New release 2.71

• FDE: auto-repair when recovery key is used
• FDE: revoke keys on shim update
• FDE: revoke old TPM keys when dbx has been updated
• FDE: do not reseal FDE hook keys every time
• FDE: store keys in the kernel keyring when installing from initrd
• FDE: allow disabled DMA on Core
• FDE: snap-bootstrap: do not check for partition in scan-disk on CVM
• FDE: support secboot preinstall check for 25.10+ hybrid installs via the /v2/system/{label} endpoint
• FDE: support generating recovery key at install time via the /v2/systems/{label} endpoint
• FDE: update passphrase quality check at install time via the /v2/systems/{label} endpoint
• FDE: support replacing recovery key at runtime via the new /v2/system-volumes endpoint
• FDE: support checking recovery keys at runtime via the /v2/system-volumes endpoint
• FDE: support enumerating keyslots at runtime via the /v2/system-volumes endpoint
• FDE: support changing passphrase at runtime via the /v2/system-volumes endpoint
• FDE: support passphrase quality check at runtime via the /v2/system-volumes endpoint
• FDE: update secboot to revision 3e181c8edf0f
• Confdb: support lists and indexed paths on read and write
• Confdb: alias references must be wrapped in brackets
• Confdb: support indexed paths in confdb-schema assertion
• Confdb: make API errors consistent with options
• Confdb: fetch confdb-schema assertion on access
• Confdb: prevent --previous from being used in read-side hooks
• Components: fix snap command with multiple components
• Components: set revision of seed components to x1
• Components: unmount extra kernel-modules components mounts
• AppArmor Prompting: add lifespan "session" for prompting rules
• AppArmor Prompting: support restoring prompts after snapd restart
• AppArmor Prompting: limit the extra information included in probed AppArmor features and system key
• Notices: refactor notice state internals
• SELinux: look for restorecon/matchpathcon at all known locations rather than current PATH
• SELinux: update policy to allow watching cgroups (for RAA), and talking to user session agents (service mgmt/refresh)
• Refresh App Awareness: Fix unexpected inotify file descriptor cleanup
• snap-confine: workaround for glibc fchmodat() fallback and handle ENOSYS
• snap-confine: add support for host policy for limiting users able to run snaps
• LP: #2114923 Reject system key mismatch advise when not yet seeded
• Use separate lanes for essential and non-essential snaps during seeding and allow non-essential installs to retry
• Fix bug preventing remodel from core18 to core18 when snapd snap is unchanged
• LP: #2112551 Make removal of last active revision of a snap equal to snap remove
• LP: #2114779 Allow non-gpt in fallback mode to support RPi
• Switch from using systemd LogNamespace to manually controlled journal quotas
• Change snap command trace logging to only log the command names
• Grant desktop-launch access to /v2/snaps
• Update code for creating the snap journal stream
• Switch from using core to snapd snap for snap debug connectivity
• Fix offline remodel case where we switched to a channel without an actual refresh
• LP: #2112544 Fix snap debug connectivity check for RISC-V
• LP: #2112332 Exclude snap/snapd/preseeding when generating preseed tarball
• LP: #1952500 Fix snap command progress reporting
• LP: #1849346 Interfaces: kerberos-tickets | add new interface
• Interfaces: u2f | add support for Thetis Pro
• Interfaces: u2f | add OneSpan device and fix older device
• Interfaces: pipewire, audio-playback | support pipewire as system daemon
• Interfaces: gpg-keys | allow access to GPG agent sockets
• Interfaces: usb-gadget | add new interface
• Interfaces: snap-fde-control, firmware-updater-support | add new interfaces to support FDE
• Interfaces: timezone-control | extend to support timedatectl varlink
• Interfaces: cpu-control | fix rules for accessing IRQ sysfs and procfs directories
• Interfaces: microstack-support | allow SR-IOV attachments
• Interfaces: modify AppArmor template to allow snaps to read their own systemd credentials
• Interfaces: posix-mq | allow stat on /dev/mqueue
• LP: #2098780 Interfaces: log-observe | add capability dac_read_search
• Interfaces: block-devices | allow access to ZFS pools and datasets
• LP: #2033883 Interfaces: block-devices | opt-in access to individual partitions
• Interfaces: accel | add new interface to support accel kernel subsystem
• Interfaces: shutdown | allow client to bind on its side of dbus socket
• Interfaces: modify seccomp template to allow pwritev2
• Interfaces: modify AppArmor template to allow reading /proc/sys/fs/nr_open
• Packaging: drop snap.failure service for openSUSE
• Packaging: add SELinux support for openSUSE
• Packaging: disable optee when using nooptee build tag
• Packaging: add support for static PIE builds in snapd.mk, drop pie.patch from openSUSE
• Packaging: add libcap2-bin runtime dependency for ubuntu-16.04
• Packaging: use snapd.mk for packaging on Fedora
• Packaging: exclude .git directory
• Packaging: fix DPKG_PARSECHANGELOG assignment
• Packaging: fix building on Fedora with dpkg installed

