snapcraft produces snaps with dangling external symlinks
Metadata
Current evaluation
Closed without a linked fix; libc symlinks were to be whitelisted in click-review-tools, but Java cacerts still required unpacking and manually replacing the link.
Resolution: —
Reason: No resolving PR, commit, or release was linked. The final maintainer comment said click-review-tools was being added to whitelist libc links, while the documented Java cacerts workaround remained manual.
Evaluated by: mr-cal-bot
No scores available.
Issue body
I used snapcraft to package minecraft (to test security policy on a non-trivial java program). Here is the bzr tree: lp:~jdstrand/+junk/minecraft-snap
$ click-review minecraft_0.1_amd64.snap
Errors
------
- lint_external_symlinks
package contains external symlinks: /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_nis.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_hesiod.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libresolv.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libutil.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libcidn.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnsl.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_files.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libBrokenLocale.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_dns.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_compat.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/librt.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libm.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libthread_db.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libcrypt.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libdl.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libnss_nisplus.so, /tmp/clickreview-fo5rcfjk/usr/lib/x86_64-linux-gnu/libanl.so, /tmp/clickreview-fo5rcfjk/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts
This check in the review tools is looking at the symlink in the unpacked snap and seeing if they point outside of the snap's directories. The goal of the check is to point out problems when installing a snap on a minimal system like Ubuntu Core where the target files may not exist. For example, after installing the snap, /apps/minecraft.sideload/current/usr/lib/jvm/java-7-openjdk-amd64/jre/lib/security/cacerts is a dangling symlink to the non-existent /etc/ssl/certs/java/cacerts.
This is not a security issue because AppArmor will resolve the symlinks before applying policy.
This is known to at least affect 'stage-packages: openjdk-7-jre-headless' and 'type: python3-project'
WORKAROUND: if you have a snap that does this, use snapcraft, run the review tools on it to see the list external symlinks, then unpack the snap, remove the external symlinks, then repack the snap.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | — | Closed without a linked fix; libc symlinks were to be whitelisted in click-review-tools, but Java cacerts still required unpacking and manually replacing the link. | |
| stealth/space-bunny-alpha | — | closed stale | Closed without a linked fix; only a manual symlink-removal workaround was documented, despite plans to whitelist libc links in click-review-tools. | |
| stealth/space-bunny-alpha | — | closed stale | Closed without a fix: snapcraft#1500505 had no linked PR, commit, or maintainer resolution; only a manual unpack, remove-symlinks, and repack workaround was provided. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. Snapcraft generated snaps with dangling external symlinks for system libraries and Java components. A manual unpack, remove, and repack workaround was provided, but no upstream fix was implemented. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution. The report flagged linting warnings for dangling external symlinks in snaps using OpenJDK or Python projects. The author noted it is not a security issue and provided a manual workaround. The report was abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without resolution, likely abandoned or superseded. The author provided a manual unpack, symlink removal, and repack workaround for snaps containing dangling external symlinks. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
snapcraft#5432
(confidence 95%)
Later open request for an external-symlink linter; it did not resolve this older report.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1650686 Some symlinks not properly fixed up | snapcraft (launchpad) | closed | Closed as stale in September 2017 after the reporter could not reproduce the problem; no Snapcraft fix was identified. |