cmd/snap-confine,tests: bind-mount /etc/os-release

cmd/snap-confine/mount-support.c

@@ -404,6 +404,64 @@ static void sc_bootstrap_mount_namespace(const struct sc_mount_config *config)
 			    dst);
 		}
 	}
+	// Since we mounted /etc from the host filesystem the /etc/os-release file
+	// (which may not be present) may be a symbolic link. It is expected that
+	// we see the real /etc/os-release file so let's do our best to show
+	// /etc/os-release as it looks like on the classic distribution.
+	//
+	// If the symbolic link in /etc is pointing to /usr/lib/os-release then
+	// bind mount /usr/lib/os-release over itself in the core snap. This way
+	// the symlink (which we cannot be the target of a bind mount as the kernel
+	// will always follow the link when performing the mount operation) will
+	// work as expected.
+	//
+	// https://bugs.launchpad.net/canonical-livepatch-client/+bug/1667470
+	if (config->on_classic) {
+		const char *etc_os_release = "/etc/os-release";
+		const char *expected_symlink = "../usr/lib/os-release";
+		const char *usr_lib_os_release = "/usr/lib/os-release";
+		char link_target[PATH_MAX];
+		// Try to read link target from /etc/os-release and special case EINVAL
+		// instead of trying to lstat it first.
+		if (readlink(etc_os_release, link_target, sizeof link_target) <
+		    0) {
+			// readlink returns EINVAL when the buffer size is negative or when
+			// the specified file is not a symbolic link. Since the buffer has
+			// a constant size and we know it's not negative we can special
+			// case EINVAL as an indicator that /etc/os-release is not a
+			// symbolic link and that we can just skip this whole section.
+			if (errno != EINVAL) {
+				die("cannot read target of symbolic link from %s", etc_os_release);
+			}
+			goto skip_etc_os_release;
+		}
+		// Check if the link points to ../usr/lib/os-release (or just
+		// /usr/lib/os-release).  If not then we're not ready for that case and
+		// we can just bail out.
+		if (strcmp(link_target, expected_symlink) != 0) {
+			goto skip_etc_os_release;
+		}
+		// Bind mount whatever /etc/os-release is effectively pointing to
+		// (effectively because we only considered the first level of symbolic
+		// links) to /usr/lib/os-release in the core snap.
+		//
+		// This way once inside the core snap we will see /etc/os-release
+		// (which is a symlink to ../usr/lib/os-release as we've checked above)
+		// pointing to a bind mount to $(realpath /etc/os-release).
+		//
+		// This is because the mount operation below will follow all the symbolic links
+		// so /etc/os-release is followed to its final destination.
+		sc_must_snprintf(dst, sizeof dst, "%s%s", scratch_dir,
+				 usr_lib_os_release);
+		debug("performing operation: mount --bind -o ro %s %s",
+		      etc_os_release, dst);
+		if (mount
+		    (etc_os_release, dst, NULL, MS_BIND | MS_RDONLY,
+		     NULL) < 0) {
+			die("cannot perform operation: mount --bind -o ro %s %s", etc_os_release, dst);
+		}
+	}
+ skip_etc_os_release:
 	// Bind mount the directory where all snaps are mounted. The location of
 	// the this directory on the host filesystem may not match the location in
 	// the desired root filesystem. In the "core" and "ubuntu-core" snaps the

cmd/snap-confine/snap-confine.apparmor.in

@@ -118,6 +118,10 @@
     mount options=(rw rbind) /etc/ -> /tmp/snap.rootfs_*/etc/,
     mount options=(rw rslave) -> /tmp/snap.rootfs_*/etc/,
 
+    # Allow bind mounting /usr/lib/os-release over itself in the core snap.
+    # See mount-support.c for a longer explanation.
+    mount options=(rw bind) /usr/lib/os-release -> /tmp/snap.rootfs_*/usr/lib/os-release,
+
     mount options=(rw rbind) /home/ -> /tmp/snap.rootfs_*/home/,
     mount options=(rw rslave) -> /tmp/snap.rootfs_*/home/,
 

tests/main/os-release/task.yaml

@@ -0,0 +1,31 @@
+summary: check that /etc/os-release is genuine
+details: |
+    Software may rely on the /etc/os-release file to identify the system where
+    a snap is running.  On a core system this is always ID=ubuntu-core but on
+    classic it is expected to be the /etc/os-release file from the host
+    distribution.
+    Since the /etc/os-release file may be a symlink (and it typically is) it
+    may point to other places, places that originate from the core snap, not
+    from the host system. In practice this happens, e.g. on xenial, where
+    /etc/os-release points to /usr/lib/os-release.
+    Since the symlink is resolved only after the chroot is set in place we
+    don't really know what it was previously pointing at. To counter this
+    snap-confine now bind mounts /etc/os-release over itself from the classic
+    distribution.
+prepare: |
+    . $TESTSLIB/snaps.sh
+    install_local test-snapd-tools
+execute: |
+    # The value on the host:
+    cat /etc/os-release > outside
+    test-snapd-tools.cmd cat /etc/os-release > inside 
+    cmp outside inside
+restore: |
+    rm -f outside inside
+debug: |
+    echo "/etc/os-release as seen on the outside of snaps"
+    cat outside
+    echo "/etc/os-release as seen on the inside of snaps"
+    cat inside
+
+