Add support for bind profiles

debian/usr.bin.snap-confine

@@ -69,6 +69,9 @@
 
     # reading seccomp filters
     /{tmp/snap.rootfs_*/,}var/lib/snapd/seccomp/profiles/* r,
+ 
+    # reading mount profiles
+    /{tmp/snap.rootfs_*/,}var/lib/snapd/mount/profiles/* r,
 
     # set up snap-specific private /tmp dir
     capability chown,

spread-tests/basic/task.yaml

@@ -0,0 +1,10 @@
+summary: Check that basic install works
+restore: |
+    snap remove hello-world
+execute: |
+    echo Run some hello-world stuff
+    snap install hello-world
+    hello-world.echo | grep Hello
+    hello-world.env | grep SNAP_NAME=hello-world
+    echo Ensure that we get an error if hello-world.evil does not return an error
+    if hello-world.evil; then exit 1; fi

spread.yaml

@@ -0,0 +1,38 @@
+project: snap-confine
+
+environment:
+    REUSE_PROJECT: $(echo $REUSE_PROJECT)
+    PATH: /snap/bin:$PATH
+
+backends:
+    linode:
+        key: $(echo $SPREAD_LINODE_KEY)
+        systems:
+            - ubuntu-16.04-64-grub
+            - ubuntu-16.04-32-grub
+
+path: /spread/snap-confine
+
+exclude:
+    - .git
+
+prepare: |
+    [ "$REUSE_PROJECT" != 1 ] || exit 0
+
+    apt purge -y snap-confine || true
+    apt update
+    apt install -y snapd fakeroot
+    apt build-dep -y ./
+
+    test -d /home/test || adduser --quiet --disabled-password --gecos '' test
+    chown test.test -R /home/test /spread/
+    sudo -i -u test /bin/sh -c "cd $PWD && DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -tc -b -Zgzip"
+    apt install -y ../ubuntu-core-launcher_*.deb ../snap-confine_*.deb 
+    rm -f ../snap-confine_*.deb
+
+suites:
+    spread-tests/:
+        summary: Full-system tests for snap-confinue
+        prepare: |
+            echo Ensure ubuntu-core is installed
+            sudo snap install ubuntu-core

src/main.c

@@ -90,6 +90,9 @@ int main(int argc, char **argv)
 		if (is_running_on_classic_distribution()) {
 			setup_snappy_os_mounts();
 		}
+		// setup the security backend bind mounts
+		setup_bind_mounts(appname);
+
 #ifdef STRICT_CONFINEMENT
 		// set up private mounts
 		setup_private_mount(appname);

src/mount-support.c

@@ -30,6 +30,7 @@
 #include <errno.h>
 #include <sched.h>
 #include <string.h>
+#include <mntent.h>
 
 #include "utils.h"
 #include "snap.h"
@@ -293,3 +294,50 @@ void setup_slave_mount_namespace()
 		die("can not make make / rslave");
 	}
 }
+
+void setup_bind_mounts(const char *appname)
+{
+	debug("%s: %s", __FUNCTION__, appname);
+
+	FILE *f = NULL;
+	const char *bind_profile_dir = "/var/lib/snapd/bind/profiles/";
+
+	char profile_path[PATH_MAX];
+	must_snprintf(profile_path, sizeof(profile_path), "%s/%s.bind",
+		      bind_profile_dir, appname);
+
+	f = fopen(profile_path, "r");
+	// it is ok for the file to not exist
+	if (f == NULL && errno == ENOENT)
+		return;
+	// however any other error is a real error
+	if (f == NULL) {
+		die("cannot open %s", profile_path);
+	}
+
+	struct mntent *m = NULL;
+	while ((m = getmntent(f)) != NULL) {
+		int flags = MS_BIND | MS_RDONLY | MS_NODEV | MS_NOSUID;
+
+		if (strcmp(m->mnt_type, "none") != 0) {
+			die("only 'none' filesystemtype is supported");
+		}
+		if (hasmntopt(m, "bind") == NULL) {
+			die("need bind mount flag");
+		}
+		if (hasmntopt(m, "rw") != NULL) {
+			flags &= ~MS_RDONLY;
+		}
+
+		if (mount(m->mnt_fsname, m->mnt_dir, NULL, flags, NULL) != 0) {
+			die("unable to bind private /tmp");
+		}
+	}
+
+	if (f != NULL) {
+		if (fclose(f) != 0)
+			die("could not close bind mount file");
+	}
+
+	return;
+}

src/mount-support.h

@@ -23,4 +23,6 @@ void setup_private_pts();
 void setup_snappy_os_mounts();
 void setup_slave_mount_namespace();
 
+void setup_bind_mounts(const char *appname);
+
 #endif

src/seccomp-support.c

@@ -150,12 +150,8 @@ void seccomp_load_filters(const char *filter_profile)
 		    secure_getenv("SNAPPY_LAUNCHER_SECCOMP_PROFILE_DIR");
 
 	char profile_path[512];	// arbitrary path name limit
-	int snprintf_rc = snprintf(profile_path, sizeof(profile_path), "%s/%s",
-				   filter_profile_dir, filter_profile);
-	if (snprintf_rc < 0 || snprintf_rc >= 512) {
-		errno = 0;
-		die("snprintf returned unexpected value");
-	}
+	must_snprintf(profile_path, sizeof(profile_path), "%s/%s",
+		      filter_profile_dir, filter_profile);
 
 	f = fopen(profile_path, "r");
 	if (f == NULL) {