← Back to issue list

snap may execute host, not wrapped, executables

View original Launchpad issue

Metadata

Project
snapcraft (launchpad)
Number
#1681152
Type
issue
State
open
Author
~cgull
Labels
—
Created
Updated
Closed
—

Current evaluation

Classic snap wrappers may execute host binaries instead of snap payloads; a concrete mosh reproducer exists, but no triage followed and later PATH-related work may apply.

Suggested action: needs triage

Reason: The mosh reproduction shows both wrapped commands reporting the host version when a newer version is installed in the classic snap. There are no labels, maintainer comments, or activity after filing, and although commit 343ac2862 (snapcraft#2889) explicitly worked around the classic PATH bug, its exact coverage of this 2018 behavior was not established.

Evaluated by: mr-cal-bot

Impact: 55 Quick Win: 21 Complexity: 35 Confidence: 78 Actionability: 60

Issue body

In working on mosh for Snapcraft, I discovered that when you invoke wrapped executables in /snap/bin, the host's executable may be run instead. I suspect this is a classic-only bug. Repro: apt install mosh # this will install a release version of mosh, such as mosh-1.3.0 git clone -b snapcraft https://github.com/elopio/mosh cd mosh snapcraft sudo snap install mosh_master_amd64.snap --classic --dangerous # this installs a devel version such as mosh-1.3.0-11-g42a7a0c-dirty sudo snap alias mosh mosh sudo snap alias mosh mosh-client sudo snap alias mosh mosh-server /snap/bin/mosh --version # perl script reports mosh-1.3.0 /snap/bin/mosh-client --version # executable reports mosh-1.3.0 It appears that snap is not using an absolute path to run the wrapped executable. This is related to Bug #1670388 and Bug #1670749 but I think it's a distinct issue. One workaround is to set environment.PATH in snapcraft.yaml to $SNAP/bin:$PATH, but I do expect a wrapper to execute the correct executable, and setting PATH may cause problems.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 55
Quick Win: 21
Complexity: 35
Confidence: 78
Actionability: 60
needs triage Classic snap wrappers may execute host binaries instead of snap payloads; a concrete mosh reproducer exists, but no triage followed and later PATH-related work may apply.
qwen/qwen3.6-35b-a3b
Impact: 30
Quick Win: 4
Complexity: 60
Confidence: 60
Actionability: 30
close not a bug Classic snap command wrappers in /snap/bin may execute host executables instead of snap versions due to snapd PATH handling; open 9+ years with no maintainer response.
qwen/qwen3.8-27b
Impact: 30
Quick Win: 16
Staleness: 95
Complexity: 45
Confidence: 72
Support Request: 10
close stale Classic-confinement snap wrappers in /snap/bin may execute host executables instead of the snap's wrapped ones due to PATH resolution. Reported 2017, no maintainer interaction, no labels. Workaround (snapcraft-runner) merged in PR #2889.
qwen/qwen3.6-35b-a3b
Staleness: 100
Complexity: 30
Confidence: 90
Support Request: 0
close stale Bug report stating snap wrappers in /snap/bin may execute host executables instead of snap-wrapped ones. Unlabeled, no maintainer interaction, inactive for over 9 years.
qwen/qwen3.6-35b-a3b
Staleness: 98
Complexity: 45
Confidence: 85
Support Request: 5
close stale Bug where snap wrapper scripts in /snap/bin execute host binaries instead of snap-wrapped ones. Untriaged, inactive for over 9 years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 98
Complexity: 40
Confidence: 90
Support Request: 5
close stale Reports a bug where snap-wrapped executables in /snap/bin run the host version instead of the snap's. Unlabeled, unassigned, and has had zero maintainer interaction for over 9 years.

Update history

Date Change
created

Related work

  • Likely Fixed By: snapcraft#2889 (confidence 72%)

    Commit 343ac2862 is titled "meta: always generate snapcraft-runner to workaround classic PATH bug" and appears closely related, but its coverage of this report needs verification.

Related issues

No related issues found above the similarity threshold.