Regarding AppArmor in the kernel

The partial confinement for snaps largely comes from the extended af_unix mediation missing in upstream apparmor, this also which includes the labeling necessary for the dbus interface. Parts of this have been upstreamed but it is not yet complete, the final parts should land in 6.12.

The 6.12 version will be a bit different than what has been carried in Ubuntu so far (24.10 should have the new version) as there was regression against upstream discovered, forcing an abi change causing this to miss 6.11.

A new version of the apparmor userspace will be required to support the abi change. However with snapd now vendoring apparmor, once it pulls in an update it will be able to support the upsteam version.