT_SUPPORT_HYBRIS_H
+
+/**
+ * Make the libhybris drivers from the classic distribution available in the snap
+ * execution environment.
+ *
+ * libhybris allows for ABI guarantees as long as their wrappers can be linked or
+ * dlopen()'ed because it is the library loader, it resolves the symbols and links them.
+ * /android needs to live inside the Snap environment too for the actual bionic-built
+ * libraries to be found, loaded and their functions executed.
+ *
+ * /android and the respective compatibility symlinks from /system to /android/system
+ * etc. allow for loading the appropriate userspace components for proper use
+ * (assuming AppArmor plays along).
+ **/
+void sc_mount_hybris_driver(const char *rootfs_dir, const char *base_snap_name);
+
+#endif

cmd/snap-confine/mount-support-test.c

@@ -18,6 +18,8 @@
 #include "mount-support.h"
 #include "mount-support-nvidia.c"
 #include "mount-support-nvidia.h"
+#include "mount-support-hybris.c"
+#include "mount-support-hybris.h"
 #include "mount-support.c"
 
 #include <glib.h>

cmd/snap-confine/mount-support.c

@@ -49,6 +49,7 @@
 #include "../libsnap-confine-private/tool.h"
 #include "../libsnap-confine-private/utils.h"
 #include "mount-support-nvidia.h"
+#include "mount-support-hybris.h"
 
 #define MAX_BUF 1000
 #define SNAP_PRIVATE_TMP_ROOT_DIR "/tmp/snap-private-tmp"
@@ -753,6 +754,7 @@ static void sc_bootstrap_mount_namespace(const struct sc_mount_config *config) {
     // pre-pivot filesystem.
     if (config->distro == SC_DISTRO_CLASSIC) {
         sc_mount_nvidia_driver(scratch_dir, config->base_snap_name);
+        sc_mount_hybris_driver(scratch_dir, config->base_snap_name);
     }
     // XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
     //                    pivot_root

cmd/snap-confine/snap-confine.apparmor.in

@@ -265,6 +265,9 @@
     mount options=(rw rbind) /mnt/ -> /tmp/snap.rootfs_*/mnt/,
     mount options=(rw rslave) -> /tmp/snap.rootfs_*/mnt/,
 
+    mount options=(ro rbind) /android/ -> /tmp/snap.rootfs_*/android/,
+    mount options=(ro rslave) -> /tmp/snap.rootfs_*/android/,
+
     # allow making host snap-exec available inside base snaps
     mount options=(rw bind) @LIBEXECDIR@/ -> /tmp/snap.rootfs_*/usr/lib/snapd/,
     mount options=(rw slave) -> /tmp/snap.rootfs_*/usr/lib/snapd/,

cmd/snap-confine/udev-support.c

@@ -107,6 +107,35 @@ static void sc_udev_allow_nvidia(sc_device_cgroup *cgroup) {
     }
 }
 
+/** Allow access to hybris devices.
+ *
+ * Required by Halium-based GNU/Linux adaptations to make use of certain device nodes.
+ *
+ * Note: Binder devices on newer Android kernels reside inside of their own binderfs mountpount.
+ **/
+static void sc_udev_allow_hybris(sc_device_cgroup *cgroup)
+{
+    /* Only go on here if this has been identified as a Halium/libhybris system
+     *
+     * In case the host happens to have binder available, but isn't identified as
+     * a system requiring it to drive host-residing Android drivers, then return early,
+     * otherwise we would open a hole between confined apps and unconfined Anbox or other
+     * which causes them to communicate over a potentially unmediated IPC interface.
+     */
+    struct stat propbuf;
+    if (stat("/system/build.prop", &propbuf) != 0) {
+        return;
+    }
+
+    const char *paths[] = {"/dev/binderfs/binder", "/dev/binderfs/hwbinder", "/dev/binder", "/dev/hwbinder"};
+    for (long unsigned int i = 0; i < sizeof(paths)/sizeof(paths[0]); i++) {
+        struct stat sbuf;
+        if (stat(paths[i], &sbuf) == 0) {
+            sc_device_cgroup_allow(cgroup, S_IFCHR, major(sbuf.st_rdev), minor(sbuf.st_rdev));
+        }
+    }
+}
+
 /**
  * Allow access to /dev/uhid.
  *
@@ -182,6 +211,7 @@ static void sc_udev_setup_acls_common(sc_device_cgroup *cgroup) {
     sc_udev_allow_common(cgroup);
     sc_udev_allow_pty_slaves(cgroup);
     sc_udev_allow_nvidia(cgroup);
+    sc_udev_allow_hybris(cgroup);
     sc_udev_allow_uhid(cgroup);
     sc_udev_allow_dev_net_tun(cgroup);
 }

daemon/api_users.go

@@ -202,7 +202,7 @@ func logoutUser(c *Command, r *http.Request, user *auth.UserState) Response {
 }
 
 // this might need to become a function, if having user admin becomes a config option
-var hasUserAdmin = !release.OnClassic
+var hasUserAdmin = !release.OnClassic || release.OnTouch
 
 const noUserAdmin = "system user administration via snapd is not allowed on this system"
 

interfaces/builtin/docker_support.go

@@ -723,6 +723,24 @@ ptrace (read, trace) peer=unconfined,
 ###EXCL{<> rwlix,:/snap/snapd/*/usr/lib/snapd/snap-confine,/snap/core/*/usr/lib/snapd/snap-confine}###
 `
 
+const dockerSupportConnectedPlugAppArmorTouch = `
+# Description: allow docker daemon to change profile
+
+# OnTouch doesn't use AAREExclusionPatterns due to parser/kernel bugs,
+# so allow accesses and change_profile the regular way.
+/** rwlix,
+change_profile unsafe /** -> docker-default,
+change_profile unsafe /** -> cri-containerd.apparmor.d,
+`
+
+const dockerSupportPrivilegedAppArmorTouch = `
+# Description: allow docker daemon to run privileged
+
+# OnTouch doesn't use AAREExclusionPatterns due to parser/kernel bugs,
+# so allow change_profile the regular way.
+change_profile unsafe /**,
+`
+
 const dockerSupportPrivilegedSecComp = `
 # Description: allow docker daemon to run privileged containers. This gives
 # full access to all resources on the system and thus gives device ownership to
@@ -762,71 +780,82 @@ func (iface *dockerSupportInterface) AppArmorConnectedPlug(spec *apparmor.Specif
 	// snaps.
 	spec.SetSuppressPycacheDeny()
 
-	defaultSnippet, err := apparmor_sandbox.InsertAAREExclusionPatterns(
-		dockerSupportConnectedPlugAppArmor,
-		[]string{
-			"/snap/snapd/*/usr/lib/snapd/snap-confine",
-			"/snap/core/*/usr/lib/snapd/snap-confine",
-		},
-		&apparmor_sandbox.AAREExclusionPatternsOptions{
-			Prefix: "change_profile unsafe ",
-			Suffix: " -> docker-default,",
-		},
-	)
-	if err != nil {
-		return err
-	}
-
-	defaultSnippet, err = apparmor_sandbox.InsertAAREExclusionPatterns(
-		defaultSnippet,
-		[]string{
-			"/snap/snapd/*/usr/lib/snapd/snap-confine",
-			"/snap/core/*/usr/lib/snapd/snap-confine",
-		},
-		&apparmor_sandbox.AAREExclusionPatternsOptions{
-			Prefix: "change_profile unsafe ",
-			Suffix: " -> cri-containerd.apparmor.d,",
-		},
-	)
-	if err != nil {
-		return err
-	}
+	defaultSnippet := dockerSupportConnectedPlugAppArmor
 
-	spec.AddSnippet(defaultSnippet)
-	if privileged {
-		privilegedSnippet, err := apparmor_sandbox.InsertAAREExclusionPatterns(
-			dockerSupportPrivilegedAppArmor,
+        if !release.OnTouch {
+		defaultSnippet, err := apparmor_sandbox.InsertAAREExclusionPatterns(
+			dockerSupportConnectedPlugAppArmor,
 			[]string{
 				"/snap/snapd/*/usr/lib/snapd/snap-confine",
 				"/snap/core/*/usr/lib/snapd/snap-confine",
 			},
 			&apparmor_sandbox.AAREExclusionPatternsOptions{
 				Prefix: "change_profile unsafe ",
-				Suffix: ",",
+				Suffix: " -> docker-default,",
 			},
 		)
 		if err != nil {
 			return err
 		}
 
-		privilegedSnippet, err = apparmor_sandbox.InsertAAREExclusionPatterns(
-			privilegedSnippet,
+		defaultSnippet, err = apparmor_sandbox.InsertAAREExclusionPatterns(
+			defaultSnippet,
 			[]string{
 				"/snap/snapd/*/usr/lib/snapd/snap-confine",
 				"/snap/core/*/usr/lib/snapd/snap-confine",
 			},
 			&apparmor_sandbox.AAREExclusionPatternsOptions{
-				Prefix: "",
-				Suffix: " rwlix,",
+				Prefix: "change_profile unsafe ",
+				Suffix: " -> cri-containerd.apparmor.d,",
 			},
 		)
 		if err != nil {
 			return err
 		}
+	} else {
+		spec.AddSnippet(dockerSupportConnectedPlugAppArmorTouch)
+	}
 
+	spec.AddSnippet(defaultSnippet)
+
+	if privileged {
+		privilegedSnippet := dockerSupportPrivilegedAppArmor
+		if !release.OnTouch {
+			privilegedSnippet, err := apparmor_sandbox.InsertAAREExclusionPatterns(
+				dockerSupportPrivilegedAppArmor,
+				[]string{
+					"/snap/snapd/*/usr/lib/snapd/snap-confine",
+					"/snap/core/*/usr/lib/snapd/snap-confine",
+				},
+				&apparmor_sandbox.AAREExclusionPatternsOptions{
+					Prefix: "change_profile unsafe ",
+					Suffix: ",",
+				},
+			)
+			if err != nil {
+				return err
+			}
+
+			privilegedSnippet, err = apparmor_sandbox.InsertAAREExclusionPatterns(
+				privilegedSnippet,
+				[]string{
+					"/snap/snapd/*/usr/lib/snapd/snap-confine",
+					"/snap/core/*/usr/lib/snapd/snap-confine",
+				},
+				&apparmor_sandbox.AAREExclusionPatternsOptions{
+					Prefix: "",
+					Suffix: " rwlix,",
+				},
+			)
+			if err != nil {
+				return err
+			}
+		} else {
+			spec.AddSnippet(dockerSupportPrivilegedAppArmorTouch)
+		}
 		spec.AddSnippet(privilegedSnippet)
 	}
-	if !release.OnClassic {
+	if !release.OnClassic || release.OnTouch {
 		spec.AddSnippet(dockerSupportConnectedPlugAppArmorCore)
 	}
 	// if apparmor supports userns mediation then add this too