Skip to content

cmd/snap-update-ns: ensure that a /tmp/.X11-unix created inside the mount ns has expected permissions #17001

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bboozzoo merged 1 commit into from
May 20, 2026
Merged

cmd/snap-update-ns: ensure that a /tmp/.X11-unix created inside the mount ns has expected permissions #17001

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions cmd/snap-update-ns/system.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,13 @@ func (upCtx *SystemProfileUpdateContext) Assumptions() *Assumptions {
// permission only matters if the plug-side app constructs its mount
// namespace before the slot-side app is launched.
as.AddModeHint("/var/lib/snapd/hostfs/tmp/snap-private-tmp/snap.*/tmp/.X11-unix", 0777|os.ModeSticky)
// This is to ensure the mount target directory /tmp/.X11-unix inside the
// mount namespace is created with the same permissions as a typical host
// /tmp/.X11-unix. When x11 interface is connected, the target path is
// shadowed by a bind mount from the host, so the actual mode is only
// visible when said interface is disconnected after being connected earlier
// with the mount namespace being preserved.
as.AddModeHint("/tmp/.X11-unix", 0777|os.ModeSticky)
// This is to ensure private shared-memory directories have
// the right permissions.
as.AddModeHint("/dev/shm/snap.*", 0777|os.ModeSticky)
Expand Down
1 change: 1 addition & 0 deletions cmd/snap-update-ns/system_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ func (s *systemSuite) TestAssumptions(c *C) {
c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp/snap-private-tmp/snap.x11-server/tmp"), Equals, os.FileMode(0777)|os.ModeSticky)
c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp/snap-private-tmp/snap.x11-server/foo"), Equals, os.FileMode(0755))
c.Check(as.ModeForPath("/var/lib/snapd/hostfs/tmp/snap-private-tmp/snap.x11-server/tmp/.X11-unix"), Equals, os.FileMode(0777)|os.ModeSticky)
c.Check(as.ModeForPath("/tmp/.X11-unix"), Equals, os.FileMode(0777)|os.ModeSticky)
c.Check(as.ModeForPath("/dev/shm/snap.some-snap"), Equals, os.FileMode(0777)|os.ModeSticky)

// Instances can, in addition, access /snap/$SNAP_INSTANCE_NAME
Expand Down
Loading