revert: "interfaces/lxd-support: add support for allow all in AppArmr (#14251)"

[sergiocazzolato]

This reverts commit 4a0c15d.

The revert is required because this change produced the following issue when uninstalling snapcraft:
https://bugs.launchpad.net/snapd/+bug/2077101

[alexmurray]

Thanks for this, apologies for the regression.

[ernestl]

Thanks

[tomponline]

@alexmurray does this mean we wont need to switch to lxd-support-with-unconfined-mode from canonical/lxd-pkg-snap#277

[alexmurray]

@tomponline well this got reverted (since I hadn't realised we would need some equivalent changes on the lxd snap side to handle this new type of confinement) - so we still need to use the unconfined-mode until I can rework this into a more complete solution.

[tomponline]

@alexmurray thanks, what additional changes are needed?

[alexmurray]

@tomponline since lxd tries to escape confinement, similar to the case where it is currently looking for either the unconfined AppArmor label or the (unconfined) profile mode, it would then need to recognise this allow_all mode and try to not escape confinement in this case (since it should already have all the required permissions from AppArmor). But given the experience with this PR here for snapd, I think it is clear I originally underestimated the integration work required between lxd and snapd, so this requires more careful consideration. However, since the current approach for LXD works well (and the new (unconfined) profile mode essentially acts as a substitute for the allow_all mode), there is no rush to implement this and I think it would end up as an item for the 25.04 roadmap if anything.

[tomponline]

there is no rush to implement this and I think it would end up as an item for the 25.04 roadmap if anything.

The only downside to the current approach is that the LXD snap needs to keep disabling restricted unprivileged namespaces system-wide right?

[alexmurray]

The only downside to the current approach is that the LXD snap needs to keep disabling restricted unprivileged namespaces system-wide right?

Yes, this is true. Given the current issues with the (unconfined) mode approach (ie since lxd now has an AppArmor label, it is not treated as label=unconfined anymore and hence its signals get blocked by AppArmor etc) I think we need to go back to the drawing board and figure out a better solution overall for LXD and its interaction with AppArmor, particularly when the userns restrictions are in place, as the current approach of disabling the restriction globally is not optimal.

[tomponline]

I think we need to go back to the drawing board and figure out a better solution overall for LXD and its interaction with AppArmor, particularly when the userns restrictions are in place, as the current approach of disabling the restriction globally is not optimal.

Agreed, thanks. Let us know when you are ready to discuss other approaches.