New release 2.70

• FDE: fix reseal with v1 hook key format
• FDE: set role in TPM keys
• AppArmor prompting (experimental): add handling for expired
  requests or listener in the kernel
• AppArmor prompting: log the notification protocol version
  negotiated with the kernel
• AppArmor prompting: implement notification protocol v5 (manually
  disabled for now)
• AppArmor prompting: register listener ID with the kernel and
  resend notifications after snapd restart (requires protocol v5+)
• AppArmor prompting: select interface from metadata tags and set
  request interface accordingly (requires protocol v5+)
• AppArmor prompting: include request PID in prompt
• AppArmor prompting: move the max prompt ID file to a subdirectory
  of the snap run directory
• AppArmor prompting: avoid race between closing/reading socket fd
• Confdb (experimental): make save/load hooks mandatory if affecting
  ephemeral
• Confdb: clear tx state on failed load
• Confdb: modify 'snap sign' formats JSON in assertion bodies (e.g.
  confdb-schema)
• Confdb: add NestedEphemeral to confdb schemas
• Confdb: add early concurrency checks
• Simplify building Arch package
• Enable snapd.apparmor on Fedora
• Build snapd snap with libselinux
• Emit snapd.apparmor warning only when using apparmor backend
• When running snap, on system key mismatch e.g. due to network
  attached HOME, trigger and wait for a security profiles
  regeneration
• Avoid requiring state lock to get user, warnings, or pending
  restarts when handling API requests
• Start/stop ssh.socket for core24+ when enabling/disabling the ssh
  service
• Allow providing a different base when overriding snap
• Modify snap-bootstrap to mount snapd snap directly to /snap
• Modify snap-bootstrap to mount /lib/{modules,firmware} from snap
  as fallback
• Modify core-initrd to use systemctl reboot instead of /sbin/reboot
• Copy the initramfs 'manifest-initramfs.yaml' to initramfs file
  creation directory so it can be copied to the kernel snap
• Build the early initrd from installed ucode packages
• Create drivers tree when remodeling from UC20/22 to UC24
• Load gpio-aggregator module before the helper-service needs it
• Run 'systemctl start' for mount units to ensure they are run also
  when unchanged
• Update godbus version to 'v5 v5.1.0'
• Add support for POST to /v2/system-info with system-key-mismatch
  indication from the client
• Add 'snap sign --update-timestamp' flag to update timestamp before
  signing
• Add vfs support for snap-update-ns to use to simulate and evaluate
  mount sequences
• Add refresh app awareness debug logging
• Add snap-bootstrap scan-disk subcommand to be called from udev
• Add feature to inject proxy store assertions in build image
• Add OP-TEE bindings, enable by default in ARM and ARM64 builds
• Fix systemd dependency options target to go under 'unit' section
• Fix snap-bootstrap reading kernel snap instead of base resulting
  in bad modeenv
• Fix a regression during seeding when using early-config
• LP: #2107443 reset SHELL to /bin/bash in non-classic snaps
• Make Azure kernels reboot upon panic
• Fix snap-confine to not drop capabilities if the original user is
  already root
• Fix data race when stopping services
• Fix task dependency issue by temporarily disable re-refresh on
  prerequisite updates
• Fix compiling against op-tee on armhf
• Fix dbx update when not using FDE
• Fix potential validation set deadlock due to bases waiting on
  snaps
• LP: #2104066 Only cancel notices requests on stop/shutdown
• Interfaces: bool-file | fix gpio glob pattern as required for
  '[XXXX]*' format
• Interfaces: system-packages-doc | allow access to
  /usr/local/share/doc
• Interfaces: ros-snapd-support | added new interface
• Interfaces: udisks2 | allow chown capability
• Interfaces: system-observe | allow reading cpu.max
• Interfaces: serial-port | add ttyMAXX to allowed list
• Interfaces: modified seccomp template to disallow
  'O_NOTIFICATION_PIPE'
• Interfaces: fwupd | add support for modem-manager plugin
• Interfaces: gpio-chardev | make unsupported and remove
  experimental flag to hide this feature until gpio-aggregator is
  available
• Interfaces: hardware-random | fix udev match rule
• Interfaces: timeserver-control | extend to allow timedatectl
  timesync commands
• Interfaces: add symlinks backend
• Interfaces: system key mismatch handling

New release 2.68.5

• LP: #2109843 1 fix missing preseed files when running in a container

New release 2.69

• FDE: re-factor listing of the disks based on run mode model and model to correctly resolve paths
• FDE: run snapd from snap-failure with the correct keyring mode
• Snap components: allow remodeling back to an old snap revision that includes components
• Snap components: fix remodel to a kernel snap that is already installed on the system, but not the current kernel due to a previous remodel.
• Snap components: fix for snapctl inputs that can crash snapd
• Confdb (experimental): load ephemeral data when reading data via snapctl get
• Confdb (experimental): load ephemeral data when reading data via snap get
• Confdb (experimental): rename {plug}-view-changed hook to observe-view-{plug}
• Confdb (experimental): rename confdb assertion to confdb-schema
• Confdb (experimental): change operator grouping in confdb-control assertion
• Confdb (experimental): add confdb-control API
• AppArmor: extend the probed features to include the presence of files, as well as directories
• AppArmor prompting (experimental): simplify the listener
• AppArmor metadata tagging (disabled): probe parser support for tags
• AppArmor metadata tagging (disabled): implement notification protocol v5
• Confidential VMs: sysroot.mount is now dynamically created by snap-bootstrap instead of being a static file in the initramfs
• Confidential VMs: Add new implementation of snap integrity API
• Non-suid snap-confine: first phase to replace snap-confine suid with capabilities to achieve the required permissions
• Initial changes for dynamic security profiles updates
• Provide snap icon fallback for /v2/icons without requiring network access at runtime
• Add eMMC gadget update support
• Support reexec when using /usr/libexec/snapd on the host (Arch Linux, openSUSE)
• Auto detect snap mount dir location on unknown distributions
• Modify snap-confine AppArmor template to allow all glibc HWCAPS subdirectories to prevent launch errors
• LP: #2102456 update secboot to bf2f40ea35c4 and modify snap-bootstrap to remove usage of go templates to reduce size by 4MB
• Fix snap-bootstrap to mount kernel snap from /sysroot/writable/system-data
• LP: #2106121 fix snap-bootstrap busy loop
• Fix encoding of time.Time by using omitzero instead of omitempty (on go 1.24+)
• Fix setting snapd permissions through permctl for openSUSE
• Fix snap struct json tags typo
• Fix snap pack configure hook permissions check incorrect file mode
• Fix gadget snap reinstall to honor existing sizes of partitions
• Fix to update command line when re-executing a snapd tool
• Fix 'snap validate' of specific missing newline and add error on missed case of 'snap validate --refresh' without another action
• Workaround for snapd-confine time_t size differences between architectures
• Disallow pack and install of snapd, base and os with specific configure hooks
• Drop udev build dependency that is no longer required and add missing systemd-dev dependency
• Build snap-bootstrap with nomanagers tag to decrease size by 1MB
• Interfaces: polkit | support custom polkit rules
• Interfaces: opengl | LP: #2088456 fix GLX on nvidia when xorg is confined by AppArmor
• Interfaces: log-observe | add missing udev rule
• Interfaces: hostname-control | fix call to hostnamectl in core24
• Interfaces: network-control | allow removing created network namespaces
• Interfaces: scsi-generic | re-enable base declaration for scsi-generic plug
• Interfaces: u2f | add support for Arculus AuthentiKey

New release 2.68.4

• Snap components: LP: #2104933 workaround for classic 24.04/24.10 models that incorrectly specify core22 instead of core24
• Update build dependencies

New release 2.68.3

• FDE: LP: #2101834 snapd 2.68+ and snap-bootstrap <2.68 fallback to old keyring path
• Fix Plucky snapd deb build issue related to /var/lib/snapd/void permissions
• Fix snapd deb build complaint about ifneq with extra bracket

New release 2.68.2

• FDE: use boot mode for FDE hooks
• FDE: add snap-bootstrap compatibility check to prevent image creation with incompatible snapd and kernel snap
• FDE: add argon2 out-of-process KDF support
• FDE: have separate mutex for the sections writing a fresh modeenv
• FDE: LP: #2099709 update secboot to e07f4ae48e98
• Confdb: support pruning ephemeral data and process alternative types in order
• core-initrd: look at env to mount directly to /sysroot
• core-initrd: prepare for Plucky build and split out 24.10 (Oracular)
• Fix missing primed packages in snapd snap manifest
• Fix snap-confine type specifier type mismatch on armhf
• Interfaces: posix-mq | fix incorrect clobbering of global variable and make interface more precise
• Interfaces: opengl | add more kernel fusion driver files

New release 2.68

• FDE: add support for new and more extensible key format that is unified between TPM and FDE hook
• FDE: add support for adding passphrases during installation
• FDE: update secboot to 30317622bbbc
• Snap components: make kernel components available on firstboot after either initramfs or ephemeral rootfs style install
• Snap components: mount drivers tree from initramfs so kernel modules are available in early boot stages
• Snap components: support remodeling to models that contain components
• Snap components: support offline remodeling to models that contain components
• Snap components: support creating new recovery systems with components
• Snap components: support downloading components with 'snap download' command
• Snap components: support sideloading asserted components
• AppArmor Prompting(experimental): improve version checks and handling of listener notification protocol for communication with kernel AppArmor
• AppArmor Prompting(experimental): make prompt replies idempotent, and have at most one rule for any given path pattern, with potentially mixed outcomes and lifespans
• AppArmor Prompting(experimental): timeout unresolved prompts after a period of client inactivity
• AppArmor Prompting(experimental): return an error if a patch request to the API would result in a rule without any permissions
• AppArmor Prompting(experimental): warn if there is no prompting client present but prompting is enabled, or if a prompting-related error occurs during snapd startup
• AppArmor Prompting(experimental): do not log error when converting empty permissions to AppArmor permissions
• Confdb(experimental): rename registries to confdbs (including API /v2/registries => /v2/confdb)
• Confdb(experimental): support marking confdb schemas as ephemeral
• Confdb(experimental): add confdb-control assertion and feature flag
• Refresh App Awareness(experimental): LP: #2089195 prevent possibility of incorrect notification that snap will quit and update
• Confidential VMs: snap-bootstrap support for loading partition information from a manifest file for cloudimg-rootfs mode
• Confidential VMs: snap-bootstrap support for setting up cloudimg-rootfs as an overlayfs with integrity protection
• dm-verity for essential snaps: add support for snap-integrity assertion
• Interfaces: modify AppArmor template to allow owner read on @{PROC}/@{pid}/fdinfo/*
• Interfaces: LP: #2072987 modify AppArmor template to allow using setpriv to run daemon as non-root user
• Interfaces: add configfiles backend that ensures the state of configuration files in the filesystem
• Interfaces: add ldconfig backend that exposes libraries coming from snaps to either the rootfs or to other snaps
• Interfaces: LP: #1712808 LP: 1865503 disable udev backend when inside a container
• Interfaces: add auditd-support interface that grants audit_control capability and required paths for auditd to function
• Interfaces: add checkbox-support interface that allows unrestricted access to all devices
• Interfaces: fwupd | allow access to dell bios recovery
• Interfaces: fwupd | allow access to shim and fallback shim
• Interfaces: mount-control | add mount option validator to detect mount option conflicts early
• Interfaces: cpu-control | add read access to /sys/kernel/irq/
• Interfaces: locale-control | changed to be implicit on Ubuntu Core Desktop
• Interfaces: microstack-support | support for utilizing of AMD SEV capabilities
• Interfaces: u2f | added missing OneSpan device product IDs
• Interfaces: auditd-support | grant seccomp setpriority
• Interfaces: opengl interface | enable parsing of nvidia driver information files
• Interfaces: LP: #2095009 mount-control interface | add CIFS support
• Allow mksquashfs 'xattrs' when packing snap types os, core, base and snapd as part of work to support non-root snap-confine
• Upstream/downstream packaging changes and build updates
• Improve error logs for malformed desktop files to also show which desktop file is at fault
• Provide more precise error message when overriding channels with grade during seed creation
• Expose 'snap prepare-image' validation parameter
• Add snap-seccomp 'dump' command that dumps the filter rules from a compiled profile
• Add fallback release info location /etc/initrd-release
• Added core-initrd to snapd repo and fixed issues with ubuntu-core-initramfs deb builds
• Remove stale robust-mount-namespace-updates experimental feature flag
• Remove snapd-snap experimental feature (rejected) and it's feature flag
• Changed snap-bootstrap to mount base directly on /sysroot
• Mount ubuntu-seed mounted as no-{suid,exec,dev}
• Mapping volumes to disks: add support for volume-assignments in gadget
• Fix silently broken binaries produced by distro patchelf 0.14.3 by using locally build patchelf 0.18
• Fix mismatch between listed refresh candidates and actual refresh due to outdated validation sets
• Fix 'snap get' to produce compact listing for tty
• Fix missing store-url by keeping it as part of auxiliary store info
• Fix snap-confine attempting to retrieve device cgroup setup inside container where it is not available
• Fix 'snap set' and 'snap get' panic on empty strings with early error checking
• Fix logger debug entries to show correct caller and file information
• Fix issue preventing hybrid systems from being seeded on first boot
• LP: #1966203 remove auto-import udev rules not required by deb package to avoid unwanted syslog errors
• LP: #1886414 fix progress reporting when stdout is on a tty, but stdin is not

New release 2.67.1

New in snapd 2.67.1

• Fix apparmor permissions to allow snaps access to kernel modules and firmware on UC24, which also fixes the kernel-modules-control interface on UC24
• AppArmor prompting (experimental): disallow /./ and /../ in path patterns
• LP: #2090938 Fix 'snap run' getent based user lookup in case of bad PATH refresh for regenerating snap profiles
• Add new syscalls to base templates
• hardware-observe interface: allow riscv_hwprobe syscall
• mount-observe interface: allow listmount and statmount syscalls

New release 2.67

• AppArmor prompting (experimental): allow overlapping rules
• Registry view (experimental): Changes to registry data (from both users and snaps) can be validated and saved by custodian snaps
• Registry view (experimental): Support 'snapctl get --pristine' to read the registry data excluding staged transaction changes
• Registry view (experimental): Put registry commands behind experimental feature flag
• Components: Make modules shipped/created by kernel-modules components available right after reboot
• Components: Add tab completion for local component files
• Components: Allow installing snaps and components from local files jointly on the CLI
• Components: Allow 'snapctl model' command for gadget and kernel snaps
• Components: Add 'snap components' command
• Components: Bug fixes
• eMMC gadget updates (WIP): add syntax support in gadget.yaml for eMMC schema
• Support for ephemeral recovery mode on hybrid systems
• Support for dm-verity options in snap-bootstrap
• Support for overlayfs options and allow empty what argument for tmpfs
• Enable ubuntu-image to determine the size of the disk image to create
• Expose 'snap debug' commands 'validate-seed' and 'seeding'
• Add debug API option to use dedicated snap socket /run/snapd-snap.socket
• Hide experimental features that are no longer required (accepted/rejected)
• Mount ubuntu-save partition with no{exec,dev,suid} at install, run and factory-reset
• Improve memory controller support with cgroup v2
• Support ssh socket activation configurations (used by ubuntu 22.10+)
• Fix generation of AppArmor profile with incorrect revision during multi snap refresh
• LP: #2084730 Fix refresh app awareness related deadlock edge case
• Fix not caching delta updated snap download
• Fix passing non root uid, guid to initial tmpfs mount
• Fix ignoring snaps in try mode when amending
• LP: #2083961 Fix reloading of service activation units to avoid systemd errors
• Fix snapd snap FIPS build on Launchpad to use Advantage Pro FIPS updates PPA
• Make killing of snap apps best effort to avoid possibility of malicious failure loop
• Alleviate impact of auto-refresh failure loop with progressive delay
• LP: #2085535 Dropped timedatex in selinux-policy to avoid runtime issue
• Fix missing syscalls in seccomp profile
• Modify AppArmor template to allow using SNAP_REEXEC on arch systems
• Modify AppArmor template to allow using vim.tiny (available in base snaps)
• Modify AppArmor template to add read-access to debian_version
• Modify AppArmor template to allow owner to read @{PROC}/@{pid}/sessionid
• {common,personal,system}-files interface: prohibit trailing @ in filepaths
• {desktop,shutdown,system-observe,upower-observe} interface: improve for Ubuntu Core Desktop
• custom-device interface: allow @ in custom-device filepaths
• desktop interface: improve launch entry and systray integration with session
• desktop-legacy interface: allow DBus access to com.canonical.dbusmenu
• fwupd interface: allow access to nvmem for thunderbolt plugin
• mpris interface: add plasmashell as label
• mount-control interface: add support for nfs mounts
• LP: #2086203 network-{control,manager} interface: add missing dbus link rules
• network-manager-observe interface: add getDevices methods
• opengl interface: add Kernel Fusion Driver access to opengl
• screen-inhibit-control interface: improve screen inhibit control for use on core
• udisks2 interface: allow ping of the UDisks2 service
• u2f-devices interface: add Nitrokey Passkey