interfaces/apparmor: allow access to core snap

[zyga]

This patch changes the default apparmor template to allow read access to
the core snap (at any revision). This is required to allow classic snaps
that use the dynamic linker or libraries when they were forcibly
confined with jailmode.

Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com

[jdstrand]

Based on conversations with @zyga, jailmode with --classic has been defined as strict mode plus read-only access to all of the core snap. As such, please:

• document the confinement story somewhere
• remove this rule from the default template and add it conditionally as a snippet 'if isClassic and isJailmode'

This makes the intent of the default template clear that it is (still) a subset of core and makes policy audits clearer.

[zyga]

Thanks for the review @jdstrand. I'll document the whole confinement story on the wiki. As for the extra core rule, I can do that via a fake snippet. I'll ping you for a second look.

[jdstrand]

Thanks! I think it will also help us future-proof a bit-- I have a suspicion that we'll want to add another rule or two for classic that may not be appropriate for regular strict mode and this will facilitate that.

[niemeyer]

Per our discussion in the channel, LGTM as long as this is opened up only if --jailmode is actually used. We currently don't allow normal snaps to read all of core in its usual mount point, so it wouldn't make a lot of sense to allow them to read it only in an alternative path in general (either it's okay to read, or it's not).

[niemeyer]

Sorry, to be clear, --jailmode and --classic, not just --jailmode.

[niemeyer]

I think it'd make more sense to have this before the custom snippets.

[jdstrand]

LGTM with added comment from feedback

[jdstrand]

Thank you for this addition. @niemeyer was right to point out that we only want to give read access to the core snap when using --classic with --jailmode (thanks for that!). With strict, we don't want this rule. With just --classic, we don't need this rule. With --devmode plus --jailmode, we don't want this rule. Only with --classic plus --jailmode do we need it.

LGTM but please add this comment above 'if opts.Classic && opts.JailMode {':

# Only add the classicJailmodeSnippet when using --classic plus --jailmode. Why?
# - normal strict mode shouldn't have it since we don't want to subvert the default
#   template
# - --devmode with or without --jailmode shouldn't have it since it wouldn't
#   accurately represent complain-mode strict
# - --classic without --jailmode doesn't need it since it uses different (non-strict)
#   policy
# - --classic with --jailmode is defined as strict policy plus read-only access to the
#   core snap