…ine-from-core

cmd/cmd.go

@@ -20,101 +20,26 @@
 package cmd
 
 import (
-	"io/ioutil"
 	"os"
-	"path/filepath"
-	"regexp"
 	"syscall"
 
 	"github.com/snapcore/snapd/logger"
 	"github.com/snapcore/snapd/osutil"
-	"github.com/snapcore/snapd/release"
-	"github.com/snapcore/snapd/strutil"
+	"github.com/snapcore/snapd/reexec"
 )
 
-// The SNAP_REEXEC environment variable controls whether the command
-// will attempt to re-exec itself from inside an ubuntu-core snap
-// present on the system. If not present in the environ it's assumed
-// to be set to 1 (do re-exec); that is: set it to 0 to disable.
-const key = "SNAP_REEXEC"
-
-// newCore is the place to look for the core snap; everything in this
-// location will be new enough to re-exec into.
-const newCore = "/snap/core/current"
-
-// oldCore is the previous location of the core snap. Only things
-// newer than minOldRevno will be ok to re-exec into.
-const oldCore = "/snap/ubuntu-core/current"
-
 // ExecInCoreSnap makes sure you're executing the binary that ships in
 // the core snap.
 func ExecInCoreSnap() {
-	if !release.OnClassic {
-		// you're already the real deal, natch
-		return
-	}
-
-	// should we re-exec? no option in the environment means yes
-	if !osutil.GetenvBool(key, true) {
-		logger.Debugf("re-exec disabled by user")
-		return
-	}
-
-	// can we re-exec? some distributions will need extra work before re-exec really works.
-	switch release.ReleaseInfo.ID {
-	case "fedora", "centos", "rhel":
-		logger.Debugf("re-exec not supported on distro %q yet", release.ReleaseInfo.ID)
-		return
-	}
-
 	// did we already re-exec?
 	if osutil.GetenvBool("SNAP_DID_REEXEC") {
 		return
 	}
 
-	exe, err := os.Readlink("/proc/self/exe")
-	if err != nil {
+	full := reexec.Path(Version)
+	if full == "" {
 		return
 	}
-
-	corePath := newCore
-	full := filepath.Join(newCore, exe)
-	if !osutil.FileExists(full) {
-		corePath = oldCore
-		full = filepath.Join(oldCore, exe)
-		if !osutil.FileExists(full) {
-			return
-		}
-	}
-
-	// ensure we do not re-exec into an older version of snapd, look
-	// for info file and ignore version of core that do not yet have
-	// it
-	fullInfo := filepath.Join(corePath, "/usr/lib/snapd/info")
-	if !osutil.FileExists(fullInfo) {
-		logger.Debugf("not restarting into %q (no version info): older than %q (%s)", full, exe, Version)
-		return
-	}
-	content, err := ioutil.ReadFile(fullInfo)
-	if err != nil {
-		logger.Noticef("cannot read info file %q: %s", fullInfo, err)
-		return
-	}
-	ver := regexp.MustCompile("(?m)^VERSION=(.*)$").FindStringSubmatch(string(content))
-	if len(ver) != 2 {
-		logger.Noticef("cannot find version information in %q", content)
-	}
-	// > 0 means our Version is bigger than the version of snapd in core
-	res, err := strutil.VersionCompare(Version, ver[1])
-	if err != nil {
-		logger.Debugf("cannot version compare %q and %q: %s", Version, ver[1], res)
-		return
-	}
-	if res > 0 {
-		logger.Debugf("not restarting into %q (%s): older than %q (%s)", full, ver, exe, Version)
-		return
-	}
-
 	logger.Debugf("restarting into %q", full)
 
 	env := append(os.Environ(), "SNAP_DID_REEXEC=1")

cmd/snap/cmd_run.go

@@ -29,9 +29,13 @@ import (
 
 	"github.com/jessevdk/go-flags"
 
+	"github.com/snapcore/snapd/cmd"
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/logger"
+	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/reexec"
+	"github.com/snapcore/snapd/release"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/snap/snapenv"
 )
@@ -220,9 +224,21 @@ func runSnapConfine(info *snap.Info, securityTag, snapApp, command, hook string,
 		logger.Noticef("WARNING: cannot create user data directory: %s", err)
 	}
 
-	cmd := []string{
-		filepath.Join(dirs.DistroLibExecDir, "snap-confine"),
+	// check for host snap-confine
+	snapConfinePath := filepath.Join(dirs.DistroLibExecDir, "snap-confine")
+	// check for core snap-confine, note the different libexec dirs
+	snapConfinePathInCore := filepath.Join(dirs.SnapMountDir, "/core/current/", dirs.CoreLibExecDir, "snap-confine")
+
+	shouldReexec := (reexec.Path(cmd.Version) != "")
+	cmd := []string{}
+	if release.OnClassic && shouldReexec && osutil.FileExists(snapConfinePathInCore) {
+		// FIXME: once https://github.com/snapcore/snapd/pull/2791
+		// lands use osutil.CommandFromCore() here
+		cmd = append(cmd, snapConfinePathInCore)
+	} else {
+		cmd = append(cmd, snapConfinePath)
 	}
+
 	if info.NeedsClassic() {
 		cmd = append(cmd, "--classic")
 	}

dirs/dirs.go

@@ -63,6 +63,9 @@ var (
 	SnapDesktopFilesDir string
 	SnapBusPolicyDir    string
 
+	SystemApparmorDir      string
+	SystemApparmorCacheDir string
+
 	CloudMetaDataFile string
 
 	ClassicDir string
@@ -147,6 +150,9 @@ func SetRootDir(rootdir string) {
 	SnapServicesDir = filepath.Join(rootdir, "/etc/systemd/system")
 	SnapBusPolicyDir = filepath.Join(rootdir, "/etc/dbus-1/system.d")
 
+	SystemApparmorDir = filepath.Join(rootdir, "/etc/apparmor.d")
+	SystemApparmorCacheDir = filepath.Join(rootdir, "/etc/apparmor.d/cache")
+
 	CloudMetaDataFile = filepath.Join(rootdir, "/var/lib/cloud/seed/nocloud-net/meta-data")
 
 	SnapUdevRulesDir = filepath.Join(rootdir, "/etc/udev/rules.d")

overlord/snapstate/snapmgr.go

@@ -23,14 +23,18 @@ package snapstate
 import (
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"math/rand"
 	"os"
+	"os/exec"
+	"path/filepath"
 	"strings"
 	"time"
 
 	"gopkg.in/tomb.v2"
 
 	"github.com/snapcore/snapd/boot"
+	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/errtracker"
 	"github.com/snapcore/snapd/i18n"
 	"github.com/snapcore/snapd/logger"
@@ -576,6 +580,107 @@ func (m *SnapManager) ensureUbuntuCoreTransition() error {
 	return nil
 }
 
+// cleanupSnapConfineApparmor will remove all but the current apparmor
+// profiles for the snap-confine binary from core
+func (m *SnapManager) cleanupSnapConfineApparmor(currentSnapConfineProfilePath string) error {
+	apparmorProfilePathPattern := strings.Replace(filepath.Join(dirs.SnapMountDir, "/core/*/usr/lib/snapd/snap-confine"), "/", ".", -1)[1:]
+
+	glob, err := filepath.Glob(filepath.Join(dirs.SystemApparmorDir, apparmorProfilePathPattern))
+	if err != nil {
+		return err
+	}
+
+	for _, path := range glob {
+		if path == currentSnapConfineProfilePath {
+			continue
+		}
+
+		// not using apparmor.UnloadProfile() because it uses a
+		// different cachedir
+		if output, err := exec.Command("apparmor_parser", "-R", filepath.Base(path)).CombinedOutput(); err != nil {
+			logger.Noticef("cannot unload apparmor profile %s: %v", filepath.Base(path), osutil.OutputErr(output, err))
+		}
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+		if err := os.Remove(filepath.Join(dirs.SystemApparmorCacheDir, filepath.Base(path))); err != nil && !os.IsNotExist(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (m *SnapManager) addSnapConfineApparmor(snapConfineInCore, apparmorProfilePath string) error {
+	coreRoot := filepath.Join(dirs.SnapMountDir, "/core/current/")
+
+	// FIXME: make this more generic once we start supporting more
+	//        distros with apparmor around snap-confine, i.e.
+	//        ship `snap-confine.apparmor.in` and use that as the base
+	//        because core is ubuntu and classic host might be anything
+	apparmorProfile, err := ioutil.ReadFile(filepath.Join(coreRoot, "/etc/apparmor.d/usr.lib.snapd.snap-confine"))
+	if err != nil {
+		return err
+	}
+
+	apparmorProfileForCore := strings.Replace(string(apparmorProfile), "/usr/lib/snapd/snap-confine", snapConfineInCore, -1)
+
+	// /etc/apparmor.d is read/write OnClassic, so write out the
+	// new core's profile there
+	if err := osutil.AtomicWriteFile(apparmorProfilePath, []byte(apparmorProfileForCore), 0644, 0); err != nil {
+		return err
+	}
+
+	// not using apparmor.LoadProfile() because it uses a different cachedir
+	if output, err := exec.Command("apparmor_parser", "--replace", "--write-cache", apparmorProfilePath, "--cache-loc", dirs.SystemApparmorCacheDir).CombinedOutput(); err != nil {
+		return fmt.Errorf("cannot replace snap-confine apparmor profile: %v", osutil.OutputErr(output, err))
+	}
+
+	return nil
+}
+
+// ensureSnapConfineApparmor ensures that we have a valid apparmor
+// profile for snap-confine when we are in re-exec mode
+func (m *SnapManager) ensureSnapConfineApparmor() error {
+	// On all-snaps we always use the mounted snapd, snap-confine,
+	// apparmor, etc but on classic we use the snapd and
+	// snap-confine from the latest core snap.  As such, nothing
+	// to do when not OnClassic
+	if !release.OnClassic {
+		return nil
+	}
+	// On releases that do not support apparmor there is no need to
+	// write an apparmor profile for snap-confine
+	if release.ReleaseInfo.ForceDevMode() {
+		return nil
+	}
+
+	root := filepath.Join(dirs.SnapMountDir, "/core/current/")
+	snapConfineInCore, err := filepath.EvalSymlinks(filepath.Join(root, "/usr/lib/snapd/snap-confine"))
+	// We do not always have a "current" symlink currently. This may happen
+	// when the system has no snaps yet or during a `snap refresh core`
+	if os.IsNotExist(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+
+	apparmorProfilePath := filepath.Join(dirs.SystemApparmorDir, strings.Replace(snapConfineInCore[1:], "/", ".", -1))
+
+	if err := m.cleanupSnapConfineApparmor(apparmorProfilePath); err != nil {
+		return err
+	}
+
+	if !osutil.FileExists(apparmorProfilePath) {
+		if err := m.addSnapConfineApparmor(snapConfineInCore, apparmorProfilePath); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
 // Ensure implements StateManager.Ensure.
 func (m *SnapManager) Ensure() error {
 	// do not exit right away on error
@@ -585,6 +690,13 @@ func (m *SnapManager) Ensure() error {
 
 	m.runner.Ensure()
 
+	// run after the runner so if we get a new core snap, we immediately
+	// generate the matching apparmor profile for snap-confine from core
+	if err := m.ensureSnapConfineApparmor(); err != nil {
+		// FIMXE: this will spam the world as ensure runs often
+		logger.Noticef("ensureSnapConfineApparmor failed with: %s", err)
+	}
+
 	//FIXME: use firstErr helper
 	if err1 != nil {
 		return err1