Merge pull request #4182 from ikeydoherty/os-release-denid

cmd/snap-confine: Ensure snap-confine is allowed to access os-release
canonical · Nov 9, 2017 · 941b6af · 941b6af
2 parents 10fcc00 + d9444a2
commit 941b6af
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/cmd/snap-confine/snap-confine.apparmor.in b/cmd/snap-confine/snap-confine.apparmor.in
@@ -213,6 +213,9 @@
     umount /var/lib/snapd/hostfs/proc/,
     mount options=(rw rslave) -> /var/lib/snapd/hostfs/,
 
+    # Allow reading the os-release file (possibly a symlink to /usr/lib).
+    /{etc/,usr/lib/}os-release r,
+
     # set up snap-specific private /tmp dir
     capability chown,
     /tmp/ w,