overlord/ifacestate: fix migration of connections on upgrade from ubuntu-core (#6530)
The connections migration code for ubuntu-core -> core transition migrates connections stored in "conns" from ubuntu-core to core and reloads connections in the repo (via reloadConnections helper). It hower incorrectly calls reloadConnections for "ubuntu-core" snap under the assumption that reloadConnections takes care of full synchronization of conns -> repo and removes non-existing connections, which is not the case. So as a result we end up with correct "conns" but incorrect repo with for both "core" and "ubuntu-core" connection. This causes an error when we run "auto-disconnect" task on "ubuntu-core" removal - see https://paste.ubuntu.com/p/FcK6mx2SwZ/
The spread test updated with this PR uncovers the problem and reports the failure of migration without the fix (thanks Michael).
The fix explicitely removed connections of "ubuntu-core" from the repo as part of migration task, so that "conns" and "repo" are in sync.
snapd version 2.15 will not work with kernels newer than
4.4 because later kernels require snap-exec to be mmapable.
This PR adds the missing rule manually.
We use the snapweb snap in various tests. The package is now
unpublished from the store and thus the tests break. We really
don't want this package anymore.
interfaces/seccomp: generate global seccomp profile (#6516)
* interfaces/seccomp: generate global seccomp profile
When initializing the seccomp backend, write the global profile to disk.
This is picked up by snap-confine and applied to all non-classic snaps.
Signed-off-by: Zygmunt Krynicki <email address hidden>
* interfaces/seccomp: handle big endian arches
Signed-off-by: Zygmunt Krynicki <email address hidden>
d755140...
by
"John R. Lenton" <email address hidden>
overlord/snapstate: add some randomness to the catalog refresh (#6506)
overlord/snapstate: add some randomness to the catalog refresh
Without this change, once the catalog refresh was successful it was
done every 24 hours exactly. This meant that if other external factors
conspired to synchronise a large number of machines to do a catalog
refresh at the same time, we'd get a thundering herd every day.
This change adds a delta to spread things out.
Also, previously the presence of the `sections` file was used to
mean "a catalog refresh happened", when it's the `names` file that is
more indivative of that; sections can easily succeed (or fail with no
error, returning empty) and `names` (and `commands.db`) fail. This
changes that.
Lastly, due to a bad systems: line the snap-advise-command integration test
wasn't running. This fixes that, tweaks the prepare so that it works
as it had apparently bitrotten, and then makes it skip for now because
the store.
