interfaces/builtin: don't hard-code slot name in connected plug apparmor

This patch replaces the hard-coded peer label (snap.bluez.*) for connected
plugs to the security tag glob for the snap that has the slot. In practice
the content should be exactly the same but now it will not be hard-coded.

Signed-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>

interfaces/builtin/bluez.go

@@ -20,6 +20,8 @@
 package builtin
 
 import (
+	"bytes"
+
 	"github.com/ubuntu-core/snappy/interfaces"
 )
 
@@ -96,8 +98,7 @@ var bluezConnectedPlugAppArmor = []byte(`
 # Allow all access to bluez service
 dbus (receive, send)
     bus=system
-    peer=(label=snap.bluez.*),
-# FIXME: adjust to use 'snap.<name>.<app>' from the connecting slot
+    peer=(label=@SLOT_SECURITY_TAG_GLOB@),
 
 dbus (send)
     bus=system
@@ -203,7 +204,10 @@ func (iface *BluezInterface) PermanentPlugSnippet(plug *interfaces.Plug, securit
 func (iface *BluezInterface) ConnectedPlugSnippet(plug *interfaces.Plug, slot *interfaces.Slot, securitySystem interfaces.SecuritySystem) ([]byte, error) {
 	switch securitySystem {
 	case interfaces.SecurityAppArmor:
-		return bluezConnectedPlugAppArmor, nil
+		old := []byte("@SLOT_SECURITY_TAG_GLOB@")
+		new := []byte(interfaces.SecurityTagGlob(slot.Snap.Name()))
+		snippet := bytes.Replace(bluezConnectedPlugAppArmor, old, new, -1)
+		return snippet, nil
 	case interfaces.SecuritySecComp:
 		return bluezConnectedPlugSecComp, nil
 	case interfaces.SecurityUDev, interfaces.SecurityDBus:

interfaces/builtin/bluez_test.go

@@ -25,6 +25,7 @@ import (
 	"github.com/ubuntu-core/snappy/interfaces"
 	"github.com/ubuntu-core/snappy/interfaces/builtin"
 	"github.com/ubuntu-core/snappy/snap"
+	"github.com/ubuntu-core/snappy/testutil"
 )
 
 type BluezInterfaceSuite struct {
@@ -55,6 +56,12 @@ func (s *BluezInterfaceSuite) TestName(c *C) {
 	c.Assert(s.iface.Name(), Equals, "bluez")
 }
 
+func (s *BluezInterfaceSuite) TestConnectedPlugSnippetUsesSlotLabel(c *C) {
+	snippet, err := s.iface.ConnectedPlugSnippet(s.plug, s.slot, interfaces.SecurityAppArmor)
+	c.Assert(err, IsNil)
+	c.Assert(string(snippet), testutil.Contains, "peer=(label=snap.bluez.*),")
+}
+
 func (s *BluezInterfaceSuite) TestUnusedSecuritySystems(c *C) {
 	systems := [...]interfaces.SecuritySystem{interfaces.SecurityAppArmor,
 		interfaces.SecuritySecComp, interfaces.SecurityDBus,