Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/snap-update-ns: refactor of profile application #6360

Closed
wants to merge 3 commits into from
Closed

cmd/snap-update-ns: refactor of profile application #6360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dd0ef1e
cmd/snap-update-ns: refactor of profile application
zyga Jan 11, 2019
6df8420
cmd/snap-update-ns: fix copy-paste comments
zyga Jan 11, 2019
1f1277f
Merge branch 'master' into feature/user-mount-ns-20.9
zyga May 24, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 10 additions & 3 deletions cmd/snap-update-ns/user.go
View file
Open in desktop
Expand Up @@ -65,9 +65,16 @@ func (upCtx *UserProfileUpdateContext) Assumptions() *Assumptions {
// TODO: configure the secure helper and inform it about directories that
// can be created without trespassing.
as := &Assumptions{}
// TODO: Handle /home/*/snap/* when we do per-user mount namespaces and
// allow defining layout items that refer to SNAP_USER_DATA and
// SNAP_USER_COMMON.
// TODO: When SNAP_USER_DATA and SNAP_USER_COMMON can be used from per-user
// mount profiles then we need to handle /home/*/snap/*
//
// Right now this is not done because we must securely figure out what the
// $HOME directory is and this must be preemptively allowed by apparmor
// profile for snap-update-ns (that is per snap but not per user). In
// effect this feels like we must grant /home/*/snap/$SNAP_NAME/ anyway.
// Note that currently using wild-cards in the Assumptions type is not
// supported.
as.AddUnrestrictedPaths("/tmp", xdgRuntimeDir(upCtx.uid))
Copy link

@jdstrand jdstrand Jun 28, 2019 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why aren't you using UID(), which will return upCtx.uid?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The UID helper came later AFAIR. Initially when I wrote it it was private.

return as
}

Expand Down
2 changes: 1 addition & 1 deletion cmd/snap-update-ns/user_test.go
View file
Open in desktop
Expand Up @@ -54,7 +54,7 @@ func (s *userSuite) TestLock(c *C) {
func (s *userSuite) TestAssumptions(c *C) {
upCtx := update.NewUserProfileUpdateContext("foo", false, 1234)
as := upCtx.Assumptions()
c.Check(as.UnrestrictedPaths(), IsNil)
c.Check(as.UnrestrictedPaths(), DeepEquals, []string{"/tmp", "/run/user/1234"})
}

func (s *userSuite) TestLoadDesiredProfile(c *C) {
Expand Down