-
Notifications
You must be signed in to change notification settings - Fork 690
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove snappy from base Ubuntu system as part of installation process? #5128
Comments
We could make a quick change to the Ansible logic to purge the snappy config, but that'll mostly only work for new installs, it won't be applied generally to all production SecureDrop instances. We cannot easily provide unattended logic to purge those configs via postinst because the dpkg/apt lock will be active. Using pull-like Ansible like as described in #3136 would resolve, but that's not on the roadmap at present. Recommend deferring action here until we tackle Bionic support #4768, when we can address cleanup issues in one fell swoop. |
Given Canonical's heavy push towards snaps, 1) is the assumption in this issue still true for 20.04 (I'm noticing on a non-SD 20.04 server that even stuff like |
On the base 20.04.1 LTS VM, there are no snaps installed by default. Since we don't use snap for the SD package dependencies, there are none installed on Xenial currently either. It's possible that in future Ubuntu versions we might be constrained to use it to satisfy application dependencies but right now (and for the duration of 20.04 support, probably) it's not required. Given that in general we want to maintain a minimal set of packages for security reasons, we want to discourage admins from installing additional applications, and we want to keep our provisioning story simple, it seems like a good candidate for removal (most likely in the prepare-servers role called early by the playbook). |
We discussed this during sprint planning today and agreed that it's worth doing, assuming we don't discover unintended side effects. Since it's only relevant to Focal, we agreed it can potentially wait until 1.8.0 or later. |
Considering as a stretch goal for 1.8.0, once other Focal requirements are met. |
Here are some reccos from a different Kevin, which I have not yet tried and which may apply more for desktop Ubuntu: https://www.kevin-custer.com/blog/disabling-snaps-in-ubuntu-20-04/ |
Also removes the related apparmor configuration.
Seeing a test failure on Focal for this, but only on Qubes staging VMs, created from ISO. Test failure looks like:
The specific lines causing the test to fail are:
We have a PR up in #5784, only documenting this to point out that it's another small divergence between ISOs and Vagrant boxes. |
Also removes the related apparmor configuration.
Also removes the related apparmor configuration.
Fixes #5128 removes snappy from the default installation
Description
Ubuntu 16.04 includes the snappy package manager, an alternative package management system that allows applications to be installed along with their dependencies in a single bundle. It's not used by SecureDrop and could be removed during the initial server setup, thereby reducing the overall attack surface.
User Research Evidence
None, this is not a user-facing issue.
User Stories
As a SecureDrop admin, I want the system to only include tools and packages required by SecureDrop.
The text was updated successfully, but these errors were encountered: