/snapd

interfaces/many: miscellaneous updates based on feedback from the field #4097

Merged
merged 11 commits into from Oct 30, 2017

Conversation

Reviewers

@zyga zyga

@mvo5 mvo5

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
  2.29
4 participants
@jdstrand @codecov-io @zyga @mvo5
@jdstrand
Contributor

jdstrand commented Oct 27, 2017

  • interfaces/desktop,unity7: allow read on system and session xdg user-dirs files
  • interfaces/browser-support: allow /run/udev access for cuse and vhost-vsock
  • interfaces: allow directory read on /home/ and / by default
  • interfaces/removable-media: allowing read on /run/ and /run/media/
  • interfaces/browser-support: also allowing reading /etc/chromium/{,**}
  • interfaces/browser-support: allow /proc/pid/mount{s,info} to avoid confusion
  • interfaces/home: allow reading files and dirs that start with 'snap[^/]'
  • interfaces/bluez: don't mediate 'path' to/from unconfined

jdstrand added some commits Oct 27, 2017

@jdstrand
interfaces/desktop,unity: allow read on system and session xdg user-d… 
…irs files
8a68fa2
@jdstrand
interfaces/browser-support: allow /run/udev access for cuse and vhost… 
…-vsock
492edf4
@jdstrand
interfaces: allow directory read on /home/ and / by default 
Reference:
https://forum.snapcraft.io/t/application-cant-see-media-in-file-browser/2384/9
fe37b3e
@jdstrand
interfaces/removable-media: allowing read on /run/ and /run/media/ 
Reference:
https://forum.snapcraft.io/t/application-cant-see-media-in-file-browser/2384/9
69a51e5
@jdstrand
interfaces/hardware-observe: also allow reading /lib/modprobe.d
a6130ab
@jdstrand
interfaces/browser-support: also allowing reading /etc/chromium/{,**}
d3a74fd
@jdstrand
interfaces/browser-support: allow /proc/pid/mount{s,info} to avoid co… 
…nfusion

This is an information leak but disallowing it leads to developer confusion
when using the chromium content api file chooser due to a (harmless) glib
warning and the noisy AppArmor denial. This transitional interface already
allows worse accessing than this information leak, so try to be pragmatic.
4582da6
@jdstrand
interfaces/home: allow reading files and dirs that start with 'snap[^/]' 
Previously we unintentionally blocked access to ~/snap-something. Add a rule
that allows these reads but still blocks ~/snap
0e304c0
@jdstrand
interfaces/bluez: don't mediate 'path' to/from unconfined 
For the org.bluez DBus interface we cannot specify an Object Path since
according to the bluez specification these can be anything
(https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/doc).
27db522
@jdstrand
adjust comment in bluez for accuracy
f935401
@jdstrand
remove extra newline in unity7 commit

Some checks were not successful

1 failing and 6 successful checks
@mvo5
xenial-amd64 — autopkgtest finished (failure)
Details
@mvo5
artful-amd64 — autopkgtest finished (success)
Details
@mvo5
artful-i386 — autopkgtest finished (success)
Details
continuous-integration/travis-ci/pr — The Travis CI build passed
Details
@mvo5
xenial-i386 — autopkgtest finished (success)
Details
@mvo5
xenial-ppc64el — autopkgtest finished (success)
Details
@mvo5
zesty-amd64 — autopkgtest finished (success)
Details
4befc00

@jdstrand jdstrand added this to the 2.29 milestone Oct 27, 2017

@jdstrand
Contributor

jdstrand commented Oct 27, 2017

@tonyespy - this PR has the bluez fix in 27db522.
@jdstrand
Contributor

jdstrand commented Oct 27, 2017

@mvo5 - please consider this for 2.29.
@codecov-io

codecov-io commented Oct 27, 2017 •
Edited 1 time

Codecov Report

Merging #4097 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #4097   +/-   ##
=======================================
  Coverage   75.75%   75.75%           
=======================================
  Files         435      435           
  Lines       37442    37442           
=======================================
  Hits        28366    28366           
  Misses       7094     7094           
  Partials     1982     1982
Impacted Files Coverage Δ
interfaces/builtin/home.go 100% <ø> (ø) ⬆️
interfaces/builtin/bluez.go 100% <ø> (ø) ⬆️
interfaces/builtin/desktop.go 86.84% <ø> (ø) ⬆️
interfaces/builtin/unity7.go 67.85% <ø> (ø) ⬆️
interfaces/builtin/removable_media.go 100% <ø> (ø) ⬆️
interfaces/builtin/browser_support.go 76.31% <ø> (ø) ⬆️
interfaces/builtin/hardware_observe.go 100% <ø> (ø) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0190c29...4befc00. Read the comment docs.
@mvo5

mvo5 approved these changes Oct 27, 2017
View changes

@zyga

zyga approved these changes Oct 30, 2017
View changes

LGTM :-)

interfaces/builtin/browser_support.go
@@ -127,6 +134,7 @@ owner @{PROC}/@{pid}/fd/[0-9]* w,
/run/udev/data/c89:[0-9]* r, # /dev/i2c-*
/run/udev/data/c81:[0-9]* r, # video4linux (/dev/video*, etc)
/run/udev/data/c202:[0-9]* r, # /dev/cpu/*/msr
+/run/udev/data/c203:[0-9]* r, # /dev/cuse
@zyga

zyga Oct 30, 2017

Contributor

For other curious reviewers: character device in userspace.

interfaces/builtin/home.go
@@ -46,6 +46,7 @@ owner @{HOME}/[^s.]** rwklix,
owner @{HOME}/s[^n]** rwklix,
owner @{HOME}/sn[^a]** rwklix,
owner @{HOME}/sna[^p]** rwklix,
+owner @{HOME}/snap[^/]** rwklix,
@zyga

zyga Oct 30, 2017

Contributor

Thank you for this!

@zyga zyga merged commit 370f8c6 into snapcore:master Oct 30, 2017
6 of 7 checks passed

6 of 7 checks passed

xenial-amd64 autopkgtest finished (failure)
Details
artful-amd64 autopkgtest finished (success)
Details
artful-i386 autopkgtest finished (success)
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
xenial-i386 autopkgtest finished (success)
Details
xenial-ppc64el autopkgtest finished (success)
Details
zesty-amd64 autopkgtest finished (success)
Details

@zyga zyga referenced this pull request Oct 30, 2017

Merged

interfaces/many: miscellaneous updates based on feedback from the field (2.29) #4101

@jdstrand jdstrand deleted the jdstrand:policy-updates-xxxi branch Nov 8, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment