FM / snapd

/snap/snapd/27710/usr/lib/snapd

Name	Size	Mode	Actions
apparmor/	-	0755	rm
apparmor.d/	-	0755	rm
apparmor_parser	1700832	0755	edit dl rm
complete.sh	5394	0644	edit dl rm
etelpmoc.sh	7031	0644	edit dl rm
info	118	0644	edit dl rm
preseed.json	841	0644	edit dl rm
snap-bootstrap	13865297	0755	edit dl rm
snap-confine	218241	0755	edit dl rm
snap-confine.caps	143	0644	edit dl rm
snap-confine.v2-only.caps	121	0644	edit dl rm
snap-debug-info.sh	2372	0755	edit dl rm
snap-device-helper	67545	0755	edit dl rm
snap-discard-ns	51113	0755	edit dl rm
snap-exec	5616696	0755	edit dl rm
snap-failure	3219529	0755	edit dl rm
snap-fde-keymgr	5328969	0755	edit dl rm
snap-gdbserver-shim	1079280	0755	edit dl rm
snap-gpio-helper	3080265	0755	edit dl rm
snap-mgmt	22207	0755	edit dl rm
snap-mgmt-selinux	3269	0755	edit dl rm
snap-preseed	11771977	0755	edit dl rm
snap-recovery-chooser	9486409	0755	edit dl rm
snap-repair	8765513	0755	edit dl rm
snap-seccomp	3010897	0755	edit dl rm
snap-strace-shim	34273	0755	edit dl rm
snap-update-ns	6718584	0755	edit dl rm
snapctl	8455848	0755	edit dl rm
snapd	31965257	0755	edit dl rm
snapd-apparmor	2695241	0755	edit dl rm
snapd.core-fixup.sh	3826	0755	edit dl rm
snapd.run-from-snap	73	0755	edit dl rm
system-shutdown	38585	0755	edit dl rm

Edit: /snap/snapd/27710/usr/lib/snapd/snapd.core-fixup.sh (3826B)

#!/bin/sh

set -e

if ! grep -q "ID=ubuntu-core" /etc/os-release; then
    # this code is only relevant on ubuntu-core devices
    #
    # this script will only run via systemd if /writable/system-data
    # exists however we still add this check here in case people run
    # it manually
    exit 0
fi

# No fix-ups yet on UC20
if grep -q snapd_recovery_mode= /proc/cmdline; then
    exit 0
fi

# Workaround https://forum.snapcraft.io/t/5253
#
# We see sometimes corrupted uboot.env files created by fsck.vfat.
# On the fat filesystem they are indistinguishable because one
# has a fat16 name UBOOT.ENV (and not lfn (long-file-name)) but
# the other has a "uboot.env" lfn name and a FSCK0000.000 FAT16
# name. The only known workaround is to remove all dupes and put
# one file back in place.
if [ "$(find /boot/uboot -name uboot.env | wc -l)" -gt 1 ]; then
    echo "Corrupted uboot.env file detected"
    # Ensure we have one uboot.env to go back to. Note that it does
    # not matter which one we pick (we can't choose anyway, we get
    # whatever the kernel gives us). The key part is that there is
    # only a single one after this script finishes. The bootloader
    # logic will recover in any case.
    cp -a /boot/uboot/uboot.env /boot/uboot/uboot.env.save
    # now delete all dupes
    while ls /boot/uboot/uboot.env 2>/dev/null; do
        rm -f /boot/uboot/uboot.env
    done
    # and move the saved one into place
    mv /boot/uboot/uboot.env.save /boot/uboot/uboot.env

# ensure we sync the fs
    sync
fi

# The code below deals with incorrect permissions that happened on
# some buggy ubuntu-image versions.
#
# This needs to run only once so we can exit here.
if [ -f /var/lib/snapd/device/ownership-change.after ]; then
    exit 0
fi

# store important data in case we need it later
if [ ! -f /var/lib/snapd/device/ownership-change.before ]; then
    mkdir -p /var/lib/snapd/device
    find /etc/cloud /var/lib/cloud /var/lib/snapd -printf '%M %U %G %p\n' > /var/lib/snapd/device/ownership-change.before.tmp || true
    find  /writable/system-data /writable/system-data/var /writable/system-data/var/lib /writable/system-data/boot /writable/system-data/etc -maxdepth 0 -printf '%M %U %G %p\n' >> /var/lib/snapd/device/ownership-change.before.tmp || true
    mv /var/lib/snapd/device/ownership-change.before.tmp /var/lib/snapd/device/ownership-change.before
fi
    
# cleanup read/write files and directories (CVE-2017-10600)
for i in /etc/cloud /var/lib/cloud /var/lib/snapd ; do
  # restore ownership to root:root
  find "$i" $ -type f -o -type d -o -type l $ -a $ \! -uid 0 -o \! -gid 0 $ -print0 | \
    xargs -0 --no-run-if-empty chown -c --no-dereference root:root -- || true
done

# cleanup a few /writable directories without descending
for i in /writable/system-data /writable/system-data/var /writable/system-data/var/lib /writable/system-data/boot /writable/system-data/etc ; do
  # restore ownership to root:root
  find "$i" -maxdepth 0 $ \! -uid 0 -o \! -gid 0 -o -type l $ -print0 | \
    xargs -0 --no-run-if-empty chown -c --no-dereference root:root -- || true
done

# store permissions after manipulation, this is also used as the stamp file
# for the systemd service to ensure it is only run once
find /etc/cloud /var/lib/cloud /var/lib/snapd -printf '%M %U %G %p\n' > /var/lib/snapd/device/ownership-change.after.tmp
# Note: this find will fail on UC20 seeding because there is no
# /writable/system-data/boot
find  /writable/system-data /writable/system-data/var /writable/system-data/var/lib /writable/system-data/boot /writable/system-data/etc -maxdepth 0 -printf '%M %U %G %p\n' >> /var/lib/snapd/device/ownership-change.after.tmp
mv /var/lib/snapd/device/ownership-change.after.tmp /var/lib/snapd/device/ownership-change.after

# ensure things are really on disk
sync

cmd: