This patch makes snap-confine also setgid root (after being setuid-root
since forever). This is required to manipulate cgroups inside LXD
containers.

To limit the scope of the change, snap-confine hides the setgid aspect
for most of the code and only restores it for the cgroup manipulation.

Forum: https://forum.snapcraft.io/t/snapcraft-adt-failures-with-the-new-core-release/2850
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Thanks to jdstrand for the quick patch.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

This patch adds a function similar to secureMkdirAll that instead of
creating a number of directories instead creates a number of directories
and a final leaf file.

The purpose of this function is to create empty files as bind mount
targets for files present in a read-only location that needs to become
writable.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

The /etc/shadow file is owned by user root across all supported distributions.
However, the group owning that file is either 'shadow' or 'root' (Arch). Drop
the group filter to avoid the need for detecting the right group at runtime.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…* seccomp rule

The make sure there is a rule to ignore group ID.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…on for seccomp rules

Some distributions may not use the 'shadow' group. In such case, seccomp rules
will be incorrect, thus account-control interface may not work as expected.
Instead of assuming a particular group, obtain this information by directly
finding the owning group of /etc/shadow.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Be more specific about required chown() call on /etc/shadow.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Use proper base when formatting group ID for seccomp template

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…Plug()

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

… run

In order to avoid stat()ing /etc/shadow too frequently, cache the snippet on
first successful run.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

…pet is cached

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Reformat the call to registerIface() in hope for smaller deltas when applying
auto-refactoring in the future.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

This patch adds a small helper that is used by SecureMk{File,Dir}All to
ensure there's consistent behavior on unclean paths.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Signed-off-by: Alberto Donato <alberto.donato@gmail.com>

Signed-off-by: Alberto Donato <alberto.donato@gmail.com>

Signed-off-by: Alberto Donato <alberto.donato@gmail.com>

This allows to create snap-{declaration,revision} assertions signed
with the TestStore keys. This allows us to put arbitrary snaps
into the fakestore for testing.

As suggested by Chipaca

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

This patch changes the Repository.AddSnap method to skip unknown
interfaces when adding constituent plugs and slots. This regression
happened because the repository no longer validates the snap, assuming
the loader did. The loader did notice but did not remove the offending
interfaces.

As it is unclear what should happen, this patch implements a minimal
solution to prevent snapd from crashing on nil interface.

Fixes: https://bugs.launchpad.net/snappy/+bug/1732555
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

Add a "refresh-schedule" attribute to the snapd-control interface
that can be set to "managed".

Signed-off-by: Alberto Donato <alberto.donato@gmail.com>

For the upcoming snapd control managed code we will need a way
to tell the store that we want the refresh information but that
the actual refresh policy is managed. In preparation for this
add a new "RefreshFlags" to allow expressing this.

Initially we support one flag:
- RefreshManaged which indicates that refreshes are managed by
  a snap via the snapd-control interface

Signed-off-by: Alberto Donato <alberto.donato@gmail.com>

This makes go vet happy again.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>

We run udevadm in our udev backend. So we need to ensure we have
a dependency on this binary via the "udev" package.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

We just need to create a file, not write to it, so it's sufficient to
O_RDONLY the open call. Thanks to jdstrand for explanation!

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>