snapd (2.76.3+ubuntu22.04) jammy; urgency=medium

  * New upstream release, LP: #2158301
    - FDE: support keyboard configuration at install-time for first-boot
    - FDE: re-enable passphrases/PINs at install-time
    - FDE: require volumes authentication if HWROT is missing
    - FDE: bump secboot to rev 457b03a16d19
    - FDE: use new secboot API for reprovision TPM
    - Cross-distro: modify SELinux policy to use
      init_named_socket_activation() for allowing systemd to start snapd
      through socket activation
    - packaging: make sure that usr/bin/snap is built with correct build
      tags on debian sid
    - Ensure profiles are setup before running prepare-{slot, plug}*
      hooks

 -- Katie May <katie.may@canonical.com>  Tue, 07 Jul 2026 10:06:48 +0200

snapd (2.76.2+ubuntu22.04) jammy; urgency=medium

  * New upstream release, LP: #2159940
    - interfaces: steam-support, docker-support | fix mountinfo denial

 -- Katie May <katie.may@canonical.com>  Tue, 07 Jul 2026 08:38:51 +0200

snapd (2.76.1+ubuntu22.04) jammy; urgency=medium

  * New upstream release, LP: #2157692
    - LP: #2067006 CVE-2024-5300
    - CVE-2026-3888

 -- Ernest Lotter <ernest.lotter@canonical.com>  Thu, 25 Jun 2026 13:09:05 +0200

snapd (2.76+ubuntu22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: information disclosure
    - interfaces/apparmor/template.go: don't grant access to systemd
      userdb API sockets.
    - CVE-2024-5300
  * SECURITY UPDATE: Privilege escalation
    - cmd/snap-confine: harden construction of bootstrap rootfs
    - CVE-2026-8933
  * SECURITY UPDATE: Privilege abuse
    - interfaces/snap-confine: harden seccomp template
    - CVE-2026-15226

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Fri, 10 Jul 2026 13:48:41 +0200

snapd (2.76+ubuntu22.04) jammy; urgency=medium

  * New upstream release, LP: #2154498
    - assertions: add helper for validating integrity data
    - assertions: drop incorrect/non-standard Ed25519 support
    - confdb: allow only API admin read access to confdb secrets
    - confdb: block concurrent confdb accesses
    - confdb: block concurrent snapctl accesses to configuration
      database
    - confdb: check for ephemeral data when missing save-view hook on
      commit
    - confdb: ignore not-found errors in confdb-schema refreshes
    - confdb: support --wait-for timeouts when accessing confdb
    - core-initrd: add group referenced in udev rules
    - core-initrd: add libbpf dependency to initramfs
    - core-initrd: add missing libbpf dependency in 24.04 packaging
    - core-initrd: ensure audio is a system group
    - core-initrd: fix /boot/uboot mount with u-boot env in dedicated
      partition
    - core-initrd: increase mount burst from 5 to 128 for faster boot
    - core-initrd: sync partition udev rules with the ones in core-base
    - core-initrd: sync with latest upload to snappy-dev PPA
    - core-initrd: synchronize changelogs with latest PPA upload
    - core-initrd: update changelog with latest PPA upload
    - core-initrd: add nfnetlink module to fix nf netlink
      socket speed regression (Ubuntu Core only)
    - cross-distro: allow snapd to manipulate systemd unit files in
      SELinux policy
    - cross-distro: FIPS bootstrap and dispatch via snap-fips-dispatch
    - desktop: fix common ID selection with multiple desktop plugs
    - FDE: allow user mode on core in secboot TPM handling
    - FDE: bump go-efilib dependency
    - FDE: bump secboot to rev cdcb64992e54 for FDE fixes
    - FDE: deprecate check-pin/passphrase API endpoints
    - LP: #2147606 FDE: give inactive state on classic
    - FDE: improve tracing for OP-TEE probing
    - FDE: move auto-repair logic to overlord/fdestate and provide state
    - FDE: update secboot for TPM/FDE bug fixes including Intel HAP and
      recovery key parsing
    - FDE: use any primary key matching digest when adding a keyslot
    - FDE: use ignore action for preinstall check in VM
    - interfaces: bluez | drop explicit deny send_destination in D-Bus
      configuration
    - interfaces: conditionally deny /proc/self/mountinfo to suppress Go
      1.25+ denials
    - interfaces: custom-device | fix for-device validation panic on
      non-string value
    - interfaces: disallow auto-connect to parallel installs
    - interfaces: docker | make plug implicit on classic systems
    - interfaces: ignore errors in disconnect hooks during explicit snap
      disconnect
    - interfaces: mediatek-accel | add plug interface base declaration
    - interfaces: microceph-support | suppress noisy sudo denial audit
      logs
    - interfaces: podman | add new interface for podman socket access
    - interfaces: pulseaudio | fix security tag syntax inconsistency
    - interfaces: raw-usb | allow USB device enumeration on Fairphone 5
      with NexDock
    - interfaces: restore auto-connections on failed refresh undo
    - interfaces: bool-file | support deep SoC sysfs paths
      for LED brightness
    - LP: #2139213 packaging: make Ubuntu 16.04 packaging dep17
      compliant
    - packaging: add cross-distro build script and instructions
    - packaging: add openSUSE 16.0 spread support
    - packaging: Debian build improvements
    - packaging: default openSUSE to /var/lib/snapd/snap and sync from
      downstream
    - packaging: fix Launchpad FIPS build detection for snapd-fips job
    - packaging: refactor and clean up snapd.mk, standardize test-data
      directories
    - packaging: switch to golang-github-chai2010-gettext-go-dev
    - packaging: update bundled AppArmor 4.1.7 (snapd snap only)
    - prompting: escape paths in prompt constraints
    - prompting: improve API error handling and validation
    - prompting: improve error message when no handler service is
      present
    - prompting: re-enable the prompting notice backend
    - prompting: respond with full user-allowed permission set
    - prompting: validate permissions while unmarshalling
    - remote device management: implement dispatch-mgmt-messages task
      with sequencing support
    - LP: #2125344 snap: avoid empty channel forwarding message
    - snap: clarify snap install help text for --classic
      and --devmode
    - LP: #2152908 snap: print complex attributes in snap interface
      --attrs output
    - snap: add run-inhibit hint and inhibit info when a snap is
      disabled
    - snap: allow removing a snap and its base at the same time
    - snap: display detailed component information in snap info
    - snap: extend AlreadyInstalledError to multiple snaps and
      components
    - snap: extend set-quota command options description with accepted
      value formats
    - snap: implement snap delta command for computing snap deltas
    - snap: improve consistency for snap install when some snaps are
      already installed
    - snap: show hint in snap list that a snap has components
    - snap-confine: allow inheriting unix sockets from snaps
    - snap-confine: allow linking to libm in AppArmor profile
    - snap-confine: fix out-of-bounds read in mountinfo parser for
      partial escape sequences
    - snap-confine: harden bpffs mount with nosuid, nodev, noexec flags
    - snap-confine: remove experimental persistent per-user mount
      namespace feature
    - snap-confine: set FD_CLOEXEC on file descriptors returned by BPF
      helpers
    - snap-confine: support transparent_hugepage in AppArmor profile
    - snap-confine: use strchr after NUL-terminating in infofile parser
    - snap-update-ns: switch to a multi-pass process for constructing
      and updating mount namespaces
    - RemoveMountUnitFile now unmounts even if mount unit file is
      missing
    - Add explicit mount phase during single-reboot refresh to fix undo
      of kernel refreshes
    - Add security audit logging subsystem
    - Add base prioritized AppArmmor snippets for strictly confined or
      jailed snaps
    - Allow openshell snap to use experimental daemon-scope: user
    - Allow configuring mount unit options based on filesystem type
    - Allow equals signs in uevent values in netlink parser
    - Also bind-mount directories modified by kmod backend during
      preseed
    - Clean up potentially corrupted files during snap download undo
    - Complete the bootloader environment implementation
    - Copy integrity data files during snap install
    - Create hook for seed refresh mode
    - Create removal tasks for old seed-refresh seeds
    - Dispatch systemctl commands asynchronously when calling Stop()
    - Ensure /tmp/.X11-unix created inside mount namespace has correct
      permissions
    - Ensure exclusive changes conflict with refresh/revert
    - Ensure existing snap confinement flags are not dropped when
      installing or removing components
    - Export ubuntu-boot-state filename constant from bootloader package
    - Fix duplicate removal of apps under $SNAP_MOUNT_DIR/bin
    - Fix integration between prerequisites task and seed-refresh mode
    - Fix split-refresh overwriting provided lane
    - Fix use of umask in GetListener for socket activation
    - Ignore net.ErrClosed during daemon shutdown
    - Implement ResolveValidationSetsEnforcementError in terms of one
      call
    - Improve snapctl install consistency when components are already
      installed
    - Inject seed creation tasks into snap refresh flow
    - Introduce system options for custom certificates on Ubuntu Core
    - Keep idle services with activation units stopped on reload
    - List snap components in snap-debug-info via debug-tools
    - Look at gadget.yaml instead of marker file to determine ubootpart
      usage
    - LP: #1966067 Skip redundant xdg-settings confirmation prompt when
      setting is already correct
    - LP: #2110368 Fix component installation for private snaps via
      snapctl
    - LP: #2110368 Fix download of private snap components by setting
      UserID
    - LP: #2144666 Fix mount namespace updates with synthetic bind
      mounts on same target paths
    - LP: #2146337 Improve handling of failed downloads and retain
      partial files for resume
    - LP: #2147207 Fix snap enable/disable cycle forgetting components
    - Make run-inhibit hint for kill-snap-apps task based on kill reason
    - Merge content-provider prerequisite updates into seed-refresh
    - Move SortServices into Backend.StartServices
    - Move state to client change conversion to ctlcmd package
    - Omit misleading "try to refresh snapd" suggestion for ISA-related
      errors
    - Only create link-component tasks when needed during refresh to
      existing revision
    - Reconfigure piboot bootloader on gadget refreshes to preserve
      os_prefix
    - Reduce the number of AppArmor profile regenerations during snap
      operations
    - Refactor seed-refresh ownership to devicestate
    - Regenerate certificate database on remodels
    - Remove obsolete FIXME comment in VersionCompare
    - Remove unused GenerateDmVerityData helper from snap/integrity
    - Rename and document error type for ISA assumes flags
    - Restart snapd from daemon.Stop to improve restart reliability
    - Restart stopped services on error in stopSnapServices for
      transactionality
    - Simplify certificate-db updates on model-base refresh/installs
    - Support racing Loop and Stop correctly in overlord
    - Support sending file descriptors to systemd via sd_notify
    - Unroll CPU-heavy recursive function in snap state handlers
    - Update seccomp syscalls list for kernel 7.1.0
    - Use change ID to prevent nested seed-refresh spawned by
      prerequisites
    - Validate content interface plug target directories exist for
      core26+ snaps
    - Validate layout paths exist in snap tree for snaps using bare or
      core26+

 -- Ernest Lotter <ernest.lotter@canonical.com>  Thu, 28 May 2026 20:00:16 +0200

snapd (2.75.2+ubuntu22.04) jammy; urgency=medium

  * New upstream release, LP: #2143882
    - Interfaces: network-setup-*| allow running python binaries from
      the base on UC26+
    - Cross-distro: modify SELinux policy to allow mounting on
      /var/snap/<snap>/<rev>
    - Fix potential task deadlock by considering all tasks in a lane
      that might be waiting for a reboot when processing delayed
      security backend effects

 -- Katie May <katie.may@canonical.com>  Mon, 30 Mar 2026 17:06:36 +0200

snapd (2.75.1) xenial; urgency=medium

  * New upstream release, LP: #2143882
    - FDE: limit number of boot check log entries
    - Allow a logged in user to refresh private snaps during a refresh
      with multiple snaps
    - Use precise prune pattern for tmpfiles (CVE-2026-3888)

 -- Katie May <katie.may@canonical.com>  Wed, 18 Mar 2026 09:59:01 +0100

snapd (2.75) xenial; urgency=medium

  * New upstream release, LP: #2143882
    - FDE: run early boot check only once per boot
    - FDE: update secboot to revision 77bc2457cc76
    - FDE: add degraded state for status API
    - FDE: prevent resealing tasks from running together
    - FDE: enable using keyslot tokens to store protected keys for UC26+
    - FDE: early commit kcmdline config transaction in update-gadget-
      cmdline to mitigate possible race condition
    - FDE: ensure extra snapd kcmdline fragments are applied
    - FDE: remove old secboot activation API calls
    - LP: #2142130 update apparmor parser to 4.1.7
    - LP: #2137543 disable translations in formatted output for snapctl
      services
    - LP: #2142655 improve snap size reporting precision in snap info
      output
    - LP: #2139664 snap-confine: remove race condition triggered by hat
      profile
    - LP: #2139065 skip 70-snap.*.rules when building dracut initramfs
    - LP: #2002697 error early on removal without purge if home is in
      NFS mount
    - LP: #2141461 Intefaces: allow snap-update-ns to read
      /proc/pid/auxv
    - LP: #2138268 Interfaces: kerberos-tickets| new interface allow
      access to kerberos tickets stored in /tmp
    - Interfaces: block-devices| allow Xen block devices
    - Interfaces: u2f-devices| add Tokey 3 FIDO
    - Interfaces: devlxd| new interface allowing acccess to LXD devlxd
      socket and APIs
    - Interfaces: browser-support| allow reading pressure stall info
      information
    - Interfaces: network-setup-control| allow additional netplan files
      access
    - Interfaces: desktop| allow access kvantum, lxqt, and gtk4
      configuration files
    - Interfaces: system-observe| allow fdinfo access for GPU monitoring
    - Interfaces: ubuntu-pro-control| allow access to Ubuntu Advantage
      client configuration
    - Prompting: add API endpoint to ask whether application should have
      access
    - Prompting: add support for audio-record prompting via API endpoint
    - Prompting: store snap name instead of apparmor label in requests
    - Prompting: respond with 503 to API requests when prompting
      subsystem is shutting down
    - Prompting: generalize prompting subsystem to support requests from
      outside AppArmor
    - Confdb: unset data for missing paths in set request
    - Confdb: return 400 for API requests with missing filter
      constraints
    - Confdb: return 400 for API requests with unmatched filter
      constraints
    - Confdb: support typed constraints in confdb filtering
    - Confdb: fixed unmarshalling transaction with placeholder path in
      deltas
    - Confdb: refresh confdb-schema assertions during manual refresh
    - Remote device management (experimental): add skeleton device
      management manager
    - Remote device management (experimental): add message exchange loop
    - Components: add snap component command, include component summary
      in snap info output
    - Components: enforce validation sets when installing components
    - Configuration: add system.motd configuration option to customize
      message of the day (motd)
    - packaging: remove dependencies libbrotli1, libfreetype6, and
      libpng16-16 from snap
    - snap-bootstrap: use libblkid for disk information to speed up boot
    - snap-confine: improve data handling error
    - snap-confine: use ld cache from the app base for core26+
    - snap: add riscv ISA detection for snaps
    - squashfs: reduce memory footprint of single file extraction
    - Add experimental snap delta format
    - Enable early download of seed snaps during refresh
    - Enable parallel downloads of essential snaps during refresh
    - Disallow removing components required by validation sets
    - Make snap prepare-image fail on --validation=ignore if model has
      enforced validation-sets
    - Fix correctly handling interrupted snap downloads
    - Fix handling of store throttling for refresh-app-awareness
      monitored snaps
    - Stop removed "endure" services on refresh
    - Install by default from the initramfs for UC26+, removing the need
      for a reboot after installation
    - Keep minidebuginfo in snapd snap
    - Make snap-specific systemd cgroup mandatory for snaps using core26
      and later, improve messaging for failure scenarios
    - Preserve stale connections of broken snaps
    - Remove enforce-validation-sets need for network
    - Opportunistic discarding of mount namespace when updating slot
      providers
    - Support for delaying updates of snap mount namespaces when
      refreshing slot providers
    - Use application CommonID as default source for desktop ID

 -- Katie May <katie.may@canonical.com>  Mon, 09 Mar 2026 17:10:13 +0100

snapd (2.74.1) xenial; urgency=medium

  * New upstream release, LP: #2138629
    - FDE: measure DeployedMode and AuditMode variables if they appear
      as disabled in the event log to avoid a potential reseal-failure
      boot loop
    - LP: #2141328 FDE: reuse preinstall check context during install to
      account for user-ignored errors
    - LP: #2139611 FDE: fix db updates by allowing multiple payloads
    - LP: #2139300 snap-confine: add CAP_SYS_RESOURCE to allow raising
      memory lock limit when required
    - LP: #2139099 snap-confine: bump the max element count of the BPF
      map used to store IDs of allowed/matched devices to 1000
    - LP: #2141607 Desktop: revert change that caused user daemons
      declaring the desktop plug to implicitly depend on graphical-
      session.target
    - Interfaces: Added pidfd_open and memfd_secret to seccomp template
    - Interfaces: camera | add locking permission for /dev/video

