ssh: invoke sshd -T with a clean environment

[ogayot]

When calling sshd -T, we used to inherit the LD_LIBRARY_PATH variable, resulting in the following errors on focal:

sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.33' not found (required by /snap/subiquity/5270/usr/lib/x86_64-linux-gnu/libsystemd.so.0)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by /snap/subiquity/5270/usr/lib/x86_64-linux-gnu/libsystemd.so.0)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /snap/subiquity/5270/usr/lib/x86_64-linux-gnu/libsystemd.so.0)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by /snap/core22/current/lib/x86_64-linux-gnu/liblzma.so.5)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /snap/core22/current/lib/x86_64-linux-gnu/liblzma.so.5)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.33' not found (required by /snap/core22/current/lib/x86_64-linux-gnu/libcap.so.2)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.33' not found (required by /snap/core22/current/lib/x86_64-linux-gnu/libgcrypt.so.20)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.32' not found (required by /snap/core22/current/lib/x86_64-linux-gnu/libgpg-error.so.0)
sshd: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by /snap/core22/current/lib/x86_64-linux-gnu/libgpg-error.so.0)

Fixed by sanitizing the environment first. We don't expect sshd to be present in the snap anyway.

I encountered this while trying to reproduce the bug described at LP:#2050030

[mwhudson]

Remind me, what sets LD_LIBRARY_PATH these days? is it code injected by snapcraft? because i'm not sure why we need it...

[ogayot]

Remind me, what sets LD_LIBRARY_PATH these days? is it code injected by snapcraft? because i'm not sure why we need it...

it looks like it's set by snapcraft ; which is interesting because it wasn't in the 22.07.2 snap.

# env | grep LIBRARY_PATH
# snap run --shell subiquity.subiquity-server
# env | grep LIBRARY_PATH
SNAP_LIBRARY_PATH=/var/lib/snapd/lib/gl:/var/lib/snapd/lib/gl32:/var/lib/snapd/void
LD_LIBRARY_PATH=/var/lib/snapd/lib/gl:/var/lib/snapd/lib/gl32:/var/lib/snapd/void:/snap/subiquity/5270/lib:/snap/subiquity/5270/usr/lib:/snap/subiquity/5270/lib/x86_64-linux-gnu:/snap/subiquity/5270/usr/lib/x86_64-linux-gnu

# grep -C 5 LD_LIBRARY_PATH /snap/subiquity/5270/meta/snap.yaml
      OS_PROBER_SHARE: $SNAP/usr/share
      OS_PROBER_LIB: $SNAP/usr/lib
confinement: classic
grade: stable
environment:
  LD_LIBRARY_PATH: ${SNAP_LIBRARY_PATH}${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}:$SNAP/lib:$SNAP/usr/lib:$SNAP/lib/x86_64-linux-gnu:$SNAP/usr/lib/x86_64-linux-gnu
  PATH: $SNAP/usr/sbin:$SNAP/usr/bin:$SNAP/sbin:$SNAP/bin:$PATH
links:
  contact:
  - https://bugs.launchpad.net/subiquity/+filebug
  issues:

not sure how it ended up there since it isn't in our snapcraft.yaml definition https://github.com/canonical/subiquity/blob/01fd8d22a95afff7ede308437856e43832210350/snapcraft.yaml

EDIT: canonical/snapcraft#4187 seems relevant. The fix was first included in https://github.com/snapcore/snapcraft/releases/tag/8.0.0 and is available in the stable channel.

[ogayot]

Converting to draft since the change would not be needed when we rebuild with snapcraft 8