[GH-ISSUE #123] Disabling Snap removal

kerem commented

2026-03-03 13:58:46 +03:00

Owner

Originally created by @rams3sh on GitHub (May 14, 2022).
Original GitHub issue: https://github.com/konstruktoid/hardening/issues/123

Originally assigned to: @konstruktoid on GitHub.

Describe the bug

This is not actually a bug.

I am trying to use hardening as part of EC2 Image Builder in AWS which is actually dependent on a service named AWS SSM agent running within the host instance. This is installed via snap and uninstalling snap apparently removes this agent. Logs snippet below from the output for reference.

....

Stdout: Found initrd image: /boot/microcode.cpio /boot/initrd.img-5.13.0-1022-aws
--
Stdout: Found Ubuntu 20.04.4 LTS (20.04) on /dev/nvme0n1p1
Stdout: done
Stdout: Removing iputils-tracepath (3:20190709-3) ...
Stdout: Removing irqbalance (1.6.0-3ubuntu1) ...
Stdout: Removing ntfs-3g (1:2017.3.23AR.3-3ubuntu1.1) ...
Stdout: Removing libntfs-3g883 (1:2017.3.23AR.3-3ubuntu1.1) ...
Stdout: Removing libnuma1:amd64 (2.0.12-1) ...
Stdout: Removing tcpdump (4.9.3-4ubuntu0.1) ...
Stdout: Removing libpcap0.8:amd64 (1.9.1-3) ...
Stdout: Removing mtr-tiny (0.93-1) ...
Stdout: Removing nano (4.8-1ubuntu1) ...
Stdout: update-alternatives: using /usr/bin/vim.basic to provide /usr/bin/editor (editor) in auto mode
Stdout: Removing ubuntu-standard (1.450.2) ...
Stdout: Removing popularity-contest (1.69ubuntu1) ...
Stdout: Removing python3-commandnotfound (20.04.6) ...
Stdout: Removing python3-gdbm:amd64 (3.8.10-0ubuntu1~20.04) ...
Stdout: Removing snapd (2.54.3+20.04.1ubuntu0.3) ...
Stdout: Stopping snap.amazon-ssm-agent.amazon-ssm-agent.service
Stdout: Stopping unit snap.amazon-ssm-agent.amazon-ssm-agent.service
Stdout: Waiting until unit snap.amazon-ssm-agent.amazon-ssm-agent.service is stopped [attempt 1]
Stdout: snap.amazon-ssm-agent.amazon-ssm-agent.service is stopped.

....

Additional context
I would want to know which file / line would be responsible for removal of snap as I was unable to determine that. I am planning to comment out those lines in my local version and use them as part of the pipeline.

Originally created by @rams3sh on GitHub (May 14, 2022). Original GitHub issue: https://github.com/konstruktoid/hardening/issues/123 Originally assigned to: @konstruktoid on GitHub. **Describe the bug** This is not actually a bug. I am trying to use hardening as part of EC2 Image Builder in AWS which is actually dependent on a service named AWS SSM agent running within the host instance. This is installed via snap and uninstalling snap apparently removes this agent. Logs snippet below from the output for reference. ``` .... Stdout: Found initrd image: /boot/microcode.cpio /boot/initrd.img-5.13.0-1022-aws -- Stdout: Found Ubuntu 20.04.4 LTS (20.04) on /dev/nvme0n1p1 Stdout: done Stdout: Removing iputils-tracepath (3:20190709-3) ... Stdout: Removing irqbalance (1.6.0-3ubuntu1) ... Stdout: Removing ntfs-3g (1:2017.3.23AR.3-3ubuntu1.1) ... Stdout: Removing libntfs-3g883 (1:2017.3.23AR.3-3ubuntu1.1) ... Stdout: Removing libnuma1:amd64 (2.0.12-1) ... Stdout: Removing tcpdump (4.9.3-4ubuntu0.1) ... Stdout: Removing libpcap0.8:amd64 (1.9.1-3) ... Stdout: Removing mtr-tiny (0.93-1) ... Stdout: Removing nano (4.8-1ubuntu1) ... Stdout: update-alternatives: using /usr/bin/vim.basic to provide /usr/bin/editor (editor) in auto mode Stdout: Removing ubuntu-standard (1.450.2) ... Stdout: Removing popularity-contest (1.69ubuntu1) ... Stdout: Removing python3-commandnotfound (20.04.6) ... Stdout: Removing python3-gdbm:amd64 (3.8.10-0ubuntu1~20.04) ... Stdout: Removing snapd (2.54.3+20.04.1ubuntu0.3) ... Stdout: Stopping snap.amazon-ssm-agent.amazon-ssm-agent.service Stdout: Stopping unit snap.amazon-ssm-agent.amazon-ssm-agent.service Stdout: Waiting until unit snap.amazon-ssm-agent.amazon-ssm-agent.service is stopped [attempt 1] Stdout: snap.amazon-ssm-agent.amazon-ssm-agent.service is stopped. .... ``` **Additional context** I would want to know which file / line would be responsible for removal of snap as I was unable to determine that. I am planning to comment out those lines in my local version and use them as part of the pipeline.

kerem closed this issue

2026-03-03 13:58:46 +03:00

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 14, 2022):

Hi @rams3sh and thanks for creating the issue.

To be honest, I don't exactly know what removes snap but there's a workaround described in the readme.

I'll have a look at creating a working AWS SSM version.

@konstruktoid commented on GitHub (May 14, 2022): Hi @rams3sh and thanks for creating the issue. To be honest, I don't exactly know what removes snap but there's a workaround described in the readme. I'll have a look at creating a working AWS SSM version.

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@rams3sh commented on GitHub (May 14, 2022):

@konstruktoid

Actually the provided solution would not work in this case, since it would lead to snap uninstallation first and then later reinstallation of snap. The SSM agent will be removed during this process which is a blocker for image building via EC2 Image Builder.

Throughout the process of hardening via the Image Builder, AWS SSM agent should be alive and talking to the service for feedbacks of completion of each stage.

@rams3sh commented on GitHub (May 14, 2022): @konstruktoid Actually the provided solution would not work in this case, since it would lead to snap uninstallation first and then later reinstallation of snap. The SSM agent will be removed during this process which is a blocker for image building via EC2 Image Builder. Throughout the process of hardening via the Image Builder, AWS SSM agent should be alive and talking to the service for feedbacks of completion of each stage.

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 14, 2022):

Yeah, but if you're using an AMI and running the script after the installation I believe the workaround does work.

Are you using Packer or something similar?

My plan is to sit down later today and write a Packer template

@konstruktoid commented on GitHub (May 14, 2022): Yeah, but if you're using an AMI and running the script after the installation I believe the workaround does work. Are you using Packer or something similar? My plan is to sit down later today and write a Packer template

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@rams3sh commented on GitHub (May 14, 2022):

So I use the EC2 image builder (in another words which acts as a packer / ansible in my case) orchestrating the entire hardening process. This hardening script is one part of the complete workflow.

During the complete execution of the workflow, an agent (AWS SSM Agent) sits inside the AMI orchestrating and monitoring the status of each workflow step and reports back to the service. If AWS SSM gets uninstalled, its like packer / ansible binary getting removed from the system while the ansible role / packer template is being run currently, leading to hardening process getting stopped abruptly.

Hence the need for the agent to be kept untouched during the hardening process.

@rams3sh commented on GitHub (May 14, 2022): So I use the [EC2 image builder](https://aws.amazon.com/image-builder/) (in another words which acts as a packer / ansible in my case) orchestrating the entire hardening process. This hardening script is one part of the complete workflow. During the complete execution of the workflow, an agent (AWS SSM Agent) sits inside the AMI orchestrating and monitoring the status of each workflow step and reports back to the service. If AWS SSM gets uninstalled, its like packer / ansible binary getting removed from the system while the ansible role / packer template is being run currently, leading to hardening process getting stopped abruptly. Hence the need for the agent to be kept untouched during the hardening process.

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@rams3sh commented on GitHub (May 14, 2022):

TL;DR

Removal of apport , rsync and popularity-contest leads to uninstallation of snapd resulting in removal of ssm agent.

Long Version

I debugged the execution of the script and narrowed down the problem.

Used the below dirty script to identify the issue. It recursively simulates the package removal and displays the package that would be removed.

#!/bin/bash 
list=`sudo apt-get purge --simulate $1  | sed -e "s/^\b[0-9]\{1,100\} upgraded\b/\$/g" | tr -d "\n" | grep -Po "(?<=REMOVED:  )[^\$]+"`
if [ -z "$list" ]
  then
    echo "Deleting $1 deletes:  $1"
  else
    echo "Deleting $1 deletes:  $list"
fi
echo "============================="
if [ -z "$2" ]
  then
    file_name="/tmp/$1"
  else
    file_name="$2"
fi

echo $1 >> $file_name
for p in $list;do
  isInFile=$(cat $file_name | grep -c $p)
  if [ $isInFile -eq 0 ]; then
    #string not contained in file
    bash $0 $p $file_name
  else
   #string is in file at least once
   :
  fi
done

if [ -z "$2" ]
  then
    rm $file_name
fi

Placed the above script as apt-get-purge-simulate in /usr/bin and replaced $APT purge across all scripts with apt-get-purge-simulate to identify the root package because of whom snapd gets removed.

Log snippet below :-

[31] Disable apport, ubuntu-report and popularity-contest

=============================
Deleting popularity-contest deletes:  command-not-found* friendly-recovery* iputils-tracepath* irqbalance*  libntfs-3g883* libnuma1* libpcap0.8* mtr-tiny* nano* ntfs-3g*  popularity-contest* python3-commandnotfound* python3-gdbm* snapd*  squashfs-tools* tcpdump* telnet* ubuntu-standard*
=============================

...
[43] Package removal

=============================
Deleting popularity-contest deletes:  command-not-found* friendly-recovery* iputils-tracepath* irqbalance*  libntfs-3g883* libnuma1* libpcap0.8* mtr-t
iny* nano* ntfs-3g*  popularity-contest* python3-commandnotfound* python3-gdbm* snapd*  squashfs-tools* tcpdump* telnet* ubuntu-standard*
=============================
..

=============================
Deleting rsync* deletes:  command-not-found* friendly-recovery* iputils-tracepath* irqbalance*  libntfs-3g883* libnuma1* libpcap0.8* mtr-tiny* nano* ntfs-3g*  python3-commandnotfound* python3-gdbm* rsync* snapd* squashfs-tools*  tcpdump* telnet* ubuntu-standard*
=============================

Re-ran the hardening again after removal of popularity-contest and rsync from f_apport (scripts/apport) and f_package_remove (scripts/packages).

The snapd got removed again. Finally after trial and error with multiple runs of commenting out certain functions found out that apport also removed snapd.

Repeated the run again with removal of apport from the scripts/packages. Finally the script finished sucessfully with snap being intact.

Below script achieves the above

sed -i "s/  f_apport/# f_apport/g" ubuntu.sh &&\
sed -i "s/apport\* //g" scripts/packages &&\
sed -i "s/popularity-contest //g" scripts/packages &&\
sed -i "s/rsync //g" scripts/packages

Holding these three packages back for the SSM may not be right from security standpoint. However, with my limited understanding and knowledge as on date, this is the only way we can use hardening with EC2 Image Builder. Removal of these three packages has to be probably handled outside the context of the EC2 Image builder.

@rams3sh commented on GitHub (May 14, 2022): ## TL;DR Removal of `apport` , `rsync` and `popularity-contest` leads to uninstallation of snapd resulting in removal of ssm agent. ## Long Version I debugged the execution of the script and narrowed down the problem. Used the below dirty script to identify the issue. It recursively simulates the package removal and displays the package that would be removed. ```bash #!/bin/bash list=`sudo apt-get purge --simulate $1 | sed -e "s/^\b[0-9]\{1,100\} upgraded\b/\$/g" | tr -d "\n" | grep -Po "(?<=REMOVED: )[^\$]+"` if [ -z "$list" ] then echo "Deleting $1 deletes: $1" else echo "Deleting $1 deletes: $list" fi echo "=============================" if [ -z "$2" ] then file_name="/tmp/$1" else file_name="$2" fi echo $1 >> $file_name for p in $list;do isInFile=$(cat $file_name | grep -c $p) if [ $isInFile -eq 0 ]; then #string not contained in file bash $0 $p $file_name else #string is in file at least once : fi done if [ -z "$2" ] then rm $file_name fi ``` Placed the above script as `apt-get-purge-simulate` in /usr/bin and replaced `$APT purge` across all scripts with `apt-get-purge-simulate` to identify the root package because of whom snapd gets removed. Log snippet below :- ``` [31] Disable apport, ubuntu-report and popularity-contest ============================= Deleting popularity-contest deletes: command-not-found* friendly-recovery* iputils-tracepath* irqbalance* libntfs-3g883* libnuma1* libpcap0.8* mtr-tiny* nano* ntfs-3g* popularity-contest* python3-commandnotfound* python3-gdbm* snapd* squashfs-tools* tcpdump* telnet* ubuntu-standard* ============================= ... [43] Package removal ============================= Deleting popularity-contest deletes: command-not-found* friendly-recovery* iputils-tracepath* irqbalance* libntfs-3g883* libnuma1* libpcap0.8* mtr-t iny* nano* ntfs-3g* popularity-contest* python3-commandnotfound* python3-gdbm* snapd* squashfs-tools* tcpdump* telnet* ubuntu-standard* ============================= .. ============================= Deleting rsync* deletes: command-not-found* friendly-recovery* iputils-tracepath* irqbalance* libntfs-3g883* libnuma1* libpcap0.8* mtr-tiny* nano* ntfs-3g* python3-commandnotfound* python3-gdbm* rsync* snapd* squashfs-tools* tcpdump* telnet* ubuntu-standard* ============================= ``` Re-ran the hardening again after removal of `popularity-contest` and `rsync` from f_apport (scripts/apport) and f_package_remove (scripts/packages). The snapd got removed again. Finally after trial and error with multiple runs of commenting out certain functions found out that apport also removed snapd. Repeated the run again with removal of apport from the `scripts/packages`. Finally the script finished sucessfully with snap being intact. Below script achieves the above ``` sed -i "s/ f_apport/# f_apport/g" ubuntu.sh &&\ sed -i "s/apport\* //g" scripts/packages &&\ sed -i "s/popularity-contest //g" scripts/packages &&\ sed -i "s/rsync //g" scripts/packages ``` Holding these three packages back for the SSM may not be right from security standpoint. However, with my limited understanding and knowledge as on date, this is the only way we can use hardening with EC2 Image Builder. Removal of these three packages has to be probably handled outside the context of the EC2 Image builder.

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 14, 2022):

Great work! Makes no sense to me why apport or popularity-contest is a dependency for snapdbut here we are, will add a variable to fix this.

@konstruktoid commented on GitHub (May 14, 2022): Great work! Makes no sense to me why `apport` or `popularity-contest` is a dependency for `snapd`but here we are, will add a variable to fix this.

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 14, 2022):

According to https://packages.ubuntu.com/focal/snapd there is no dependency.

@konstruktoid commented on GitHub (May 14, 2022): According to https://packages.ubuntu.com/focal/snapd there is no dependency.

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@rams3sh commented on GitHub (May 14, 2022):

Thanks !!
I did check that site and I myself actually couldnt figure out why it's behaving the way it is .

I was using Ubuntu 20 LTS version for this.

@rams3sh commented on GitHub (May 14, 2022): Thanks !! I did check that site and I myself actually couldnt figure out why it's behaving the way it is . I was using Ubuntu 20 LTS version for this.

kerem commented

2026-03-03 13:58:47 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 14, 2022):

Hmm, purging those doesn't remove snapd from me.

~$ for S in apport popularity-contest rsync; do sudo apt-get purge --assume-yes "${S}"; done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  apport-symptoms python3-apport python3-problem-report python3-systemd
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  apport* ubuntu-server*
0 upgraded, 0 newly installed, 2 to remove and 4 not upgraded.
After this operation, 863 kB disk space will be freed.
(Reading database ... 63737 files and directories currently installed.)
Removing ubuntu-server (1.450.2) ...
Removing apport (2.20.11-0ubuntu27.23) ...
Processing triggers for man-db (2.9.1-1) ...
(Reading database ... 63645 files and directories currently installed.)
Purging configuration files for apport (2.20.11-0ubuntu27.23) ...
Processing triggers for systemd (245.4-4ubuntu3.17) ...
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  apport-symptoms python3-apport python3-problem-report python3-systemd
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  popularity-contest* ubuntu-standard*
0 upgraded, 0 newly installed, 2 to remove and 4 not upgraded.
After this operation, 177 kB disk space will be freed.
(Reading database ... 63635 files and directories currently installed.)
Removing ubuntu-standard (1.450.2) ...
Removing popularity-contest (1.69ubuntu1) ...
Processing triggers for man-db (2.9.1-1) ...
(Reading database ... 63608 files and directories currently installed.)
Purging configuration files for popularity-contest (1.69ubuntu1) ...
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  apport-symptoms python3-apport python3-problem-report python3-systemd
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  rsync*
0 upgraded, 0 newly installed, 1 to remove and 4 not upgraded.
After this operation, 688 kB disk space will be freed.
(Reading database ... 63607 files and directories currently installed.)
Removing rsync (3.1.3-8ubuntu0.3) ...
Processing triggers for man-db (2.9.1-1) ...
(Reading database ... 63579 files and directories currently installed.)
Purging configuration files for rsync (3.1.3-8ubuntu0.3) ...
Processing triggers for systemd (245.4-4ubuntu3.17) ...
~$ dpkg -l | grep 'snap'
ii  snapd                           2.54.3+20.04.1ubuntu0.3            amd64        Daemon and tooling that enable snap packages
~$ snap list
Name    Version        Rev    Tracking       Publisher   Notes
core20  20220329       1434   latest/stable  canonical✓  base
lxd     4.0.9-8e2046b  22753  4.0/stable/…   canonical✓  -
snapd   2.55.3         15534  latest/stable  canonical✓  snapd

