bboozzoo/snapd forked from snapcore/snapd

Shellcheck was incorrectly raising this issue:

In tests/lib/prepare.sh line 211:
        output=$(bootenv)
                 ^-- SC2119: Use bootenv "$@" if function's $1 should mean script's $1.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Calling `bootenv` provides the desired output of all bootloader environment
variables. `bootenv list` would try to print the value of 'list' variable, which
is not something that is needed in this case.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…onment

Use helpers from tests/lib/boot.sh instead of calling grub tools directly.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Fedora and OpenSUSE use grub2-editenv instead of grub-editenv

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

cmd/snap-confine: Respect biarch nature of libdirs

cmd/snap-confine: Ensure snap-confine is allowed to access os-release

cmd: fix re-exec bug with classic confinement for host snapd < 2.28

 interfaces/kmod: simplify loadModules now that errors are ignored

The test relies on the "old" snapd-xdg-open deb package. However
with the promotion of snapd 2.28.5 into xenial-updates the pervious
snapd-xdg-open version 0.0.0~16.04 is no longer available to
download. This means we can not run the test. Disable for now
until we find a way to fix it.

The test relies on the "old" snapd-xdg-open deb package. However
with the promotion of snapd 2.28.5 into xenial-updates the pervious
snapd-xdg-open version 0.0.0~16.04 is no longer available to
download. This means we can not run the test. Disable for now
until we find a way to fix it.

…-classic

tests: disable xdg-open-compat test

tests: add test that checks core reverts on core devices

The test relies on the "old" snapd-xdg-open deb package. However
with the promotion of snapd 2.28.5 into xenial-updates the pervious
snapd-xdg-open version 0.0.0~16.04 is no longer available to
download. This means we can not run the test. Disable for now
until we find a way to fix it.

This follows the same bi-arching seen in other parts of the policy and
ensures snap-update-ns rules are actually matched on biarch distributions
employing a lib64 tree.

Signed-off-by: Ikey Doherty <ikey@solus-project.com>

This dupes the existing rule and fixes a regression on Solus where we
see a denial for the os-release file.

Signed-off-by: Ikey Doherty <ikey@solus-project.com>

dirs: use alt root when checking classic confinement support without …

Older version of snapd (before 2.28) did use the SNAPD_DID_REEXEC
env to check if they should re-exec or not. We need
to unset it after re-exec because the host snap tool may be old and
using this key.

So if e.g. the host has snapd 2.27 and snapd re-execs to 2.29 then
`snap run --shell classic-snap` will go into an environment where the
snapd 2.27 sees this key and stops re-execing and things break in
suble ways.

C.f.
https://forum.snapcraft.io/t/seccomp-error-calling-snap-from-another-classic-snap-on-core-candidate/2736/7

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…symlink workaround

The test needs be isolated from local filesystem state.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…ion-on-module-load

…-load

interfaces/kmod: treat failure to load module as non-fatal

cmd/snap-update-ns: fix golint and some stale comments

In PR snapcore#4162 we removed
failing in the kmod backend when modules cannot be loaded.

With this change the code can be simplified as now there is no
way for loadModules() to generate an error anymore.

corecfg:  support setting proxy.store if there's a matching store assertion

…eded

overlord/snapstate: toggle ignore-validation as needed as we do for channel

tests: fix security-device-cgroup* tests on devices with framebuffer

interfaces/raw-usb: match on SUBSYSTEM, not SUBSYSTEMS

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>