interfaces/many: deny arbitrary desktop files and misc from /usr/share #8301
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -26,6 +26,7 @@ import ( | |
| "regexp" | ||
| "sort" | ||
|
|
||
| "github.com/snapcore/snapd/dirs" | ||
| "github.com/snapcore/snapd/interfaces" | ||
| "github.com/snapcore/snapd/release" | ||
| "github.com/snapcore/snapd/snap" | ||
|
|
@@ -125,3 +126,58 @@ func verifySlotPathAttribute(slotRef *interfaces.SlotRef, attrs interfaces.Attre | |
| } | ||
| return cleanPath, nil | ||
| } | ||
|
|
||
| // aareExclusivePatterns takes a string and generates deny alternations. Eg, | ||
| // aareExclusivePatterns("foo") returns: | ||
| // []string{ | ||
| // "[^f]*", | ||
| // "f[^o]*", | ||
| // "fo[^o]*", | ||
| // } | ||
| func aareExclusivePatterns(orig string) []string { | ||
| // This function currently is only intended to be used with desktop | ||
| // prefixes as calculated by info.DesktopPrefix (the snap name and | ||
| // instance name, if present). To avoid having to worry about aare | ||
| // special characters, etc, perform ValidateDesktopPrefix() and return | ||
| // an empty list if invalid. If this function is modified for other | ||
| // input, aare/quoting/etc will have to be considered. | ||
| if !snap.ValidateDesktopPrefix(orig) { | ||
| return make([]string, 0) | ||
jdstrand marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
|
|
||
| s := make([]string, len(orig)) | ||
|
|
||
| prefix := "" | ||
| for i, letter := range orig { | ||
| prefix = orig[:i] | ||
| s[i] = fmt.Sprintf("%s[^%c]*", prefix, letter) | ||
|
There was a problem hiding this comment. since apparmor globbing is not quite regex, are there any characters here we might need to escape such as "^" itself or is this all handled in the expected way by apparmor's regex/globs ? There was a problem hiding this comment. @jdstrand is the authority here, but I suspect the problematic characters would be Given that the input to this function is validated to not contain the problem characters, I don't think it is worth trying to implement escaping. There was a problem hiding this comment.
That is precisely why I did not do this; we are using this with snapInstanceName only. I'll add a snap.ValidateInstanceName() and add some additional tests. There was a problem hiding this comment. Done (at first I did ValidateInstanceName() but based on other feedback, I'm not using a new ValidateDesktopPrefix()). |
||
| } | ||
| return s | ||
| } | ||
|
|
||
| // getDesktopFileRules(<snap instance name>) generates snippet rules for | ||
| // allowing access to the specified snap's desktop files in | ||
| // dirs.SnapDesktopFilesDir, but explicitly denies access to all other snaps' | ||
| // desktop files since xdg libraries may try to read all the desktop files | ||
| // in the dir, causing excessive noise. (LP: #1868051) | ||
| func getDesktopFileRules(snapInstanceName string) []string { | ||
| baseDir := dirs.SnapDesktopFilesDir | ||
|
|
||
| rules := []string{ | ||
| "# Support applications which use the unity messaging menu, xdg-mime, etc", | ||
| "# This leaks the names of snaps with desktop files", | ||
| fmt.Sprintf("%s/ r,", baseDir), | ||
| "# Allowing reading only our desktop files (required by (at least) the unity", | ||
| "# messaging menu).", | ||
| "# parallel-installs: this leaks read access to desktop files owned by keyed", | ||
| "# instances of @{SNAP_NAME} to @{SNAP_NAME} snap", | ||
| fmt.Sprintf("%s/@{SNAP_INSTANCE_DESKTOP}_*.desktop r,", baseDir), | ||
| "# Explicitly deny access to other snap's desktop files", | ||
| fmt.Sprintf("deny %s/@{SNAP_INSTANCE_DESKTOP}[^_.]*.desktop r,", baseDir), | ||
| } | ||
| for _, t := range aareExclusivePatterns(snapInstanceName) { | ||
mvo5 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| rules = append(rules, fmt.Sprintf("deny %s/%s r,", baseDir, t)) | ||
| } | ||
|
|
||
| return rules | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This access is removed but not added anywhere back AFAICT - is there a regression risk here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No. This path does not exist in core images (notice is is in /usr, which comes from core* snaps). This is explained in commit 105b47f: