{"action":"created","comment":{"url":"https://api.github.com/repos/snapcore/snapd/pulls/comments/194762417","pull_request_review_id":127994157,"id":194762417,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5NDc2MjQxNw==","diff_hunk":"@@ -60,6 +60,11 @@ const dockerSupportConnectedPlugAppArmor = `\n /{,var/}run/runc/       rw,\n /{,var/}run/runc/**     mrwklix,\n \n+# Socket for docker-container-shim\n+unix (bind,listen) type=stream addr=\"@/containerd-shim/moby/*/shim.sock\\x00\",","path":"interfaces/builtin/docker_support.go","position":5,"original_position":5,"commit_id":"ec14ecacedccdafcef10eb832b473f477f1af887","original_commit_id":"ec14ecacedccdafcef10eb832b473f477f1af887","user":{"login":"anonymouse64","id":6006573,"node_id":"MDQ6VXNlcjYwMDY1NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/6006573?v=4","gravatar_id":"","url":"https://api.github.com/users/anonymouse64","html_url":"https://github.com/anonymouse64","followers_url":"https://api.github.com/users/anonymouse64/followers","following_url":"https://api.github.com/users/anonymouse64/following{/other_user}","gists_url":"https://api.github.com/users/anonymouse64/gists{/gist_id}","starred_url":"https://api.github.com/users/anonymouse64/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anonymouse64/subscriptions","organizations_url":"https://api.github.com/users/anonymouse64/orgs","repos_url":"https://api.github.com/users/anonymouse64/repos","events_url":"https://api.github.com/users/anonymouse64/events{/privacy}","received_events_url":"https://api.github.com/users/anonymouse64/received_events","type":"User","site_admin":false},"body":"`moby` here is the new name of the docker project (i.e. see this [post](https://blog.docker.com/2017/04/introducing-the-moby-project/) and the fact that the old [github.com/docker/docker](https://github.com/docker/docker) is now [github.com/moby/moby](https://github.com/moby/moby) ). I would say it's unlikely to change, but since docker changed to moby I guess it is possible it could be changed to something else. I can change if if y'all think it should be changed, but I'm leaning towards leaving it as is with moby there.","created_at":"2018-06-12T14:35:01Z","updated_at":"2018-06-12T14:35:01Z","html_url":"https://github.com/snapcore/snapd/pull/5292#discussion_r194762417","pull_request_url":"https://api.github.com/repos/snapcore/snapd/pulls/5292","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/snapcore/snapd/pulls/comments/194762417"},"html":{"href":"https://github.com/snapcore/snapd/pull/5292#discussion_r194762417"},"pull_request":{"href":"https://api.github.com/repos/snapcore/snapd/pulls/5292"}},"in_reply_to_id":194185738},"pull_request":{"url":"https://api.github.com/repos/snapcore/snapd/pulls/5292","id":193717658,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkzNzE3NjU4","html_url":"https://github.com/snapcore/snapd/pull/5292","diff_url":"https://github.com/snapcore/snapd/pull/5292.diff","patch_url":"https://github.com/snapcore/snapd/pull/5292.patch","issue_url":"https://api.github.com/repos/snapcore/snapd/issues/5292","number":5292,"state":"open","locked":false,"title":"interfaces/docker-support: update for docker 18.05","user":{"login":"anonymouse64","id":6006573,"node_id":"MDQ6VXNlcjYwMDY1NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/6006573?v=4","gravatar_id":"","url":"https://api.github.com/users/anonymouse64","html_url":"https://github.com/anonymouse64","followers_url":"https://api.github.com/users/anonymouse64/followers","following_url":"https://api.github.com/users/anonymouse64/following{/other_user}","gists_url":"https://api.github.com/users/anonymouse64/gists{/gist_id}","starred_url":"https://api.github.com/users/anonymouse64/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anonymouse64/subscriptions","organizations_url":"https://api.github.com/users/anonymouse64/orgs","repos_url":"https://api.github.com/users/anonymouse64/repos","events_url":"https://api.github.com/users/anonymouse64/events{/privacy}","received_events_url":"https://api.github.com/users/anonymouse64/received_events","type":"User","site_admin":false},"body":"During the time between 17.09 (the most recent docker release to be snapped) and 18.05 release of docker community edition, docker now starts another background process and that process listens on `/containerd-shim/moby/$UUID/shim.sock\\x00`. Note that the NUL byte at the end is important for reasons I don't entirely understand - other similar apparmor profiles for listening/binding on sockets don't need this NUL byte, but for some reason or another this one does (I couldn't get it to work without it there).\r\n\r\nRegarding the access to `/run/mount/utab`; I can't say I know why the docker daemon now attempts to access this, but the `docker-support` interface already allows so much I don't see how this could be exploited in a way that's not already exploitable. But docker does seem to run fine without this there, so it could be removed if so desired.\r\n\r\nLastly, there is still a denial I see with `snappy-debug.security scanlog docker` for `kmod`:\r\n```\r\n[12799.114438] audit: type=1400 audit(1528490047.492:679): apparmor=\"DENIED\" operation=\"exec\" profile=\"snap.docker.dockerd\" name=\"/bin/kmod\" pid=4375 comm=\"dockerd\" requested_mask=\"x\" denied_mask=\"x\" fsuid=0 ouid=0\r\n```\r\nbut I'm not sure if this should be resolved or not, as the current daemon script implies that loading kernel modules directly from a snap always fails, and works around this [like so](https://github.com/docker/docker-snap/blob/master/bin/dockerd-wrapper#L43). ","created_at":"2018-06-08T20:37:26Z","updated_at":"2018-06-12T14:35:01Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5807ec2d49ef8b57a03dc4e815391a78ba7f03d7","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/snapcore/snapd/pulls/5292/commits","review_comments_url":"https://api.github.com/repos/snapcore/snapd/pulls/5292/comments","review_comment_url":"https://api.github.com/repos/snapcore/snapd/pulls/comments{/number}","comments_url":"https://api.github.com/repos/snapcore/snapd/issues/5292/comments","statuses_url":"https://api.github.com/repos/snapcore/snapd/statuses/ec14ecacedccdafcef10eb832b473f477f1af887","head":{"label":"anonymouse64:docker-support-interface-18-05-update","ref":"docker-support-interface-18-05-update","sha":"ec14ecacedccdafcef10eb832b473f477f1af887","user":{"login":"anonymouse64","id":6006573,"node_id":"MDQ6VXNlcjYwMDY1NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/6006573?v=4","gravatar_id":"","url":"https://api.github.com/users/anonymouse64","html_url":"https://github.com/anonymouse64","followers_url":"https://api.github.com/users/anonymouse64/followers","following_url":"https://api.github.com/users/anonymouse64/following{/other_user}","gists_url":"https://api.github.com/users/anonymouse64/gists{/gist_id}","starred_url":"https://api.github.com/users/anonymouse64/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anonymouse64/subscriptions","organizations_url":"https://api.github.com/users/anonymouse64/orgs","repos_url":"https://api.github.com/users/anonymouse64/repos","events_url":"https://api.github.com/users/anonymouse64/events{/privacy}","received_events_url":"https://api.github.com/users/anonymouse64/received_events","type":"User","site_admin":false},"repo":{"id":131676874,"node_id":"MDEwOlJlcG9zaXRvcnkxMzE2NzY4NzQ=","name":"snapd","full_name":"anonymouse64/snapd","owner":{"login":"anonymouse64","id":6006573,"node_id":"MDQ6VXNlcjYwMDY1NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/6006573?v=4","gravatar_id":"","url":"https://api.github.com/users/anonymouse64","html_url":"https://github.com/anonymouse64","followers_url":"https://api.github.com/users/anonymouse64/followers","following_url":"https://api.github.com/users/anonymouse64/following{/other_user}","gists_url":"https://api.github.com/users/anonymouse64/gists{/gist_id}","starred_url":"https://api.github.com/users/anonymouse64/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anonymouse64/subscriptions","organizations_url":"https://api.github.com/users/anonymouse64/orgs","repos_url":"https://api.github.com/users/anonymouse64/repos","events_url":"https://api.github.com/users/anonymouse64/events{/privacy}","received_events_url":"https://api.github.com/users/anonymouse64/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/anonymouse64/snapd","description":"The snapd and snap tools enable systems to work with .snap