Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
tests: add snap-confine privilege test #3428
Conversation
Some checks were not successful
jdstrand
approved these changes
Jun 2, 2017
•
Thanks for this test! I have some small comments but marking this as approved since the tests themselves are fine.
| +details: | | ||
| + The openSUSE security team has made a remark about a particular part of | ||
| + snap-confine's UID/GID handling. The code there was, we believe, correct | ||
| + but this test is here to demonstrate that and ensure it never regresses. |
jdstrand
Jun 2, 2017
Contributor
The tests prove snap-confine has the desired behavior so we don't have to say 'we believe' here.
| + Security review https://bugzilla.opensuse.org/show_bug.cgi?id=986050 | ||
| +# This test is not executed on a core system simply because of the hassle of | ||
| +# building the support C program. In the future it might be improved with the | ||
| +# use of the classic snap where we just use classic to build the helper. |
jdstrand
Jun 2, 2017
Contributor
Note, core has python3 and python3 has os.getresuid(). I think it is fine to test on just classic, but if you really want it everywhere, keep that in mind. Also, I think this test is valid on other distros where snap-confine is setuid. On those with fscaps, we'd of course need different tests.
zyga
Jun 2, 2017
Contributor
But python scripts cannot be setuid/setgid as they use an interpreter (bummer).
As for fscaps, that code is not used anymore and I actually removed it in one of my patches today (still pending PR)
jdstrand
Jun 2, 2017
•
Edited 1 time
-
jdstrand
Jun 2, 2017
Contributor
-
Jun 2, 2017
re interpreted-- oh, right, duh.
All checks have passed
codecov-io
commented
Jun 2, 2017
•
Edited 1 time
-
codecov-io
Jun 5, 2017
-
Jun 5, 2017
Codecov Report
@@ Coverage Diff @@
## master #3428 +/- ##
=======================================
Coverage 77.56% 77.56%
=======================================
Files 371 371
Lines 25519 25519
=======================================
Hits 19794 19794
Misses 3975 3975
Partials 1750 1750
Continue to review full report at Codecov.
|
Some checks were not successful
| @@ -0,0 +1,24 @@ | ||
| +#define _GNU_SOURCE |
zyga commentedJun 2, 2017
•
Edited 1 time
-
pedronis
Jun 2, 2017
This test ensures that snap confine correctly drops privileges (user and
group identifiers) in various scenarios involving sudo and regular users.
Signed-off-by: Zygmunt Krynicki zygmunt.krynicki@canonical.com