← Back to issue list

Symlinks to libc are followed by the dump and copy plugins

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1658774
Type
issue
State
closed
Author
~kyrofa
Labels
—
Created
Updated
Closed

Current evaluation

Merged snapcraft#1174 as commit 2b8bac953, changing copy and dump plugins to ignore staged-package symlinks to libc instead of following or removing them.

Resolution: closed resolved

Reason: The replacement fix in merged PR snapcraft#1174, commit 2b8bac953, preserves libc symlinks while preventing plugins from following them. The earlier removal approach in #1100 had been reverted by #1146.

Evaluated by: mr-cal-bot

No scores available.

Issue body

Snapcraft has some special-case code where, if a stage-package is pulled with symlinks to libraries contained within libc, snapcraft allows them to dangle knowing that they'll be pointing to (hopefully) valid locations once run. However, the various plugins in snapcraft also have code that checks for dangling symlinks, and rewrites (or follows) them as necessary to make sure the snap won't be broken once run. This is conflicting logic, and it particularly comes to light when using content sharing. When trying to build a content consumer by tarring the producer's staging area and adding it as a part to the consumer, the plugins follow the symlinks that are dangling in the producer, copying libc in from the system. Which means if any other part in the consumer stages something that has symlinks to libc again (which are left dangling), they conflict with the parts that were already staged. To overcome this whole issue, ideally snapcraft could simply _remove_ symlinks to libc. However, as discussed in the comments below this doesn't work in practice. Therefore, the plugins that rewrite/follow symlinks need to be updated to allow libc symlinks to pass through.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved Merged snapcraft#1174 as commit 2b8bac953, changing copy and dump plugins to ignore staged-package symlinks to libc instead of following or removing them.
stealth/space-bunny-alpha — closed resolved Fixed by merged PR #1174 (commit 2b8bac953): copy/dump plugins now ignore libc symlinks instead of following them. The earlier removal fix in #1100 was reverted by #1146.
stealth/space-bunny-alpha — closed resolved Fixed by merged PR canonical/snapcraft#1174 (commit 2b8bac9): copy and dump now preserve libc symlinks instead of following or rewriting them.
qwen/qwen3.6-35b-a3b — — Abandoned without resolution. Proposed updating dump and copy plugins to allow dangling libc symlinks to pass through instead of following or rewriting them.
qwen/qwen3.6-35b-a3b — — Closed. Fixed by updating dump and copy plugins to allow libc symlinks to pass through, preventing content sharing conflicts.
qwen/qwen3.6-35b-a3b — — Abandoned. Dump and copy plugins incorrectly followed libc symlinks, causing content sharing conflicts. The proposed fix to allow these symlinks to pass through was never implemented.
qwen3.6-35b-a3b-mtp-q6 — — Closed without resolution. The dump and copy plugins were not updated to allow libc symlinks to pass through, leaving the content sharing conflict unresolved.

Update history

Date Change
created

Related work

  • Likely Fixed By: snapcraft#1174 (confidence 100%)

    Merged fix implementing the final ignore-libc-symlinks behavior.

  • Superseded By: snapcraft#1174 (confidence 100%)

    Superseded the ineffective symlink-removal approach from #1100.

  • Caused By: launchpad#1665089 (confidence 95%)

    The earlier #1100 fix caused a classic-confinement build regression and was reverted by #1146.

Related issues

Issue Project State Summary Similarity
#1174 copy, dump plugin: ignore symlinks to libc. snapcraft merged Merged as 2b8bac953: copy and dump plugins now ignore, rather than follow or remove, staged-package symlinks to libc.
87%
#1614913 FAIL: test_dump_symlinks (snapcraft.tests.test_plugin_dump.DumpPluginTestCase) snapcraft (launchpad) closed Fixed by merged PR snapcraft#767 (commit d14329836), which copied common.SNAPCRAFT_FILES before use, preventing leaked test state from breaking dump symlink tests.
76%
#209 Added symlinks option to the copy plugin snapcraft closed Closed unmerged in favor of redesigning copy-plugin symlink handling; commit b332715a8 later added following for symlinks pointing outside the snap.
74%
#1532515 Copy plugin should follow symlinks that point outside of the snap snapcraft (launchpad) closed Merged in canonical/snapcraft#426 (commit b332715a8): the copy plugin now follows absolute and part-external symlinks so copied targets remain valid inside the snap.
72%
#426 Copy plugin: Follow symlinks if outside of snap. snapcraft merged Merged in canonical/snapcraft#426 (b332715a8), following absolute or out-of-part symlinks to prevent broken links and fix LP #1532515.
71%
#1597600 Replace "copy" plugin by "dump" with std conventions snapcraft (launchpad) closed Merged snapcraft#712 in commit b86965088, adding the standard dump plugin to extract an entire part source into the install directory.
71%
#1754010 Dump follows symlink and fails snapcraft (launchpad) open Snapcraft 2.39.3's dump plugin dereferenced an in-tree directory symlink during staging and crashed. Later symlink-preservation fixes and current no-dereference behavior resolve the defect, but the tracker remains open.
70%