overlord/ifacestate: fix setup-profiles to use new snap revision for setup #1049

Merged
merged 7 commits into from Apr 26, 2016

Conversation

Projects
None yet
4 participants
Contributor

zyga commented Apr 20, 2016

This patch fixes a bug in setup-profiles where on snap upgrade, the
security would be still set up with the older revision of the snap.

This was caused by DisconnectSnap returning the list of snaps
(represented as snap.Info's) that are affected by the disconnect
operation. Those infos were subsequently used to setup the security of
each snap. This didn't work because snap.Info encodes the Revision which
changes on each upgrade.

Note that this bug is not a security vulnerability as apparmor uses the
revision in the actual profile so applications from both revisions are
simply unavailable.

Fixes: https://bugs.launchpad.net/snappy/+bug/1572463
Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com

overlord/ifacestate: fix setup-profiles to use new snap revision for …
…setup

This patch fixes a bug in setup-profiles where on snap upgrade, the
security would be still set up with the older revision of the snap.

This was caused by DisconnectSnap returning the list of snaps
(represented as snap.Info's) that are affected by the disconnect
operation. Those infos were subsequently used to setup the security of
each snap. This didn't work because snap.Info encodes the Revision which
changes on each upgrade.

Note that this bug is not a security vulnerability as apparmor uses the
revision in the actual profile so applications from both revisions are
simply unavailable.

Fixes: https://bugs.launchpad.net/snappy/+bug/1572463
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Contributor

niemeyer commented Apr 20, 2016

The underlying issue here felt strange when this logic was first introduced, and seeing this bug so early on seems to show that it is indeed quite dangerous logic. We're storing out-of-date information inside the repository, and then trusting it to be right at arbitrary points in time, despite everything else the system is doing.

As such, let's please fix this logic more aggressively: let's stop returning side infos from DisconnectSnap, and return their names instead. This will prevent that data from being misused.

Also, please never trust the plug/slot.Info field inside the repository as being up-to-date. I don't think we're doing that today, and let's be careful not to introduce new logic that does that.

@niemeyer niemeyer added the Reviewed label Apr 20, 2016

zyga added some commits Apr 25, 2016

overlord/snapstate: add Current
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces: return sorted list of snap names from DisconnectSnap
This patch begins to remove exposure of snap.Info's stored in
the repository. In order to avoid bugs where stale info is returned
the APIs will now encourage the caller to look up the info from the state
directly, returning snap names instead.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
overlord/ifacestate: adapt to DisconnectSnap API changes
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
}
+ sort.Strings(result)
@pedronis

pedronis Apr 25, 2016

Contributor

do we need the sorting? is it used by tests?

@zyga

zyga Apr 25, 2016

Contributor

Yes, otherwise the order of Setup() calls is not deterministic and one of the tests catches that.

@@ -300,6 +300,23 @@ func Info(s *state.State, name string, revision int) (*snap.Info, error) {
return nil, fmt.Errorf("cannot find snap %q at revision %d", name, revision)
}
+// Current returns the information about the current revision of a snap with the given name.
+func Current(s *state.State, name string) (*snap.Info, error) {
@pedronis

pedronis Apr 25, 2016

Contributor

this can be simplified a bit:

if err != nil && err != state.ErrNoState {
return nil, err
}
if snapst.Current() == nil {
return nil, fmt.Errorf("cannot find snap %q", name)
}
...

@zyga

zyga Apr 25, 2016

Contributor

I did something similar. Let me know if that's okay now.

+ if err != nil {
+ return err
+ }
+ snap.AddImplicitSlots(snapInfo)
@pedronis

pedronis Apr 25, 2016

Contributor

this looks strange? if it's always needed shouldn't something in snap do this instead when we make Infos? otherwise shouldn't there be an helper in ifacestate that gets the slots from an info and fills in the implicit ones then?

@zyga

zyga Apr 25, 2016

Contributor

This is still a temporary hack as we should not need this (we should publish this data in the OS snap normally). The helper itself would be weird as AddImplicitSlots is the helper, we access the info objects in various ways each time.

I'd much rather remove this function entirely with the next wave of OS snap updates

@zyga

zyga Apr 25, 2016

Contributor

Or, for a more realistic approach, I'd like to keep this as-is and have a separate branch that ensures we just call AddImplicitSlots in one place in snapstate.

@pedronis pedronis removed the Reviewed label Apr 25, 2016

overlord/snapstate: shorten implementation of Current
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Member

chipaca commented Apr 25, 2016

yeap, 👍

Contributor

pedronis commented Apr 25, 2016

as mentioned some of the integration test failures seem to point to real issues

overlord/ifacestate: handle the main snap explicitly
This patch changes setup-profiles to work with the main snap (the one
for which setup-profiles was called) explicitly. This way it doesn't
use snapstate.Current() which is not available for the candidate snap
being installed.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
Contributor

zyga commented Apr 25, 2016

@pedronis fixed

@zyga zyga merged commit cf12c9b into snapcore:master Apr 26, 2016

4 checks passed

Integration tests Success
Details
autopkgtest Success
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
coverage/coveralls Coverage decreased (-0.03%) to 79.162%
Details

@zyga zyga deleted the zyga:fix-lp1572463 branch Dec 12, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment