daemon, seclog: log snapd restarts outside requested restart and standby

[ernestl]

Log snapd process exits that previously had no lifecycle event. sys_restart_snapd stays reason-only: attributes are snapd_version and reason. There is no error attribute and no error text in the description. The Go error remains in the journal from the process exit.

Rebased on master, which includes the signal event from #17762. A SIGTERM or SIGINT stop is sys_exit_signal_snapd. This change logs sys_restart_snapd for the stop-failed and idle-aborted cases below.

Summary:

• When idle standby was requested but pending requests prevented it, log reason snapd-idle-aborted. The process exits 0.
• When Stop returns an error (no Overlord, or tomb.Wait fails outside a system shutdown), log reason snapd-stop-failed.
• Those two reasons are string constants in seclog. They are not restart.RestartReason values and are not passed to restart.Request.
• RestartSnapdIdle stays a RestartSocket request. Completed socket standby (ErrRestartSocket, exit 42) still logs sys_standby_snapd with reason snapd-idle.
• Requested daemon restarts (snapd-update, snapd-revert, snapd-undo, snapd-feature-change) are unchanged. LogSystemRestartSnapd and LogSystemStandbySnapd take the reason as a string.
• A signal stop stays sys_exit_signal_snapd only. StopDaemon (preseed), system restart and shutdown (doReboot, including a signal that arrives while waiting), and both snap-failure startup results stay off sys_restart_snapd. Those starts are already sys_startup_snapd.
• The security-logging spread test restores the snapd unit override before starting the service, so SNAPD_STANDBY_WAIT=1s does not remain in an already running process. It still checks sys_exit_signal_snapd, snapd-update, and snapd-idle.

Spec: SD236- Security Event Logging
JIRA: https://warthogs.atlassian.net/browse/SNAPDENG-37102

[Copilot]

Copilot review overview

🟡 Changes recommended

Failure-recovery errors can emit a restart event even though the transient recovery process is not restarted.

Review effort: Balanced
Findings: 1

Open (1)

• Avoid logging snapd restart when failure recovery exits unsuccessfully · New

What changed in this PR

Adds security events for unexpected snapd restarts and no-op failure recovery.

Changes:

• Adds restart reasons and optional error descriptions.
• Logs restart events before security logging teardown.
• Extends unit coverage for new restart paths.

File	Description
seclog/​seclog.go	Supports error-aware restart descriptions.
seclog/​seclog_test.go	Tests restart event formatting.
overlord/​restart/​restart.go	Defines new restart reasons.
daemon/​daemon.go	Logs no-op failure recovery restarts.
daemon/​daemon_test.go	Tests failure recovery logging.
cmd/​snapd/​daemon/​main.go	Logs unexpected run errors.
cmd/​snapd/​daemon/​main_test.go	Tests unexpected restart filtering.
cmd/​snapd/​daemon/​export_test.go	Exposes the helper for tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

❌ Patch coverage is 95.45455% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 78.50%. Comparing base (ba2436a) to head (a90446e).

Files with missing lines	Patch %	Lines
daemon/daemon.go	91.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #17763      +/-   ##
==========================================
- Coverage   82.06%   78.50%   -3.57%     
==========================================
  Files        1420     1416       -4     
  Lines      201401   201315      -86     
  Branches     2503     2503              
==========================================
- Hits       165279   158039    -7240     
+ Misses      33914    33863      -51     
- Partials     2208     9413    +7205     

Flag	Coverage Δ
unittests	78.50% <95.45%> (-3.57%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Copilot review overview

🟡 Changes recommended

Preseed failures currently emit a restart event even though snapd is not restarted.

Review effort: Balanced
Findings: 1

Open (1)

• Avoid false snapd restart audit events during preseed · New

Resolved since last review (1)

• Avoid logging snapd restart when failure recovery exits unsuccessfully

[github-actions]

Tue Oct 13 19:21:05 UTC 2026
The following results are from: https://github.com/canonical/snapd/actions/runs/38382398016

Test Predictor Analysis

Preparing

Test	Success %
openstack:ubuntu-core-24-64:tests/main/ 2 times	🟢 100.0%

Executing

Test	Success %
openstack:debian-12-64:tests/main/snapshot-basic	🟢 83.3%
openstack:ubuntu-20.04-64:tests/main/lxd	🟢 100.0%

Skipped tests from snapd-testing-skip

If you wish to have any of the below tests run in your PR, in your PR description, add 'unskip:' followed by a copy-and-pasted list of the below tests you wish to run (unskip plus test list must be valid yaml)

• openstack:arch-linux-64:tests/main/interfaces-location-control
• openstack:debian-12-64:tests/main/interfaces-location-control
• openstack:ubuntu-20.04-64:tests/main/interfaces-location-control
• openstack:ubuntu-24.04-64:tests/main/i18n
• openstack:ubuntu-24.04-64:tests/main/interfaces-location-control
• openstack:ubuntu-24.04-64:tests/main/network-retry
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-flag-restart
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-integration-tests
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-prompt-restoration
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-smoke
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-snapd-startup
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-support
• openstack:ubuntu-26.04-64:tests/main/interfaces-location-control
• openstack:ubuntu-26.04-64:tests/main/interfaces-requests-activates-handlers

[Copilot]

🟡 Changes recommended

Restore ordering leaks the temporary standby configuration, and the tomb-failure event path lacks direct coverage.

3 open findings

• Restore service override before restarting snapd · New
• Avoid false snapd restart audit events during preseed
• Add coverage for real snapd tomb failure handling · New

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The lifecycle paths and their security events are consistently implemented and adequately tested.

1 open finding

• Add coverage for real snapd tomb failure handling

2 resolved since last review

• Restore service override before restarting snapd
• Avoid false snapd restart audit events during preseed

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The lifecycle paths are consistently implemented and covered by focused unit and integration tests.

1 open finding

• Add coverage for real snapd tomb failure handling

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The tomb failure path can emit a false restart event during preseed shutdown.

1 open finding

• Suppress restart event for StopDaemon during preseed shutdown · New

1 resolved since last review

• Add coverage for real snapd tomb failure handling

🧠 Review effort: Balanced

[Copilot]

🟢 Approval recommended

The lifecycle logging behavior is consistent with the stated scope and is adequately tested.

0 open findings

1 resolved since last review

• Suppress restart event for StopDaemon during preseed shutdown

🧠 Review effort: Balanced

[Mohit-Chachada]

Thanks!

[andrewphelpsj]

thanks!

[bboozzoo]

LGTM

[ernestl]

Failure analysis: Not related to changes.