@konstruktoid commented on GitHub (May 14, 2022): Hmm, purging those doesn't remove snapd from me. ```sh ~$ for S in apport popularity-contest rsync; do sudo apt-get purge --assume-yes "${S}"; done Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: apport-symptoms python3-apport python3-problem-report python3-systemd Use 'sudo apt autoremove' to remove them. The following packages will be REMOVED: apport* ubuntu-server* 0 upgraded, 0 newly installed, 2 to remove and 4 not upgraded. After this operation, 863 kB disk space will be freed. (Reading database ... 63737 files and directories currently installed.) Removing ubuntu-server (1.450.2) ... Removing apport (2.20.11-0ubuntu27.23) ... Processing triggers for man-db (2.9.1-1) ... (Reading database ... 63645 files and directories currently installed.) Purging configuration files for apport (2.20.11-0ubuntu27.23) ... Processing triggers for systemd (245.4-4ubuntu3.17) ... Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: apport-symptoms python3-apport python3-problem-report python3-systemd Use 'sudo apt autoremove' to remove them. The following packages will be REMOVED: popularity-contest* ubuntu-standard* 0 upgraded, 0 newly installed, 2 to remove and 4 not upgraded. After this operation, 177 kB disk space will be freed. (Reading database ... 63635 files and directories currently installed.) Removing ubuntu-standard (1.450.2) ... Removing popularity-contest (1.69ubuntu1) ... Processing triggers for man-db (2.9.1-1) ... (Reading database ... 63608 files and directories currently installed.) Purging configuration files for popularity-contest (1.69ubuntu1) ... Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: apport-symptoms python3-apport python3-problem-report python3-systemd Use 'sudo apt autoremove' to remove them. The following packages will be REMOVED: rsync* 0 upgraded, 0 newly installed, 1 to remove and 4 not upgraded. After this operation, 688 kB disk space will be freed. (Reading database ... 63607 files and directories currently installed.) Removing rsync (3.1.3-8ubuntu0.3) ... Processing triggers for man-db (2.9.1-1) ... (Reading database ... 63579 files and directories currently installed.) Purging configuration files for rsync (3.1.3-8ubuntu0.3) ... Processing triggers for systemd (245.4-4ubuntu3.17) ... ~$ dpkg -l | grep 'snap' ii snapd 2.54.3+20.04.1ubuntu0.3 amd64 Daemon and tooling that enable snap packages ~$ snap list Name Version Rev Tracking Publisher Notes core20 20220329 1434 latest/stable canonical✓ base lxd 4.0.9-8e2046b 22753 4.0/stable/… canonical✓ - snapd 2.55.3 15534 latest/stable canonical✓ snapd ```

kerem commented

2026-03-03 13:58:48 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 14, 2022):

But you are correct, your code works ¯_(ツ)_/¯

@konstruktoid commented on GitHub (May 14, 2022): But you are correct, your code works ¯\_(ツ)_/¯

kerem commented

2026-03-03 13:58:48 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 14, 2022):

I've added a Packer configuration with an installation script, see #124
I'll add a snapd variable soon.

@konstruktoid commented on GitHub (May 14, 2022): I've added a Packer configuration with an installation script, see #124 I'll add a `snapd` variable soon.

kerem commented

2026-03-03 13:58:48 +03:00

Author

Owner

@rams3sh commented on GitHub (May 15, 2022):

@konstruktoid . You are rite. But this happens only during the execution of the complete script. It's weird , but thats how it functions.

Removing the package individually does not result in snap being removed.

@rams3sh commented on GitHub (May 15, 2022): @konstruktoid . You are rite. But this happens only during the execution of the complete script. It's weird , but thats how it functions. Removing the package individually does not result in snap being removed.

kerem commented

2026-03-03 13:58:48 +03:00

Author

Owner

@konstruktoid commented on GitHub (May 16, 2022):

KEEP_SNAPD variable added

@konstruktoid commented on GitHub (May 16, 2022): `KEEP_SNAPD` variable added

kerem referenced this issue

2026-03-03 14:29:46 +03:00

[PR #56] [MERGED] #55 aide timer duplication #123

Rows
Columns

[GH-ISSUE #123] Disabling Snap removal #56

TL;DR

Long Version