lxd: enable security.syscalls.intercept.mknod if supported to allow snaps to create some device nodes
Metadata
Current evaluation
Merged PR #3218 enabled LXD mknod interception only on supported kernels, allowing safe device-node creation while preserving compatibility with hosts such as Ubuntu 16.04.
Resolution: closed resolved
Reason: PR #3218 was merged. Commit e27a2280e enabled security.syscalls.intercept.mknod, while follow-up 5feaeff62 gated it on kernel support after unsupported 16.04 hosts failed; commit 42548cdb5 added spread-test coverage.
Evaluated by: mr-cal-bot
No scores available.
Issue body
- [x] Have you followed the [guidelines for contributing](https://github.com/snapcore/snapcraft/blob/master/CONTRIBUTING.md)?
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
- [x] Have you successfully run `./runtests.sh static`?
- [x] Have you successfully run `./runtests.sh tests/unit`?
-----
When building a bootable base snap, it is common to include a few device files in `/dev` for the benefit of anything running in early boot before udev/devtmpfs is available.
However, trying to build such a snap with the LXD build provider fails because the `mknod` syscall is blocked by default for unprivileged containers. LXD does provide a way to give unprivileged containers limited access to the syscall for device nodes it considers safe:
https://linuxcontainers.org/lxd/docs/master/syscall-interception#mknod-mknodat
This safe set of devices includes all of the ones included in the `core18` and `core20` snaps, so enabling it should allow bases like that to be built under LXD.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #3218 enabled LXD mknod interception only on supported kernels, allowing safe device-node creation while preserving compatibility with hosts such as Ubuntu 16.04. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #3218 enables LXD mknod interception only on supported kernels, allowing base snaps to create permitted device nodes without breaking hosts such as Ubuntu 16.04. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged PR #3218, enabling LXD mknod interception on supported kernels so base snaps can create permitted device nodes. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged LXD support for enabling mknod syscall interception, allowing snaps with device nodes to build on supported hosts (commit e27a2280e). | |
| qwen/qwen3.6-35b-a3b | — | — | Merged changes enabling LXD mknod syscall interception to allow snaps to create device nodes during boot. The update includes automatic detection for older kernels lacking interception support, resolving base snap build failures. Approved and passed CI. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged. Enables LXD's security.syscalls.intercept.mknod for snap device node creation. Adds kernel support detection to skip interception on older systems, resolving LXD build failures. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #191 Don't set security.syscalls.intercept.mknod=true for LXD provider | craft-providers | closed | Resolved by merged PR #717 (commit 6ceb498), released in 2.2.0: LXDProvider gained an intercept_mknod option so applications can disable automatic mknod interception. | |
| #482 fix: workaround for mknod in lxd | imagecraft | merged | Merged into main. Implements a mknod shim to bypass inconsistent mknod behavior in LXD, resolving issue #489. | |
| #717 feat: mknod intercepts now configurable from LXDProvider | craft-providers | merged | Merged #717, adding an intercept_mknod option to LXDProvider so dependent applications can enable or disable LXD mknod interception; released in 2.2.0. |