Inconsistent output for "snap refresh"/"snap refresh <specific_snap>"

Bug #1928567 reported by Markus Ueberall
44
This bug affects 9 people
Affects Status Importance Assigned to Milestone
snapd
Triaged
Medium
Unassigned

Bug Description

Using "snap set core experimental.refresh-app-awareness=true" (see https://snapcraft.io/blog/experimental-feature-snap-refresh-awareness-and-update-inhibition), "snap refresh" will not print an error message for snaps that cannot be refreshed while "snap refresh <specific_snap>" will.

Example: With snap "lxd" installed and running containers, snapd would previously shut down those and possibly restart them afterwards. Now, (tested with snapd 2.50 on Ubuntu 20.04LTS, arm64/amd64 architectures) what you get to see is
 * "snap refresh" --> "All snaps up to date."
 * "snap refresh lxd" --> "error: cannot refresh "lxd": snap "lxd" has running apps (lxc)"

While the current behaviour is IMHO very much in line with the feature definition ("ensure the least amount of disruption to your work") *now*, the output of both commands above should be identical (e.g. always showing errors for "non-refreshable" snaps) in said situation.

Tags: issue security

CVE References

Changed in snapd:
importance: Undecided → High
status: New → Triaged
Changed in snapd:
importance: High → Medium
Revision history for this message
Steve Ulrich (u-ubuntu-b) wrote :

This is a security issue!
I just had a vuln. package on my system. fixed version already in store. snap telling me "All snaps up to date".
So I can never be sure, my system is up to date until I go through all my snaps by hand.

tags: added: issue security
Revision history for this message
Harm van Bakel (hvbakel) wrote :

Note that the combination of this bug and https://bugs.launchpad.net/snapd/+bug/2019158 may lead a sizable fraction of users to believe they are using an up-to-date version of firefox when there are in fact pending updates. That is a concern given e.g. the recent CVE-2023-4863 that is being exploited in the wild.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.