{"action":"created","issue":{"url":"https://api.github.com/repos/snapcore/snapd/issues/3963","repository_url":"https://api.github.com/repos/snapcore/snapd","labels_url":"https://api.github.com/repos/snapcore/snapd/issues/3963/labels{/name}","comments_url":"https://api.github.com/repos/snapcore/snapd/issues/3963/comments","events_url":"https://api.github.com/repos/snapcore/snapd/issues/3963/events","html_url":"https://github.com/snapcore/snapd/pull/3963","id":260425798,"number":3963,"title":"cmd/snap-confine: add support for per-user mounts","user":{"login":"jhenstridge","id":12724165,"avatar_url":"https://avatars2.githubusercontent.com/u/12724165?v=4","gravatar_id":"","url":"https://api.github.com/users/jhenstridge","html_url":"https://github.com/jhenstridge","followers_url":"https://api.github.com/users/jhenstridge/followers","following_url":"https://api.github.com/users/jhenstridge/following{/other_user}","gists_url":"https://api.github.com/users/jhenstridge/gists{/gist_id}","starred_url":"https://api.github.com/users/jhenstridge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhenstridge/subscriptions","organizations_url":"https://api.github.com/users/jhenstridge/orgs","repos_url":"https://api.github.com/users/jhenstridge/repos","events_url":"https://api.github.com/users/jhenstridge/events{/privacy}","received_events_url":"https://api.github.com/users/jhenstridge/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2017-09-25T21:48:34Z","updated_at":"2017-11-28T15:05:09Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/snapcore/snapd/pulls/3963","html_url":"https://github.com/snapcore/snapd/pull/3963","diff_url":"https://github.com/snapcore/snapd/pull/3963.diff","patch_url":"https://github.com/snapcore/snapd/pull/3963.patch"},"body":"This PR is a partial solution for the [per-user bind mounts](https://forum.snapcraft.io/t/can-interfaces-define-per-user-bind-mounts/501?u=jamesh) feature that is required to support xdg-desktop-portal.\r\n\r\nThe main requirements for xdg-desktop-portal were\r\n * bind mount a directory under $XDG_RUNTIME_DIR (which has a different value for each user of the system).\r\n * have that bind mount last no longer than the desktop session (since the source of the mount is from a FUSE daemon that will exit at that point).\r\n\r\nAt the same time, we still want to see changes to the persistent mount namespace made by `snap-update-ns`.  This branch tries to achieve this by doing the following:\r\n\r\n1. unshare(CLONE_NEWNS) to create a new mount namespace\r\n2. recursively remount '/' in \"slave\" mode so we see changes from the parent namespace but prevent changes from being sent in the other.\r\n3. make our bind mounts.\r\n\r\nThis branch still doesn't quite do everything I need for xdg-desktop-portal:\r\n\r\n* I think we need to be using the real $XDG_RUNTIME_DIR (i.e. `/run/user/$UID`) in the substitutions rather than the snap specific one.\r\n* The mount calls need to be done while running as the real uid, but holding CAP_SYS_ADMIN.  This is necessary so that the contents of a FUSE file system are visible."},"comment":{"url":"https://api.github.com/repos/snapcore/snapd/issues/comments/347551689","html_url":"https://github.com/snapcore/snapd/pull/3963#issuecomment-347551689","issue_url":"https://api.github.com/repos/snapcore/snapd/issues/3963","id":347551689,"user":{"login":"zyga","id":784262,"avatar_url":"https://avatars0.githubusercontent.com/u/784262?v=4","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"created_at":"2017-11-28T15:05:08Z","updated_at":"2017-11-28T15:05:08Z","author_association":"CONTRIBUTOR","body":"@jhenstridge I commented on the forum with a plan on how to bring this into feature parity with system mount namespaces https://forum.snapcraft.io/t/can-interfaces-define-per-user-bind-mounts/501/33"}}
{"actor":{"display_login":"zyga"}}