File 0001-interfaces-apparmor-do-not-fail-during-ini... of Package snapd

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-interfaces-apparmor-do-not-fail-during-initializatio.patch of Package snapd (Revision ecc6ce8f02c7a76a9a3fe7304b33795c)

Currently displaying revision ecc6ce8f02c7a76a9a3fe7304b33795c , Show latest

From b18b33b7cdc55facee11ef28289cb49edef4f18b Mon Sep 17 00:00:00 2001
Message-Id: <b18b33b7cdc55facee11ef28289cb49edef4f18b.1610114393.git.maciej.zenon.borzecki@canonical.com>
From: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>
Date: Wed, 9 Dec 2020 13:52:22 +0100
Subject: [PATCH] interfaces/apparmor: do not fail during initialization when
 there is no AppArmor profile for snap-confine

Some distros support AppArmor in the kernel and have the necessary userspace
tools, but the snapd package (specifically the snap-confine binary) is built
without AppArmor support. In this case, the AppArmor profiles files will not be
present on the host.

Should such distro run with /home on NFS, or overlay set up for /, the apparmor
backend initialization would fail on trying to update the profile files, this
preventing snapd from operating at all. In particular, this happens on openSUSE
Leap 15.x where the snapd package is built with AppArmor support disabled.

See https://forum.snapcraft.io/t/snapd-doesnt-start-on-opensuse-leap-15-1/13710
for more details.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>
---
 interfaces/apparmor/backend.go      | 18 +++++++++--
 interfaces/apparmor/backend_test.go | 46 +++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/interfaces/apparmor/backend.go b/interfaces/apparmor/backend.go
index 1819525c2bf54a8d3807855b889c2a1f5f2202ca..f418172dc757cc8984e800d3daa0f620e18f0c5a 100644
--- a/interfaces/apparmor/backend.go
+++ b/interfaces/apparmor/backend.go
@@ -160,18 +160,27 @@ func (b *Backend) Initialize(opts *interfaces.SecurityBackendOptions) error {
 	// not.  If we do then we prefer the file ending with the name .real as
 	// that is the more recent name we use.
 	var profilePath string
+	// TODO: fix for distros using /usr/libexec/snapd
 	for _, profileFname := range []string{"usr.lib.snapd.snap-confine.real", "usr.lib.snapd.snap-confine"} {
-		profilePath = filepath.Join(apparmor_sandbox.ConfDir, profileFname)
-		if _, err := os.Stat(profilePath); err != nil {
+		maybeProfilePath := filepath.Join(apparmor_sandbox.ConfDir, profileFname)
+		if _, err := os.Stat(maybeProfilePath); err != nil {
 			if os.IsNotExist(err) {
 				continue
 			}
 			return err
 		}
+		profilePath = maybeProfilePath
 		break
 	}
 	if profilePath == "" {
-		return fmt.Errorf("cannot find system apparmor profile for snap-confine")
+		// XXX: is profile mandatory on some distros?
+
+		// There is no AppArmor profile for snap-confine, quite likely
+		// AppArmor support is enabled in the kernel and relevant
+		// userspace tools exist, but snap-confine was built without it,
+		// nothing we need to update then.
+		logger.Noticef("snap-confine apparmor profile is absent, nothing to update")
+		return nil
 	}
 
 	aaFlags := skipReadCache
@@ -193,6 +202,9 @@ func (b *Backend) Initialize(opts *interfaces.SecurityBackendOptions) error {
 // snapConfineFromSnapProfile returns the apparmor profile for
 // snap-confine in the given core/snapd snap.
 func snapConfineFromSnapProfile(info *snap.Info) (dir, glob string, content map[string]osutil.FileState, err error) {
+	// TODO: fix this for distros using /usr/libexec/snapd when those start
+	// to use reexec
+
 	// Find the vanilla apparmor profile for snap-confine as present in the given core snap.
 
 	// We must test the ".real" suffix first, this is a workaround for
diff --git a/interfaces/apparmor/backend_test.go b/interfaces/apparmor/backend_test.go
index 1188dff105662acce716aaf56b9b852606c9a28f..cbc31a0b13d9e27be4af32f5e52115d16c7214bd 100644
--- a/interfaces/apparmor/backend_test.go
+++ b/interfaces/apparmor/backend_test.go
@@ -169,6 +169,8 @@ func (s *backendSuite) SetUpTest(c *C) {
 	s.parserCmd = testutil.MockCommand(c, "apparmor_parser", fakeAppArmorParser)
 
 	apparmor.MockRuntimeNumCPU(func() int { return 99 })
+	restore := release.MockReleaseInfo(&release.OS{ID: "ubuntu"})
+	s.AddCleanup(restore)
 }
 
 func (s *backendSuite) TearDownTest(c *C) {
@@ -1429,6 +1431,28 @@ func (s *backendSuite) TestSetupSnapConfineGeneratedPolicyWithNFS2(c *C) {
 	s.testSetupSnapConfineGeneratedPolicyWithNFS(c, "usr.lib.snapd.snap-confine.real")
 }
 
+func (s *backendSuite) TestSetupSnapConfineGeneratedPolicyWithNFSNoProfileFiles(c *C) {
+	// Make it appear as if NFS workaround was needed.
+	restore := apparmor.MockIsHomeUsingNFS(func() (bool, error) { return true, nil })
+	defer restore()
+	// Make it appear as if overlay was not used.
+	restore = apparmor.MockIsRootWritableOverlay(func() (string, error) { return "", nil })
+	defer restore()
+
+	// Intercept interaction with apparmor_parser
+	cmd := testutil.MockCommand(c, "apparmor_parser", "")
+	defer cmd.Restore()
+	// Set up apparmor profiles directory, but no profile for snap-confine
+	c.Assert(os.MkdirAll(apparmor_sandbox.ConfDir, 0755), IsNil)
+
+	// The apparmor backend should not fail if the apparmor profile of
+	// snap-confine is not present
+	err := (&apparmor.Backend{}).Initialize(nil)
+	c.Assert(err, IsNil)
+	// Since there is no profile file, no call to apparmor were made
+	c.Assert(cmd.Calls(), HasLen, 0)
+}
+
 // snap-confine policy when NFS is used and snapd has not re-executed.
 func (s *backendSuite) testSetupSnapConfineGeneratedPolicyWithNFS(c *C, profileFname string) {
 	// Make it appear as if NFS workaround was needed.
@@ -1754,6 +1778,28 @@ func (s *backendSuite) TestSetupSnapConfineGeneratedPolicyWithOverlay2(c *C) {
 	s.testSetupSnapConfineGeneratedPolicyWithOverlay(c, "usr.lib.snapd.snap-confine.real")
 }
 
+func (s *backendSuite) TestSetupSnapConfineGeneratedPolicyWithOverlayNoProfileFiles(c *C) {
+	// Make it appear as if overlay workaround was needed.
+	restore := apparmor.MockIsRootWritableOverlay(func() (string, error) { return "/upper", nil })
+	defer restore()
+	// No NFS workaround
+	restore = apparmor.MockIsHomeUsingNFS(func() (bool, error) { return false, nil })
+	defer restore()
+
+	// Intercept interaction with apparmor_parser
+	cmd := testutil.MockCommand(c, "apparmor_parser", "")
+	defer cmd.Restore()
+	// Set up apparmor profiles directory, but no profile for snap-confine
+	c.Assert(os.MkdirAll(apparmor_sandbox.ConfDir, 0755), IsNil)
+
+	// The apparmor backend should not fail if the apparmor profile of
+	// snap-confine is not present
+	err := (&apparmor.Backend{}).Initialize(nil)
+	c.Assert(err, IsNil)
+	// Since there is no profile file, no call to apparmor were made
+	c.Assert(cmd.Calls(), HasLen, 0)
+}
+
 // snap-confine policy when overlay is used and snapd has not re-executed.
 func (s *backendSuite) testSetupSnapConfineGeneratedPolicyWithOverlay(c *C, profileFname string) {
 	// Make it appear as if overlay workaround was needed.
-- 
2.30.0

Places

File 0001-interfaces-apparmor-do-not-fail-during-initializatio.patch of Package snapd (Revision ecc6ce8f02c7a76a9a3fe7304b33795c)

Places