files.","fork":true,"url":"https://api.github.com/repos/anonymouse64/snapd","forks_url":"https://api.github.com/repos/anonymouse64/snapd/forks","keys_url":"https://api.github.com/repos/anonymouse64/snapd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/anonymouse64/snapd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/anonymouse64/snapd/teams","hooks_url":"https://api.github.com/repos/anonymouse64/snapd/hooks","issue_events_url":"https://api.github.com/repos/anonymouse64/snapd/issues/events{/number}","events_url":"https://api.github.com/repos/anonymouse64/snapd/events","assignees_url":"https://api.github.com/repos/anonymouse64/snapd/assignees{/user}","branches_url":"https://api.github.com/repos/anonymouse64/snapd/branches{/branch}","tags_url":"https://api.github.com/repos/anonymouse64/snapd/tags","blobs_url":"https://api.github.com/repos/anonymouse64/snapd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/anonymouse64/snapd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/anonymouse64/snapd/git/refs{/sha}","trees_url":"https://api.github.com/repos/anonymouse64/snapd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/anonymouse64/snapd/statuses/{sha}","languages_url":"https://api.github.com/repos/anonymouse64/snapd/languages","stargazers_url":"https://api.github.com/repos/anonymouse64/snapd/stargazers","contributors_url":"https://api.github.com/repos/anonymouse64/snapd/contributors","subscribers_url":"https://api.github.com/repos/anonymouse64/snapd/subscribers","subscription_url":"https://api.github.com/repos/anonymouse64/snapd/subscription","commits_url":"https://api.github.com/repos/anonymouse64/snapd/commits{/sha}","git_commits_url":"https://api.github.com/repos/anonymouse64/snapd/git/commits{/sha}","comments_url":"https://api.github.com/repos/anonymouse64/snapd/comments{/number}","issue_comment_url":"https://api.github.com/repos/anonymouse64/snapd/issues/comments{/number}","contents_url":"https://api.github.com/repos/anonymouse64/snapd/contents/{+path}","compare_url":"https://api.github.com/repos/anonymouse64/snapd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/anonymouse64/snapd/merges","archive_url":"https://api.github.com/repos/anonymouse64/snapd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/anonymouse64/snapd/downloads","issues_url":"https://api.github.com/repos/anonymouse64/snapd/issues{/number}","pulls_url":"https://api.github.com/repos/anonymouse64/snapd/pulls{/number}","milestones_url":"https://api.github.com/repos/anonymouse64/snapd/milestones{/number}","notifications_url":"https://api.github.com/repos/anonymouse64/snapd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/anonymouse64/snapd/labels{/name}","releases_url":"https://api.github.com/repos/anonymouse64/snapd/releases{/id}","deployments_url":"https://api.github.com/repos/anonymouse64/snapd/deployments","created_at":"2018-05-01T04:38:39Z","updated_at":"2018-06-11T13:38:14Z","pushed_at":"2018-06-11T13:39:14Z","git_url":"git://github.com/anonymouse64/snapd.git","ssh_url":"git@github.com:anonymouse64/snapd.git","clone_url":"https://github.com/anonymouse64/snapd.git","svn_url":"https://github.com/anonymouse64/snapd","homepage":"","size":65151,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"gpl-3.0","name":"GNU General Public License v3.0","spdx_id":"GPL-3.0","url":"https://api.github.com/licenses/gpl-3.0","node_id":"MDc6TGljZW5zZTk="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"snapcore:master","ref":"master","sha":"df9930f71c8c39c15b7348d6cde9eaea98d27c5a","user":{"login":"snapcore","id":19532717,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE5NTMyNzE3","avatar_url":"https://avatars1.githubusercontent.com/u/19532717?v=4","gravatar_id":"","url":"https://api.github.com/users/snapcore","html_url":"https://github.com/snapcore","followers_url":"https://api.github.com/users/snapcore/followers","following_url":"https://api.github.com/users/snapcore/following{/other_user}","gists_url":"https://api.github.com/users/snapcore/gists{/gist_id}","starred_url":"https://api.github.com/users/snapcore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snapcore/subscriptions","organizations_url":"https://api.github.com/users/snapcore/orgs","repos_url":"https://api.github.com/users/snapcore/repos","events_url":"https://api.github.com/users/snapcore/events{/privacy}","received_events_url":"https://api.github.com/users/snapcore/received_events","type":"Organization","site_admin":false},"repo":{"id":44672744,"node_id":"MDEwOlJlcG9zaXRvcnk0NDY3Mjc0NA==","name":"snapd","full_name":"snapcore/snapd","owner":{"login":"snapcore","id":19532717,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE5NTMyNzE3","avatar_url":"https://avatars1.githubusercontent.com/u/19532717?v=4","gravatar_id":"","url":"https://api.github.com/users/snapcore","html_url":"https://github.com/snapcore","followers_url":"https://api.github.com/users/snapcore/followers","following_url":"https://api.github.com/users/snapcore/following{/other_user}","gists_url":"https://api.github.com/users/snapcore/gists{/gist_id}","starred_url":"https://api.github.com/users/snapcore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snapcore/subscriptions","organizations_url":"https://api.github.com/users/snapcore/orgs","repos_url":"https://api.github.com/users/snapcore/repos","events_url":"https://api.github.com/users/snapcore/events{/privacy}","received_events_url":"https://api.github.com/users/snapcore/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/snapcore/snapd","description":"The