Merge pull request #5784 from freedomofpress/5128-remove-snappy

Fixes #5128 removes snappy from the default installation

install_files/ansible-base/roles/common/defaults/main.yml

@@ -49,3 +49,4 @@ unused_packages:
   - libiw30
   - wireless-tools
   - wpasupplicant
+  - snapd

install_files/ansible-base/roles/common/tasks/remove_unused_packages.yml

@@ -3,6 +3,7 @@
   apt:
     name: "{{ unused_packages }}"
     state: absent
+    purge: yes
   tags:
     - apt
     - hardening

molecule/testinfra/common/test_system_hardening.py

@@ -148,8 +148,9 @@ def test_no_ecrypt_messages_in_logs(host, logfile):
 @pytest.mark.parametrize('package', [
     'cloud-init',
     'libiw30',
-    'wpasupplicant',
+    'snapd',
     'wireless-tools',
+    'wpasupplicant',
 ])
 def test_unused_packages_are_removed(host, package):
     """ Check if unused package is present """
@@ -165,3 +166,10 @@ def test_iptables_packages(host):
         assert host.package("iptables-persistent").is_installed
     else:
         assert not host.package("iptables-persistent").is_installed
+
+
+def test_snapd_absent(host):
+    assert not host.file("/lib/systemd/system/snapd.service").exists
+    assert not host.file("/etc/apparmor.d/usr.lib.snapd.snap-confine.real").exists
+    assert not host.file("/usr/bin/snap").exists
+    assert not host.file("/var/lib/snapd/snaps").exists