Don't set security.syscalls.intercept.mknod=true for LXD provider
Metadata
Current evaluation
Resolved by merged PR #717 (commit 6ceb498), released in 2.2.0: LXDProvider gained an intercept_mknod option so applications can disable automatic mknod interception.
Resolution: closed resolved
Reason: PR #717 was merged and added an intercept_mknod option to LXDProvider, allowing dependent applications to override the previous automatic behavior. The change shipped in version 2.2.0.
Evaluated by: mr-cal-bot
No scores available.
Issue body
https://github.com/canonical/craft-providers/blob/c293be3f534afa5fda47d6ac2ba4859ad1775b07/craft_providers/lxd/lxd_instance.py#L405 sets security.syscalls.intercept.mknod=true when it detects the host supports this - however, this seems to break some usecases - and this setting is also not set by default by LXD normally on new containers - so it would be better to NOT automatically set this even if it is supported - OR to provide a way for users of tools like lpcraft / snapcraft etc to override it easily.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Resolved by merged PR #717 (commit 6ceb498), released in 2.2.0: LXDProvider gained an intercept_mknod option so applications can disable automatic mknod interception. | |
| qwen/qwen3.6-35b-a3b | — | closed resolved | Resolved by PR #717, making mknod intercept configurable instead of automatically enabled in LXDProvider. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Likely Fixed By:
canonical/craft-providers#717
(confidence 100%)
Merged PR #717 made LXD mknod interception configurable; implemented in commit 6ceb498 and released in 2.2.0.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #3218 lxd: enable security.syscalls.intercept.mknod if supported to allow snaps to create some device nodes | snapcraft | merged | Merged PR #3218 enabled LXD mknod interception only on supported kernels, allowing safe device-node creation while preserving compatibility with hosts such as Ubuntu 16.04. | |
| #717 feat: mknod intercepts now configurable from LXDProvider | craft-providers | merged | Merged #717, adding an intercept_mknod option to LXDProvider so dependent applications can enable or disable LXD mknod interception; released in 2.2.0. | |
| #482 fix: workaround for mknod in lxd | imagecraft | merged | Merged into main. Implements a mknod shim to bypass inconsistent mknod behavior in LXD, resolving issue #489. |