snapd and snap tools enable systems to work with .snap files.","fork":false,"url":"https://api.github.com/repos/snapcore/snapd","forks_url":"https://api.github.com/repos/snapcore/snapd/forks","keys_url":"https://api.github.com/repos/snapcore/snapd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/snapcore/snapd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/snapcore/snapd/teams","hooks_url":"https://api.github.com/repos/snapcore/snapd/hooks","issue_events_url":"https://api.github.com/repos/snapcore/snapd/issues/events{/number}","events_url":"https://api.github.com/repos/snapcore/snapd/events","assignees_url":"https://api.github.com/repos/snapcore/snapd/assignees{/user}","branches_url":"https://api.github.com/repos/snapcore/snapd/branches{/branch}","tags_url":"https://api.github.com/repos/snapcore/snapd/tags","blobs_url":"https://api.github.com/repos/snapcore/snapd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/snapcore/snapd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/snapcore/snapd/git/refs{/sha}","trees_url":"https://api.github.com/repos/snapcore/snapd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/snapcore/snapd/statuses/{sha}","languages_url":"https://api.github.com/repos/snapcore/snapd/languages","stargazers_url":"https://api.github.com/repos/snapcore/snapd/stargazers","contributors_url":"https://api.github.com/repos/snapcore/snapd/contributors","subscribers_url":"https://api.github.com/repos/snapcore/snapd/subscribers","subscription_url":"https://api.github.com/repos/snapcore/snapd/subscription","commits_url":"https://api.github.com/repos/snapcore/snapd/commits{/sha}","git_commits_url":"https://api.github.com/repos/snapcore/snapd/git/commits{/sha}","comments_url":"https://api.github.com/repos/snapcore/snapd/comments{/number}","issue_comment_url":"https://api.github.com/repos/snapcore/snapd/issues/comments{/number}","contents_url":"https://api.github.com/repos/snapcore/snapd/contents/{+path}","compare_url":"https://api.github.com/repos/snapcore/snapd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/snapcore/snapd/merges","archive_url":"https://api.github.com/repos/snapcore/snapd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/snapcore/snapd/downloads","issues_url":"https://api.github.com/repos/snapcore/snapd/issues{/number}","pulls_url":"https://api.github.com/repos/snapcore/snapd/pulls{/number}","milestones_url":"https://api.github.com/repos/snapcore/snapd/milestones{/number}","notifications_url":"https://api.github.com/repos/snapcore/snapd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/snapcore/snapd/labels{/name}","releases_url":"https://api.github.com/repos/snapcore/snapd/releases{/id}","deployments_url":"https://api.github.com/repos/snapcore/snapd/deployments","created_at":"2015-10-21T11:51:46Z","updated_at":"2018-06-12T09:27:24Z","pushed_at":"2018-06-12T13:44:12Z","git_url":"git://github.com/snapcore/snapd.git","ssh_url":"git@github.com:snapcore/snapd.git","clone_url":"https://github.com/snapcore/snapd.git","svn_url":"https://github.com/snapcore/snapd","homepage":"","size":65179,"stargazers_count":949,"watchers_count":949,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":237,"mirror_url":null,"archived":false,"open_issues_count":36,"license":{"key":"gpl-3.0","name":"GNU General Public License v3.0","spdx_id":"GPL-3.0","url":"https://api.github.com/licenses/gpl-3.0","node_id":"MDc6TGljZW5zZTk="},"forks":237,"open_issues":36,"watchers":949,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/snapcore/snapd/pulls/5292"},"html":{"href":"https://github.com/snapcore/snapd/pull/5292"},"issue":{"href":"https://api.github.com/repos/snapcore/snapd/issues/5292"},"comments":{"href":"https://api.github.com/repos/snapcore/snapd/issues/5292/comments"},"review_comments":{"href":"https://api.github.com/repos/snapcore/snapd/pulls/5292/comments"},"review_comment":{"href":"https://api.github.com/repos/snapcore/snapd/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/snapcore/snapd/pulls/5292/commits"},"statuses":{"href":"https://api.github.com/repos/snapcore/snapd/statuses/ec14ecacedccdafcef10eb832b473f477f1af887"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"anonymouse64"}}