 -- Ernest Lotter <ernest.lotter@canonical.com>  Thu, 12 Feb 2026 21:27:23 +0200

snapd (2.74) xenial; urgency=medium

  * New upstream release, LP: #2138629
    - FDE: use new activation API from secboot
    - FDE: use activation API also with non keydata keys
    - FDE: ignore internal recovery key expiration during install
    - FDE: support adding/removing PINs post-installation
    - FDE: support changing PINs post-installation
    - FDE: support adding a recovery key post-installation
    - FDE: provide activation status via new endpoint v2/system-
      info/storage-encrypted
    - FDE: support sealing and resealing using the preinstall check
      result
    - FDE: disable passphrase support during install
    - FDE: add keyboard configuration helpers
    - FDE: lazily inject keyboard layout configuration in kernel cmdline
    - FDE: enable pin tries and limits PIN entry attempts to 3
    - FDE: extend secureboot endpoint to accept DB, KEK, and PK
    - FDE: simplify /v2/system-volumes keyslots handling by allowing
      name-only entries, implicitly expanding to all system containers
    - FDE: support extra non-system key slot names to support agents
      such as Landscape to set dedicated recovery keys
    - FDE: initialize fde state after device state
    - FDE: use device node to find the storage container and keys
    - FDE: provide user visible name for disk based on ID_MODEL
    - FDE: update secboot in snapd with latest additions and fixes
    - core-initrd: add systemd service for setting plymouth keyboard
      layout and X11 keyboard layouts
    - core-initrd: set plymouth cleartext toggle option
    - core-initrd: fix plymouth missing font issue
    - core-initrd: update dependency from libteec1 to libteec2
    - core-initrd: add new dlopened libs
    - LP: #2116949 Preseeding: add support for preseeding of hybrid
      systems via the installer API$
    - Preseeding: check whether a path is a mountpoint before remounting
    - Confdb: support tagging paths as secret in storage schemas
    - Confdb: support filtering on placeholder sub-keys
    - Confdb: support filtering in API and confdbstate
    - Confdb: support field filtering on reads
    - Confdb: support "parameters" stanza and check filters against them
    - Confdb: add support for '--with' contraints
    - Confdb: parsing fixes and error handling improvements
    - Assertions: restrict serials to new format in confdb-control
    - Assertions: add verify signature function
    - Remote device management: modify request-message assertion to
      expose its time constraints for remote device management
    - Remote device management: support polling of store messages
    - Remote device management: add signing of response messages with
      device key
    - Prompting: enable notify protocol v5 and test prompt restoration
      after snapd restart
    - snap: change malformed '--channel=' warning to error
    - snap: add 'snap report-issue' command to get the available contact
      details for the specified snap
    - snap: add 'snap version --verbose' flag to include information on
      snap binaries origin
    - snap: create the XDG_RUNTIME_DIR folder
    - LP: #2068493 snap: add support for 'snap refresh --tracking'
    - snapctl: add '--tracking' flag to 'snapctl refresh'
    - Reexec: include the info filepath in the version compare debug log
    - Reexec: add support for forcing reexec into and older snapd snap
      by setting SNAP_REEXEC=force in the environment
    - snap-confine: correct error message related to snap-confine group
      policy validation
    - snap-confine: ensure we only mount existing directories
    - LP: #2134364 snap-confine: handle potential race when creating
      /tmp/snap-private-tmp when lacking systemd-tmpfiles support
    - snap-confine: filter plus characters from security tags
    - Desktop: use desktop file IDs as desktop IDs
    - Desktop: store the common ID in the desktop file
    - Desktop: allow graphical daemons to show icons in the dock
    - Desktop: change user daemons with desktop plug defined to depend
      on graphical-session.target
    - dm-verity for essential snaps: made change to prerequisite struct
    - Cross-distro: modify SELinux profile to allow connecting to squid
      proxy
    - Cross-distro: add support for migrating snap mount directory
    - Packaging: drop ubuntu-14.04 packaging
    - Packaging: drop ubuntu-{14.04,16.04} transitional binary packages
    - Packaging: remove desktop files and state lock file during snapd
      purge
    - Packaging: fix inhibition hint file being left behind on failed
      unlink-current-snap
    - Disallow timeouts < 1us in systemd units
    - Add snap-store to the user-daemons support overrides
    - Support for SuccessExitStatus= generation for systemd daemon
    - Make standby output more verbose
    - Add prepare-serial-request hook
    - Try to discard snap mount namespaces when no processes are running
      during snap updates
    - Improve handling of snap downloads cache by introducing periodic
      cleanup with more aggressive policy
    - Interfaces: mediatek-accel | create new interface
    - Interfaces: nvidia-video-driver-libs | create new interface
    - Interfaces: *-driver-libs | accept component paths
    - Interfaces: desktop-legacy, unity7 | remove workaround for slash
      filtering in ibus address
    - Interfaces: fwupd | allow writing reboot notification in /run
    - Interfaces: add 'install' coreutil to base AppArmor template
    - Interfaces: u2f-devices | add apparmor permissions to allow the
      use of the libfido2 library in snaps
    - Interfaces: u2f-devices | add support for Thetis security key
    - Interfaces: add AppArmor workaround for mmap MAP_HUGETLB
    - Interfaces: timeserver-control | manage per-link ntp settings via
      systemd-networkd

 -- Ernest Lotter <ernest.lotter@canonical.com>  Tue, 20 Jan 2026 18:54:17 +0200

# For older changelog entries, run 'apt-get changelog golang-github-snapcore-snapd-dev'
