zyga/snapd forked from snapcore/snapd

This is a openSUSE specific patch that I think only makes sense in the
case when snap-confine is confined but snap applications are not.
Proposed to gather feedback.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

This rule is required to make snap-confine work on openSUSE tumbleweed.
The rule is presumably required by selinux as seen in the following
strace fragment:

23075 statfs("/sys/fs/selinux", 0x7ffdaa3ad9b0) = -1 ENOENT (No such file or directory)
23075 statfs("/selinux", {f_type=BTRFS_SUPER_MAGIC, f_bsize=4096, f_blocks=10486528, f_bfree=6317286, f_bavail=5992378, f_files=0, f_ffree=0, f_fsid={val=[2999193500, 2112688126]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_RELATIME}) = 0
23075 brk(NULL)                         = 0x20b4000
23075 brk(0x20d5000)                    = 0x20d5000
23075 open("/proc/filesystems", O_RDONLY) = 3

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

On openSUSE tumbleweed I need a few more rules to successfully
run snap-confine under apparmor. This includes libresolv, libpcre
and ironically libselinux.

Since snap-confine links to libcap dynamically we also need an entry for
this. All entries are duplicated for the helper hat profile.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

Depending on the distribution at hand we the conceptual "/lib" may be
at /lib or /usr/lib, the "lib" directory may be spelled
lib, lib32, lib64 or even libx32. It may be optionally followed by a
multiarch suffix. This patch applies those rules to all the shared
libraries we need to map and read.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

daemon: add polkit support to /v2/login

snapd,snapctl: decode json using Number

client: fix go vet 1.7 errors

tests: make 17.04 shellcheck clean

tests: remove TestInterfacesHelp as it breaks when go-flags changes

snapstate: undo a daemon restart on classic if needed

…ons checking signatures and brand account

This adds code to initialise snap-repair state with brand/model recovered from /var/lib/snapd/seed/assertions.

…rt-no-integration

spread: opt into unsafe IO during spread tests

…he keys

…e-info

…af-io-for-testing

snap-repair: update snap-repair/runner_test.go for API change in makeMockServer

Also this fixes the proxy settings' keys which were wrong but that was unnoticed.

…3772)

This change is to fix the tests refresh-all and refresh-all-undo by
waiting util the fake store is ready to be contacted.

Based on different tests done on PR 3768, 3770 and 3771 it is clear the
problem is because the store is not ready when snap refresh is executed
and it is causing the error seen in the autopkgtests.

This patch enables a variable now honored by our atomic file write
helpers. As referenced earlier it offers massive improvements in time
needed to perform certain tests.

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

osutil: honor SNAPD_UNSAFE_IO for testing