interfaces,overlord,testutil: implement support for interface-based security #733

Closed
wants to merge 11 commits into
from

Conversation

Projects
None yet
2 participants
Contributor

zyga commented Mar 23, 2016

This branch adds 2nd iteration of "security helpers" that know enough to enable certain type of security support (apparmor, seccomp, udev, dbus) for a given snap. Unlinke the first version they have somewhat different layout a public API (through interfaces.SecurityConfigurator) and are meant to be used from the overlord directly.

The branch has extensive tests for apparmor, basic tests for other backends and no tests for the new interface manager task (I'm mostly looking for feedback at that level and I probably will only land that after the snap manager populates some basic facts about snaps).

zyga added some commits Mar 23, 2016

testutil: add MockCmd.ForgetCalls
Ths patch adds a method that is useful for forgetting calls made so far.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces: add SecurityTag and SecurityGlob functions
This patch adds two support functions that compute the "security tag"
for a single application and a glob for all security tags in a given
snap.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
testutil: don't panic in MockCmd.Calls() if no calls were made
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces/udev: add udev configurator
This patch adds the udev configurator. Configurators encapsulate the
knowledge on how to configure a given security system. Here, each app
gets a dedicated udev rule file with rules that apply to that application.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces/dbus: add dbus configurator
This patch adds the dbus configurator. Configurators encapsulate the
knowledge on how to configure a given security system. Here, each app
with at least one dbus snippet gets a dedicated dbus configuration file
with rules that apply to that application.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces/apparmor: add apparmor configurator
This patch adds the apparmor configurator. Configurators encapsulate the
knowledge on how to configure a given security system. Here, each app
with gets a dedicated apparmor configuration file. Additional snippets
are injected into the profile by interface connection.

Developer mode is supported by switching apparmor into so-called complain
mode. There violations are logged, but don't kill the offeding process.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces/seccomp: add seccomp configurator
This patch adds the udev configurator. Configurators encapsulate the
knowledge on how to configure a given security system. Here, each app
gets a dedicated snappy-specific seccomp profile comprised of a stock
header and all the security snippets concatenated. In developer mode
only the string "@unrestricted" is placed into the profile.

The seccomp package also exposes ProfileFile() function that should be
used when calling ubuntu-core-launcher.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
overlord/interfaces: first stab at ensure security
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces: add SecurityConfigurator interface
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces: remove older security support code
This patch removes the earlier seccomp/apparmor support code.
This code is entirely replaced by the new set of packages and the
security configurator packages.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
interfaces: add SecurityBackend interface
Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>
+ }
+ // Ensure that files are correctly on disk
+ changed, removed, err := osutil.EnsureDirState(dir, glob, content)
+ // Record changes so that we can do clean-up in Finalize. This has to
@pedronis

pedronis Mar 24, 2016

Contributor

All ConfigureSnapSecurity seem to start the same? first impression is that the abstraction is not the best if it ends up with that much repetition? what's the relation between Configurators and Security Systems?

+ return nil
+}
+
+// Finalize does nothing at all.
@pedronis

pedronis Mar 24, 2016

Contributor

doesn't seem to do nothing here?

@zyga

zyga Mar 24, 2016

Contributor

Ah, copy paste error. I'll correct this.

Contributor

zyga commented Mar 24, 2016

Closing for the split

@zyga zyga closed this Mar 24, 2016

@zyga zyga deleted the zyga:security-cfs branch Dec 12, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment