Ubuntu Core, GDM Spike and a confined egmde user session

Mir
1

@jamesh of the desktop team has been working on getting GDM working on Ubuntu Core. This work enables egmde-confined-desktop to be installed, set up and run as a user session on Ubuntu Core:

Screenshot%20from%202020-08-24%2016-34-20
Screenshot from 2020-08-24 16-34-20.png2560Ă—1440 36 KB

Screenshot%20from%202020-08-24%2017-17-33
Screenshot from 2020-08-24 17-17-33.png2560Ă—1440 163 KB

Note, this is a self contained snap that can only launch applications included in the snap. Launching other snaps is a separate piece of work.

For more on the GDM spike: Desktop Team Updates - Monday 24th August 2020
For more on launching other snaps: https://github.com/snapcore/snapd/pull/8699

6 Likes
2

I’m excited to see work progressing to enable EGMDE to run atop Ubuntu Core. But I’m curious about the ultimate goals of the work.

Is allowing a traditional DE (such as Mate or Lomiri) to run atop Ubuntu Core among your goals?

And if so, leaving aside the work needed to repackage the DE and apps as snaps, what would be among the biggest challenges that a DE team would encounter when attempting to rebase from traditional Ubuntu to Ubuntu Core?

Please forgive me if my questions are too hypothetical and/or a wee bit premature. :slight_smile:

3

The snap ecosystem comes with a lot of control … imagine that today people run fleets of 10000s of IoT devices with Ubuntu Core installs centrally controlled from a single place …
The security system as well as the package management have been designed for exactly this …
Core is a readonly system where the admin has full control (going way farther than traditional linux installs) over all aspects of the install via a REST API …

https://github.com/CanonicalLtd/iot-management

Now imagine you are a company that needs to manage … say … 40000 desktops with very strict security limits for the user …

Snaps offer the admin to restrict access to system resources on a per-app basis through the snap interfaces. Snap packages are transitional, so you can roll back to a former version of your app within a second in case an update of an app broke functionality … if the snap packager wanted that, he can even put in update-self-tests to do this automatically.

In case of Ubuntu Core the kernel, bootloader and root filesystem are all snaps, they all have this built in self-test functionality so you do not need to send out a technician to one of these 40000 home-office workplaces if a kernel update failed, the system just heals itself with a reboot to the former kernel/rootfs/app …

An Ubuntu Core Desktop is a massive leap in enterprise desktop IMHO … and a good thing for home use if you are security-concerned or simply dont want to spend your every-two-weeks-visit at granny for fixing her computer and have cake with her instead :slight_smile:

3 Likes
4

I heartily agree! Moreover, I hope that we’ll eventually have the ability to install Ubuntu Core Desktop on a great many devices, including desktops, laptops, and mobile.

5

There are a few more moving parts to this.

  1. egmde already runs (as a daemon) on Ubuntu Core (there’s an egmde-confined-desktop snap which was used here. This demonstrates running in a user session.
  2. Having multiple users (and not just daemons) on a system running Ubuntu Core has a wide range of uses. For example, smart devices within a household might give different access to parents and children. Ubuntu Core hasn’t had support for user sessions, which us what the GDM spike has addressed.
  3. Confining a shell in a strict snap raises a number of issues. (The most obvious being how to launch anything outside the snap - even simple UIs on embedded devices might want to allow “applications” to be installed and run.)
  4. For full desktop environments which have evolved in environments without the restrictions of confinement there are lots of “gotchas”. One aspect of this work is to understand the impact.

That would be an eventual consequence of this stream of work and, as @ogra says, is a significant goal.

It will take work on any particular desktop to accommodate snap confinement. We’re not likely to undertake that work for either Mate or Lomiri. However, Lomiri was designed and implemented with click confinement, and that should make the task easier should someone choose to take that on.

2 Likes
6

not to mention that the way used to get a confined ubuntu desktop will indeed be documented (at least in source) so it should be reproducable for any other DE.

3 Likes