3 ms·
>> Snap is similar, although it requires AppArmor, so can't run on many popular distros, > I'm not sure why you continue to repeat this factually incorrect inf
by the_why_of_y 7y ago
>> Snap is similar, although it requires AppArmor, so can't run on many popular distros,
> I'm not sure why you continue to repeat this factually incorrect information. AppArmor is not required. In fact, guessing you being a Fedora user, you can verify that by installing snapd from your distro repositories.
I'm sorry, what I meant to write is, it doesn't run equally well on many distros; you get a first-class or second-class experience depending on which LSM your distro has chosen to use. This is not the case with Flatpak, because it doesn't use any LSM for sandboxing.
Although I've heard there were attempts to enable LSM stacking in the kernel, which would provide a way to solve the problem; do you know the current status of that?
- bboozzoo 7y agoAFAIK the effort is still ongoing. I believe LWN had some nice coverage on that, with the last majir pain point being attaching a security context to sockets in a way that suits all interested LSMs. Anyways, I would not expect to have LSM stacking enabled in Fedora or RHEL anytime soon after it lands in mainline, mostly due to political reasons, thought I'd very much like to be surprised when the day comes.