Merge lp:~gary-wzl77/squid/snap_package into lp:squid/3.5

[Gary.Wang]

Enable to package and compile squid in snap world.

1.Added conditional for snap packaging by testing "--enable-snap".
As all services run as root thanks to confinement in snap world,
so we need to get rid of uid, gid configured,
otherwise there will be bunch of apparmor DENIED issue when running
this snap in confined mode.
2.Fixed bunch of critical conf file reading path.
3.Make sure writeable path for some file reading. e.g pidfile
4.Make sure sem_open available inside snap. see
    https://bugs.launchpad.net/snappy/+bug/1653955

Enable to package and compile squid in snap world.

1.Added conditional for snap packaging by testing "--enable-snap".
As all services run as root thanks to confinement in snap world,
so we need to get rid of uid, gid configured,
otherwise there will be bunch of apparmor DENIED issue when running
this snap in confined mode.
2.Fixed bunch of critical conf file reading path.
3.Make sure writeable path for some file reading. e.g pidfile
4.Make sure sem_open available inside snap. see
    https://bugs.launchpad.net/snappy/+bug/1653955

This PR is still using the master branch as squid source in snapraft.yaml file.
As a PR, I don't change it as it targets to merge into master.
You can simply make a change as following to use my branch for testing purpose for the time being.
http://paste.ubuntu.com/24063880/

[Alex Rousskov (rousskov)]

The patch or bundle should probably be posted and discussed on squid-dev mailing list rather than here.

FWIW, I am against the proposed "let's sprinkle the code with snap-only hacks and add a bunch of snap-only files that developers will have to somehow maintain" approach. I hope this work can be refactored into two pieces:

1. A stand-alone package with a custom Squid configuration file template (if really needed) and possibly snap-specific Squid build options. The Squid Project will not maintain this package but official Squid documentation can refer to it.

2. A _minimum_ set of generally-useful Squid changes that make #1 possible. These changes will be committed and maintained by the Squid Project, of course. This should be done without adding a single monolithic set of options tied to the snap environment.

review: Disapprove

[Amos Jeffries (yadi)]

Just so it is clear why I'm rejecting this outright:

* see review of previous proposal https://code.launchpad.net/~cprov/squid/snap/+merge/297663. All of Alex's and Robert's comments about packaging still apply.
 For the purposes of snap packaging your upstreams are in this order: the Ubuntu Server Team, the Debian pkg-squid Team, then Squid Project.

* SNAP does not change any of the legal restrictions that have long prevented Debian/Ubuntu distrbuting SSL/TLS enabled Squid packages. You are free to build your own binaries, but Debian/Ubuntu are forbidden from distribution. Please drop all the OpenSSL related parts, there is no chance of a merge while they remain.

review: Disapprove

[Gary.Wang (gary-wzl77)]

Thanks, Alex and Amos for your comments.

@Alex, about your suggestions, I think it makes sense to me.
But
"...This should be done without adding a single monolithic set of options tied to the snap environment..."
That's impossible if we're gonna release squid snap in stable channel of ubuntu store. Because the ultimate goal is to publish squid snap into the stable channel so that normal user can let it run with the strict security confinement.
And except custom Squid configuration file template, all the changes I made in squid3.5 are related to sth which let normal users run this snap in strict confinement mode.

Strict confinement gives you the following readable and/or writable paths:
1. /snap/<snap>/<revision> (read-only, snap install path)
    Hence I need to pre-append $SNAP to the following file path to make these files can be found and read by squid.
     *mime table file
     *error template file.
     *conf file
     *icon directory
2./var/snap/<snap>/<revision> (read/write, per-revision data)
    Hence I need to pre-append $SNAP_DATA to the pid file path to make sure it's in writable path.
3.As all services run as root due to confinement in snap world
    Hence I need to get rid of setresuid/setuid/setgid sys call otherwise appapmor denies occurs.
4. In order to make shm_open available in snap world, need to make share memory file name declared according to the required namespace
     Please see https://bugs.launchpad.net/snappy/+bug/1653955

If any above changes are not made, squid daemon failed to run in strict confinement mode.
Snap that can only read and write in its own namespace is recommended and enforced, if we wanna publish it into stable channel.
That's why I made this change here.

[Alex Rousskov (rousskov)]

>> should be done without adding a single monolithic set of options tied to the snap environment

> That's impossible

I obviously think it is possible. AFAICT, your "Because the ultimate goal is to publish squid snap into the stable channel" explanation does not prove that the only way to achieve this ultimate goal is to have a "monolithic set of options tied to the snap environment".

> Snap that can only read and write in its own namespace is recommended and enforced, if we wanna publish it into stable channel.

I am not against teaching Squid to obey some kind of a "namespace". We already have "./configure --prefix" and "squid -n". It is possible that more knobs like that are needed (but it is on you to prove that the existing knobs are insufficient or too awkward to use in a snap context -- I do not see that proof in your comments but please point me to it if I missed it).

To better understand why I do not like your implementation, take a step back and assume that there is not just one snap-like environment, but ten. It does not matter what they are called. You can call them Snap v1, Snap v2, ... or Docker, Snap, Chroot, ... or something else. Do we want to add --enable-snap-v1, --enable-snap-v2, --enable-snap-v3, ... options and then deal with all their weird combinations in the code, while being unable to test most of them? No. Does that "no" mean that we do not want to support Snap v1, Snap v2, ...? No! It only means that you need to (a) use existing configuration knobs and (b) generalize the missing knobs that you want to add.

For example, if --prefix and/or -n are enough to support snap "install path", use those existing configuration features. If they are not enough, describe what is missing in generalized terms and propose adding knobs for that generally useful support (using snap as an example).

Similarly, do you need a custom prefix for shared memory segment names? Does Squid already support a customer prefix for those names? If yes/no, then it would be OK to propose a ./configure or runtime option that adds such support, but that option is not going to be --enable-snap, it would be something like --ipc-prefix.

Hope this clarifies. To avoid doing a lot of work that is going to be rejected at the end, I recommend getting a preliminary Project approval in advance, based on a brief description of what Squid changes you want to make and _why_ they are necessary.

N.B. As for licensing conflicts, I do not yet understand why your proposal would create any new ones, but I will leave it for you and Amos to battle that out.

Unmerged revisions

14144. By Gary.Wang on 2017-02-25

Enable to package and compile squid in snap world.

1.Added conditional for snap packaging by testing "--enable-snap".
As all services run as root thanks to confinement in snap world,
so we need to get rid of uid, gid configured,
otherwise there will be bunch of apparmor DENIED issue when running
this snap in confined mode.
2.Fixed bunch of critical conf file reading path.
3.Make sure writeable path for some file reading. e.g pidfile
4.Make sure sem_open available inside snap. see
    https://bugs.launchpad.net/snappy/+bug/1653955

=== added file 'README.snap'
--- README.snap	1970-01-01 00:00:00 +0000
+++ README.snap	2017-02-25 10:06:38 +0000
@@ -0,0 +1,29 @@
+## Snap
+
+If you would like to build squid as a snap package, please make sure
+you have snapd(> 2.21) and snapcraft(2.26) packages installed firstly.
+
+```
+sudo apt-get install snapd snapcraft
+sudo snap install core
+```
+
+Then run the following command to create a snap package.
+
+```
+cd snap && snapcraft
+```
+
+After it's done, you can simply run the following command to install it
+locally.
+
+```
+sudo snap install --dangerous squid-snap_[VER]_[ARCH].snap
+```
+
+Also you can install squid from the store by running the following
+command.
+
+```
+sudo snap install squid-snap
+```
 
=== modified file 'configure.ac'
--- configure.ac	2017-01-28 03:54:15 +0000
+++ configure.ac	2017-02-25 10:06:38 +0000
@@ -922,6 +922,16 @@
   fi
 ])
 
+AM_CONDITIONAL(ENABLE_SNAP, false)
+AC_ARG_ENABLE(snap,
+  AS_HELP_STRING([--enable-snap],[Enable to package and run squid in snap world]),
+[ if test "x$enableval" = "xyes" ; then
+    AC_MSG_NOTICE([SNAP enabled])
+    AC_DEFINE(USE_SNAP,1,[Define to enable to package and compile squid in snap world])
+    AM_CONDITIONAL(ENABLE_SNAP, true)
+  fi
+])
+
 AM_CONDITIONAL(ENABLE_DELAY_POOLS, false)
 AC_ARG_ENABLE(delay-pools,
   AS_HELP_STRING([--enable-delay-pools],[Enable delay pools to limit bandwidth usage]),
 
=== added directory 'snap'
=== added directory 'snap/setup'
=== added directory 'snap/setup/gui'
=== added file 'snap/setup/gui/icon.png'
 Binary files snap/setup/gui/icon.png	1970-01-01 00:00:00 +0000 and snap/setup/gui/icon.png	2017-02-25 10:06:38 +0000 differ
=== added file 'snap/snapcraft.yaml'
--- snap/snapcraft.yaml	1970-01-01 00:00:00 +0000
+++ snap/snapcraft.yaml	2017-02-25 10:06:38 +0000
@@ -0,0 +1,83 @@
+name: squid-snap
+version: '0.3'
+summary: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more.
+description: |
+  It reduces bandwidth and improves response times by caching 
+  and reusing frequently-requested web pages. 
+  Squid has extensive access controls and makes a great server accelerator.
+
+  usage: $ sudo snap set squid http-port=9876
+  supported parameters:
+    - http-port: The socket addresses where Squid will listen for HTTP client requests. The default is '3128'
+    - cache-mem: The ideal amount of memory (MB) to be used for in-transit/Hot/negative-Cached objects. The default is '256'
+    - maximum-object-size: The max-size parameter on any cache_dir (MB). The default is '512'.
+    - maximum-object-size-in-memory: Objects greater than this size (MB)will not be attempted to kept in the memory cache. The default is '16'.
+    - cache_dir_space: The amount of disk space (MB) to use under cache directory. The default value is '4096'.
+    - visible-hostname: If you want to present a special hostname in error messages, etc, define this. The default value is 'store.etag.proxy'.
+    - cache_mgr: Email-address of local cache manager who will receive mail if the cache dies. The default value is '[e-mail]'.
+
+
+grade: stable
+confinement: strict
+
+apps:
+  squid:
+    command: run-squid start
+    stop-command: run-squid stop
+    daemon: forking
+    plugs: [ network, network-bind, process-control ]
+
+  start:
+    command: run-squid start
+    plugs: [ network, network-bind, process-control ]
+
+  stop:
+    command: run-squid stop
+    plugs: [ network, network-bind, process-control ]
+
+  restart:
+    command: run-squid restart
+    plugs: [ network, network-bind, process-control ]
+
+parts:
+  squid:
+    plugin: autotools
+    source: lp:squid/3.5
+    source-type: bzr
+    configflags:
+      - --enable-gnuregex
+      - --enable-async-io=240 
+      - --enable-storeio=ufs,aufs,diskd
+      - --enable-poll 
+      - --enable-ssl
+      - --enable-icmp
+      - --enable-kill-parent-hack
+      - --enable-cachemgr-hostname=localhost  
+      - --enable-linux-netfilter  
+      - --enable-large-cache-files
+      - --enable-default-hostsfile=/etc/hosts
+      - --enable-snmp 
+      - --enable-underscore  
+      - --enable-arp-acl
+      - --enable-snap
+      - --with-maxfd=65535
+      - --with-openssl=/usr/include/openssl
+      - --with-dl
+      - --with-pthreads
+      - --disable-carp
+      - --disable-internal-dns 
+      - --disable-ident-lookups 
+      - --disable-arch-native
+    build-packages:
+      - libssl-dev
+      - libxml2-dev
+    stage:
+      - -etc/squid.conf
+    snap:
+      - -etc/squid.conf
+  squid-customized:
+    plugin: dump
+    organize:
+      src/squid/script/*: bin/
+      src/squid/conf/squid.conf.template: etc/
+      src/squid/conf/configure: meta/hooks/configure
 
=== added directory 'snap/src'
=== added directory 'snap/src/squid'
=== added directory 'snap/src/squid/conf'
=== added file 'snap/src/squid/conf/squid.conf.template'
--- snap/src/squid/conf/squid.conf.template	1970-01-01 00:00:00 +0000
+++ snap/src/squid/conf/squid.conf.template	2017-02-25 10:06:38 +0000
@@ -0,0 +1,116 @@
+# listen port
+http_port 3128
+
+#Support IPv6 for intercept mode.
+http_port 8080 intercept
+
+# The extra memory that to be provided for squid to use.
+cache_mem 256 MB
+
+# The default value for max-size on any cache_dir.
+maximum_object_size 512 MB
+
+# All responses can be stored.
+minimum_object_size 0 KB
+
+# Objects greater than 16MB will not be attempted to kept in the memory cache.
+maximum_object_size_in_memory 16 MB
+
+# cache path, cache dir space(4G), number of 1L/2L cache(16MB/256MB).
+cache_dir ufs ${SNAP_DATA}/var/spool/squid 4096 15 256
+
+# access_log dir path
+access_log ${SNAP_DATA}/var/log/squid/access.log combined
+
+# cache_log dir path
+cache_log ${SNAP_DATA}/var/log/squid/cache.log
+
+# logfile rotation days
+logfile_rotate 60
+
+# start to clean old cache if cache is in the percentage(95%)
+cache_swap_high 95
+
+# stop to clean old cache when cache is in the percentage(90%)
+cache_swap_low 90
+
+# RFC1918 possible internal network
+acl localnet src 10.0.0.0/8
+# RFC1918 possible internal network
+acl localnet src 172.16.0.0/12
+# RFC1918 possible internal network
+acl localnet src 192.168.0.0/16
+# RFC 4193 local private network range
+acl localnet src fc00::/7
+# RFC 4291 link-local (directly plugged) machines
+acl localnet src fe80::/10
+
+# Example rule allowing access from your local networks.
+# Adapt to list your (internal) IP networks from where browsing
+# should be allowed
+acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
+acl localnet src 172.16.0.0/12  # RFC1918 possible internal network
+acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
+acl localnet src fc00::/7       # RFC 4193 local private network range
+acl localnet src fe80::/10      # RFC 4291 link-local (directly plugged) machines
+
+acl SSL_ports port 443
+acl Safe_ports port 80      # http
+acl Safe_ports port 21      # ftp
+acl Safe_ports port 443     # https
+acl Safe_ports port 70      # gopher
+acl Safe_ports port 210     # wais
+acl Safe_ports port 1025-65535  # unregistered ports
+acl Safe_ports port 280     # http-mgmt
+acl Safe_ports port 488     # gss-http
+acl Safe_ports port 591     # filemaker
+acl Safe_ports port 777     # multiling http
+acl CONNECT method CONNECT
+
+#
+# Recommended minimum Access Permission configuration:
+#
+# Deny requests to certain unsafe ports
+http_access deny !Safe_ports
+
+# Deny CONNECT to other than secure SSL ports
+http_access deny CONNECT !SSL_ports
+
+# Only allow cachemgr access from localhost
+http_access allow localhost manager
+http_access deny manager
+
+# allow the access from local network segment
+http_access allow localnet
+
+# allow the access from localhost
+http_access allow localhost
+
+# deny all access from others
+http_access deny all
+
+# based on http://code.google.com/p/ghebhes/downloads/detail?name=tunning.conf&can=2&q=
+#All File
+refresh_pattern -i \.(3gp|7z|ace|asx|avi|bin|cab|dat|deb|rpm|divx|dvr-ms)      129600 100% 129600 ignore-no-cache ignore-no-store ignore-private override-expire override-lastmod reload-into-ims ignore-reload
+refresh_pattern -i \.(rar|jar|gz|tgz|tar|bz2|iso|m1v|m2(v|p)|mo(d|v)|(x-|)flv) 129600 100% 129600 ignore-no-cache ignore-no-store ignore-private override-expire override-lastmod reload-into-ims ignore-reload
+refresh_pattern -i \.(jp(e?g|e|2)|gif|pn[pg]|bm?|tiff?|ico|swf|css|js)         129600 100% 129600 ignore-no-cache ignore-no-store ignore-private override-expire override-lastmod reload-into-ims ignore-reload
+refresh_pattern -i \.(mp(e?g|a|e|1|2|3|4)|mk(a|v)|ms(i|u|p))                   129600 100% 129600 ignore-no-cache ignore-no-store ignore-private override-expire override-lastmod reload-into-ims ignore-reload
+refresh_pattern -i \.(og(x|v|a|g)|rar|rm|r(a|p)m|snd|vob|wav)                  129600 100% 129600 ignore-no-cache ignore-no-store ignore-private override-expire override-lastmod reload-into-ims ignore-reload
+refresh_pattern -i \.(pp(s|t)|wax|wm(a|v)|wmx|wpl|zip|cb(r|z|t))               129600 100% 129600 ignore-no-cache ignore-no-store ignore-private override-expire override-lastmod reload-into-ims ignore-reload
+# for snap package, it fetches the latest one from server if new one is found on server, cache it and give it back to client.
+refresh_pattern -i \.snap$                                                     129600 100% 129600 reload-into-ims ignore-no-cache
+
+refresh_pattern ^gopher:  1440  0%  1440
+refresh_pattern ^ftp:    10080 95% 43200 override-lastmod reload-into-ims
+
+refresh_pattern -i \.(doc|pdf)$           100080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private reload-into-ims
+refresh_pattern -i \.(html|htm)$          1440   40% 40320 ignore-no-cache ignore-no-store ignore-private override-expire reload-into-ims
+refresh_pattern (Release|Packages(.gz)*)$    0   20%  2880
+refresh_pattern .                          180   95% 43200 override-lastmod reload-into-ims
+
+# hostname
+visible_hostname store.etag.proxy
+
+# admin email address
+cache_mgr [e-mail]
+
 
=== added directory 'snap/src/squid/script'
=== added file 'snap/src/squid/script/run-squid'
--- snap/src/squid/script/run-squid	1970-01-01 00:00:00 +0000
+++ snap/src/squid/script/run-squid	2017-02-25 10:06:38 +0000
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+test -d ${SNAP_DATA}/etc || mkdir -p ${SNAP_DATA}/etc
+test -d ${SNAP_DATA}/var/run || mkdir -p ${SNAP_DATA}/var/run
+test -d ${SNAP_DATA}/var/log/squid || mkdir -p ${SNAP_DATA}/var/log/squid
+test -d ${SNAP_DATA}/var/spool/squid || mkdir -p ${SNAP_DATA}/var/spool/squid
+test -f ${SNAP_DATA}/etc/squid.conf || sed -e "s|\${SNAP_DATA}|$SNAP_DATA|" ${SNAP}/etc/squid.conf.template > ${SNAP_DATA}/etc/squid.conf
+
+source ${SNAP}/bin/settings
+
+create_swap_directories() {
+    if [ "$(find $SNAP_DATA/var/spool/squid/ -maxdepth 1 -type d -printf 1 | wc -m)" -eq 1 ] ; then
+        squid -z -f ${SNAP_DATA}/etc/squid.conf
+         #waiting for a long time to make sure the directories are created 
+         #to avoid fatal error occurs when squid startup.
+        sleep 8
+    fi
+}
+
+launch() {
+    squid -f ${SNAP_DATA}/etc/squid.conf
+}
+
+shutdown() {
+    squid -k shutdown -f ${SNAP_DATA}/etc/squid.conf
+}
+
+restart() {
+    squid -k restart -f ${SNAP_DATA}/etc/squid.conf
+}
+
+create_swap_directories
+
+case "$1" in
+  start)
+    echo "launch squid."
+    launch
+    ;;
+  stop)
+    echo "shutdown squid."
+    shutdown
+    ;;
+  restart)
+    echo "restart squid."
+    restart
+    ;;
+   *)  
+    echo "Usage: squid.{start|stop|restart}"
+    exit 1
+    ;;
+esac
+
 
=== added file 'snap/src/squid/script/settings'
--- snap/src/squid/script/settings	1970-01-01 00:00:00 +0000
+++ snap/src/squid/script/settings	2017-02-25 10:06:38 +0000
@@ -0,0 +1,39 @@
+#!/bin/bash
+
+source $SNAP_DATA/custom_config
+
+squid_conf="${SNAP_DATA}/etc/squid.conf"
+
+params=("http_port" "cache_mem" "maximum_object_size" "maximum_object_size_in_memory" "cache_dir_space" "visible_hostname" "cache_mgr")
+line_number=(2 8 11 17 20 112 115)
+length=${#params[@]}
+
+#sed -i in-place option is not available by default on some other distro.
+modify() {
+    sed -u "$1" ${squid_conf} > ${squid_conf}.bak && mv ${squid_conf}.bak ${squid_conf}
+}
+
+for ((i = 0; i < $length; i++))
+do
+  if [ ! -z "${!params[i]}" ]; then
+      echo "customized config: ${params[i]}=${!params[i]}"
+      modify "${line_number[i]}d"
+      unit=""
+      if [ ${params[i]} == "cache_mem" ] || [ ${params[i]} == "maximum_object_size" ] ||
+         [ ${params[i]} == "maximum_object_size_in_memory" ]; then
+          unit="MB" 
+      fi
+
+      if [ ${params[i]} == "cache_dir_space" ]; then
+          modify "${line_number[i]}icache_dir ufs ${SNAP_DATA}/var/spool/squid ${!params[i]} 15 256"
+      else
+          #space sensitive
+          if [ -z $unit ]; then
+              modify "${line_number[i]}i${params[i]} ${!params[i]}"
+          else
+              modify "${line_number[i]}i${params[i]} ${!params[i]} ${unit}"
+          fi
+      fi
+  fi
+done
+
 
=== modified file 'src/cache_cf.cc'
--- src/cache_cf.cc	2017-01-01 00:16:45 +0000
+++ src/cache_cf.cc	2017-02-25 10:06:38 +0000
@@ -4039,6 +4039,12 @@
         path = pathbuf;
     }
 
+    const char *snap = getenv("SNAP");
+    if (snap) {
+        snprintf(pathbuf, BUFSIZ, "%s/%s", snap, path);
+        path = pathbuf;
+    }
+
     if (stat(path, &sb) < 0) {
         debugs(0, DBG_CRITICAL, (opt_parse_cfg_only?"FATAL: ":"ERROR: ") << name << " " << path << ": " << xstrerror());
         // keep going to find more issues if we are only checking the config file with "-k parse"
 
=== modified file 'src/cf_gen_defines'
--- src/cf_gen_defines	2017-01-01 00:16:45 +0000
+++ src/cf_gen_defines	2017-02-25 10:06:38 +0000
@@ -47,6 +47,7 @@
 	define["USE_UNLINKD"]="--enable-unlinkd"
 	define["USE_WCCP"]="--enable-wccp"
 	define["USE_WCCPv2"]="--enable-wccpv2"
+	define["USE_SNAP"]="--enable-snap"
 }
 /^IFDEF:/ {
 	if (define[$2] != "")
 
=== modified file 'src/errorpage.cc'
--- src/errorpage.cc	2017-01-01 00:16:45 +0000
+++ src/errorpage.cc	2017-02-25 10:06:38 +0000
@@ -298,8 +298,14 @@
 
     char path[MAXPATHLEN];
     /* TODO: prep the directory path string to prevent snprintf ... */
-    snprintf(path, sizeof(path), "%s/%s/%s",
-             DEFAULT_SQUID_ERROR_DIR, lang, templateName.termedBuf());
+    const char *snap = getenv("SNAP");
+    if (snap) {
+        snprintf(path, sizeof(path), "%s/%s/%s/%s",
+                 snap, DEFAULT_SQUID_ERROR_DIR, lang, templateName.termedBuf());
+    } else {
+        snprintf(path, sizeof(path), "%s/%s/%s",
+                 DEFAULT_SQUID_ERROR_DIR, lang, templateName.termedBuf());
+    } 
     path[MAXPATHLEN-1] = '\0';
 
     if (loadFromFile(path))
 
=== modified file 'src/ipc/mem/Segment.cc'
--- src/ipc/mem/Segment.cc	2017-01-01 00:16:45 +0000
+++ src/ipc/mem/Segment.cc	2017-02-25 10:06:38 +0000
@@ -226,12 +226,28 @@
     assert(BasePath && *BasePath);
     static const bool nameIsPath = shm_portable_segment_name_is_path();
     String name;
+    const char *snap_name = getenv("SNAP_NAME");
+    char snap_shm[MAXPATHLEN];
+    *snap_shm = 0;
+    if (snap_name) {
+       snprintf(snap_shm, sizeof(snap_shm)-1, "sem.snap.%s.", snap_name);
+    }
+    //https://bugs.launchpad.net/snappy/+bug/1653955
+    //snapd 2.21 added support to allow /{dev,run}/shm/sem.snap.@{SNAP_NAME}.*. 
+    //This is sufficient to make use of sem_open() possible.
+
     if (nameIsPath) {
         name.append(BasePath);
         if (name[name.size()-1] != '/')
             name.append('/');
+        if (snap_name) {
+            name.append(snap_shm);
+        }
     } else {
         name.append('/');
+        if (snap_name) {
+            name.append(snap_shm);
+        }
         name.append(service_name.c_str());
         name.append('-');
     }
 
=== modified file 'src/main.cc'
--- src/main.cc	2017-01-01 00:16:45 +0000
+++ src/main.cc	2017-02-25 10:06:38 +0000
@@ -871,7 +871,15 @@
 
     storeDirOpenSwapLogs();
 
-    mimeInit(Config.mimeTablePathname);
+    const char *snap = getenv("SNAP");
+    if (snap) {
+        char mimePathbuf[BUFSIZ];
+        assert(mimePathbuf != NULL);
+        snprintf(mimePathbuf, BUFSIZ, "%s/%s", snap, Config.mimeTablePathname);
+        mimeInit(mimePathbuf);
+    } else {
+        mimeInit(Config.mimeTablePathname);
+    }
 
     if (unlinkdNeeded())
         unlinkdInit();
@@ -927,8 +935,7 @@
 {
     keepCapabilities();
     leave_suid();       /* Run as non privilegied user */
-#if _SQUID_OS2_
-
+#if _SQUID_OS2_ || USE_SNAP
     return;
 #endif
 
@@ -1100,7 +1107,16 @@
         statInit();
         storeInit();
         mainSetCwd();
-        mimeInit(Config.mimeTablePathname);
+
+        const char *snap = getenv("SNAP");
+        if (snap) {
+            char mimePathbuf[BUFSIZ];
+            assert(mimePathbuf != NULL);
+            snprintf(mimePathbuf, BUFSIZ, "%s/%s", snap, Config.mimeTablePathname);
+            mimeInit(mimePathbuf);
+        } else {
+            mimeInit(Config.mimeTablePathname);
+        }
         refreshInit();
 #if USE_DELAY_POOLS
         DelayPools::Init();
 
=== modified file 'src/mime.cc'
--- src/mime.cc	2017-01-01 00:16:45 +0000
+++ src/mime.cc	2017-02-25 10:06:38 +0000
@@ -376,8 +376,14 @@
     Http::StatusCode status = Http::scOkay;
 
     static char path[MAXPATHLEN];
+    const char *snap = getenv("SNAP");
     *path = 0;
-    if (snprintf(path, sizeof(path)-1, "%s/%s", Config.icons.directory, icon_) < 0) {
+    if (snap) {
+        if (snprintf(path, sizeof(path)-1, "%s/%s/%s", snap, Config.icons.directory, icon_) < 0) {
+            debugs(25, DBG_CRITICAL, "ERROR: icon file '" << Config.icons.directory << "/" << icon_ << "' path is longer than " << MAXPATHLEN << " bytes");
+            status = Http::scNoContent;
+        }
+    } else if (snprintf(path, sizeof(path)-1, "%s/%s", Config.icons.directory, icon_) < 0) {
         debugs(25, DBG_CRITICAL, "ERROR: icon file '" << Config.icons.directory << "/" << icon_ << "' path is longer than " << MAXPATHLEN << " bytes");
         status = Http::scNoContent;
     }
 
=== modified file 'src/tools.cc'
--- src/tools.cc	2017-01-01 00:16:45 +0000
+++ src/tools.cc	2017-02-25 10:06:38 +0000
@@ -540,6 +540,10 @@
 void
 leave_suid(void)
 {
+#if USE_SNAP
+    return;
+#endif
+
     debugs(21, 3, "leave_suid: PID " << getpid() << " called");
 
     if (Config.effectiveGroup) {
@@ -607,6 +611,10 @@
 void
 enter_suid(void)
 {
+#if USE_SNAP
+    return;
+#endif
+
     debugs(21, 3, "enter_suid: PID " << getpid() << " taking root privileges");
 #if HAVE_SETRESUID
     if (setresuid((uid_t)-1, 0, (uid_t)-1) < 0)
@@ -744,11 +752,16 @@
     const char *f = NULL;
     mode_t old_umask;
     char buf[32];
+    char path[MAXPATHLEN];
 
     if (!IamPrimaryProcess())
         return;
 
-    if ((f = Config.pidFilename) == NULL)
+    const char *snap_data = getenv("SNAP_DATA");
+    if (snap_data) {
+        snprintf(path, sizeof(path)-1, "%s/%s", snap_data, f);
+        f = path;
+    } else if ((f = Config.pidFilename) == NULL)
         return;
 
     if (!strcmp(Config.pidFilename, "none"))
@@ -796,6 +809,14 @@
         f = chroot_f;
     }
 
+    char path[MAXPATHLEN];
+    *path = 0;
+    const char *snap_data = getenv("SNAP_DATA");
+    if (snap_data) {
+        snprintf(path, sizeof(path)-1, "%s/%s", snap_data, f);
+        f = path;
+    }
+
     pid_fp = fopen(f, "r");
 
     if (pid_fp != NULL) {