github.com/chipaca/snappy@v0.0.0-20210104084008-1f06296fe8ad/interfaces/builtin/x11_test.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2018 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin_test 21 22 import ( 23 . "gopkg.in/check.v1" 24 25 "github.com/snapcore/snapd/interfaces" 26 "github.com/snapcore/snapd/interfaces/apparmor" 27 "github.com/snapcore/snapd/interfaces/builtin" 28 "github.com/snapcore/snapd/interfaces/mount" 29 "github.com/snapcore/snapd/interfaces/seccomp" 30 "github.com/snapcore/snapd/interfaces/udev" 31 "github.com/snapcore/snapd/osutil" 32 "github.com/snapcore/snapd/release" 33 "github.com/snapcore/snapd/snap" 34 "github.com/snapcore/snapd/testutil" 35 ) 36 37 type X11InterfaceSuite struct { 38 iface interfaces.Interface 39 coreSlotInfo *snap.SlotInfo 40 coreSlot *interfaces.ConnectedSlot 41 corePlugInfo *snap.PlugInfo 42 corePlug *interfaces.ConnectedPlug 43 classicSlotInfo *snap.SlotInfo 44 classicSlot *interfaces.ConnectedSlot 45 plugInfo *snap.PlugInfo 46 plug *interfaces.ConnectedPlug 47 } 48 49 var _ = Suite(&X11InterfaceSuite{ 50 iface: builtin.MustInterface("x11"), 51 }) 52 53 const x11MockPlugSnapInfoYaml = `name: consumer 54 version: 0 55 apps: 56 app: 57 plugs: [x11] 58 ` 59 60 // an x11 slot on an x11 snap (as installed on a core/all-snap system) 61 const x11CoreYaml = `name: x11 62 version: 0 63 apps: 64 app: 65 slots: [x11-provider] 66 plugs: [x11-consumer] 67 plugs: 68 x11-consumer: 69 interface: x11 70 slots: 71 x11-provider: 72 interface: x11 73 ` 74 75 // an x11 slot on the core snap (as automatically added on classic) 76 const x11ClassicYaml = `name: core 77 version: 0 78 type: os 79 slots: 80 x11: 81 interface: x11 82 ` 83 84 func (s *X11InterfaceSuite) SetUpTest(c *C) { 85 s.plug, s.plugInfo = MockConnectedPlug(c, x11MockPlugSnapInfoYaml, nil, "x11") 86 s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, x11CoreYaml, nil, "x11-provider") 87 s.corePlug, s.corePlugInfo = MockConnectedPlug(c, x11CoreYaml, nil, "x11-consumer") 88 s.classicSlot, s.classicSlotInfo = MockConnectedSlot(c, x11ClassicYaml, nil, "x11") 89 } 90 91 func (s *X11InterfaceSuite) TestName(c *C) { 92 c.Assert(s.iface.Name(), Equals, "x11") 93 } 94 95 func (s *X11InterfaceSuite) TestSanitizeSlot(c *C) { 96 c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil) 97 c.Assert(interfaces.BeforePrepareSlot(s.iface, s.classicSlotInfo), IsNil) 98 } 99 100 func (s *X11InterfaceSuite) TestSanitizePlug(c *C) { 101 c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil) 102 } 103 104 func (s *X11InterfaceSuite) TestMountSpec(c *C) { 105 // case A: x11 slot is provided by the system 106 spec := &mount.Specification{} 107 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil) 108 c.Assert(spec.MountEntries(), DeepEquals, []osutil.MountEntry{{ 109 Name: "/var/lib/snapd/hostfs/tmp/.X11-unix", 110 Dir: "/tmp/.X11-unix", 111 Options: []string{"bind", "ro"}, 112 }}) 113 c.Assert(spec.UserMountEntries(), HasLen, 0) 114 115 // case B: x11 slot is provided by another snap on the system 116 spec = &mount.Specification{} 117 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil) 118 c.Assert(spec.MountEntries(), DeepEquals, []osutil.MountEntry{{ 119 Name: "/var/lib/snapd/hostfs/tmp/snap.x11/tmp/.X11-unix", 120 Dir: "/tmp/.X11-unix", 121 Options: []string{"bind", "ro"}, 122 }}) 123 c.Assert(spec.UserMountEntries(), HasLen, 0) 124 125 // case C: x11 slot is both provided and consumed by a snap on the system. 126 spec = &mount.Specification{} 127 c.Assert(spec.AddConnectedPlug(s.iface, s.corePlug, s.coreSlot), IsNil) 128 c.Assert(spec.MountEntries(), HasLen, 0) 129 c.Assert(spec.UserMountEntries(), HasLen, 0) 130 } 131 132 func (s *X11InterfaceSuite) TestAppArmorSpec(c *C) { 133 // case A: x11 slot is provided by the classic system 134 restore := release.MockOnClassic(true) 135 defer restore() 136 137 // Plug side connection permissions 138 spec := &apparmor.Specification{} 139 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil) 140 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 141 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "fontconfig") 142 c.Assert(spec.UpdateNS(), HasLen, 1) 143 c.Assert(spec.UpdateNS()[0], testutil.Contains, `mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/.X11-unix/ -> /tmp/.X11-unix/,`) 144 145 // case B: x11 slot is provided by another snap on the system 146 restore = release.MockOnClassic(false) 147 defer restore() 148 149 // Plug side connection permissions 150 spec = &apparmor.Specification{} 151 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil) 152 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 153 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "fontconfig") 154 c.Assert(spec.UpdateNS(), HasLen, 1) 155 c.Assert(spec.UpdateNS()[0], testutil.Contains, `mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/snap.x11/tmp/.X11-unix/ -> /tmp/.X11-unix/,`) 156 157 // Slot side connection permissions 158 spec = &apparmor.Specification{} 159 c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.coreSlot), IsNil) 160 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"}) 161 c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, `peer=(label="snap.consumer.app"),`) 162 c.Assert(spec.UpdateNS(), HasLen, 0) 163 164 // Slot side permantent permissions 165 spec = &apparmor.Specification{} 166 c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil) 167 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"}) 168 c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, "capability sys_tty_config,") 169 c.Assert(spec.UpdateNS(), HasLen, 0) 170 171 // case C: x11 slot is both provided and consumed by a snap on the system. 172 spec = &apparmor.Specification{} 173 c.Assert(spec.AddConnectedPlug(s.iface, s.corePlug, s.coreSlot), IsNil) 174 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"}) 175 c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, "fontconfig") 176 // Self-connection does not need bind mounts, so no additional permissions are provided to snap-update-ns. 177 c.Assert(spec.UpdateNS(), HasLen, 0) 178 } 179 180 func (s *X11InterfaceSuite) TestAppArmorSpecOnClassic(c *C) { 181 // on a classic system with x11 slot coming from the core snap. 182 restore := release.MockOnClassic(true) 183 defer restore() 184 185 // connected plug to classic slot 186 spec := &apparmor.Specification{} 187 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil) 188 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 189 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "owner /run/user/[0-9]*/.Xauthority r,") 190 191 // connected classic slot to plug 192 spec = &apparmor.Specification{} 193 c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.classicSlot), IsNil) 194 c.Assert(spec.SecurityTags(), HasLen, 0) 195 196 // permanent classic slot 197 spec = &apparmor.Specification{} 198 c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil) 199 c.Assert(spec.SecurityTags(), HasLen, 0) 200 } 201 202 func (s *X11InterfaceSuite) TestSecCompOnClassic(c *C) { 203 // on a classic system with x11 slot coming from the core snap. 204 restore := release.MockOnClassic(true) 205 defer restore() 206 207 seccompSpec := &seccomp.Specification{} 208 err := seccompSpec.AddPermanentSlot(s.iface, s.classicSlotInfo) 209 c.Assert(err, IsNil) 210 err = seccompSpec.AddConnectedPlug(s.iface, s.plug, s.classicSlot) 211 c.Assert(err, IsNil) 212 213 // app snap has additional seccomp rules 214 c.Assert(seccompSpec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 215 c.Assert(seccompSpec.SnippetForTag("snap.consumer.app"), testutil.Contains, "bind\n") 216 } 217 218 func (s *X11InterfaceSuite) TestSecCompOnCore(c *C) { 219 // on a core system with x11 slot coming from a snap. 220 restore := release.MockOnClassic(false) 221 defer restore() 222 223 seccompSpec := &seccomp.Specification{} 224 err := seccompSpec.AddPermanentSlot(s.iface, s.coreSlotInfo) 225 c.Assert(err, IsNil) 226 err = seccompSpec.AddConnectedPlug(s.iface, s.plug, s.coreSlot) 227 c.Assert(err, IsNil) 228 229 // both app and x11 have secomp rules set 230 c.Assert(seccompSpec.SecurityTags(), DeepEquals, []string{"snap.consumer.app", "snap.x11.app"}) 231 c.Assert(seccompSpec.SnippetForTag("snap.x11.app"), testutil.Contains, "listen\n") 232 c.Assert(seccompSpec.SnippetForTag("snap.consumer.app"), testutil.Contains, "bind\n") 233 } 234 235 func (s *X11InterfaceSuite) TestUDev(c *C) { 236 // on a core system with x11 slot coming from a regular app snap. 237 restore := release.MockOnClassic(false) 238 defer restore() 239 240 spec := &udev.Specification{} 241 c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil) 242 c.Assert(spec.Snippets(), HasLen, 6) 243 c.Assert(spec.Snippets(), testutil.Contains, `# x11 244 KERNEL=="event[0-9]*", TAG+="snap_x11_app"`) 245 c.Assert(spec.Snippets(), testutil.Contains, `# x11 246 KERNEL=="mice", TAG+="snap_x11_app"`) 247 c.Assert(spec.Snippets(), testutil.Contains, `# x11 248 KERNEL=="mouse[0-9]*", TAG+="snap_x11_app"`) 249 c.Assert(spec.Snippets(), testutil.Contains, `# x11 250 KERNEL=="ts[0-9]*", TAG+="snap_x11_app"`) 251 c.Assert(spec.Snippets(), testutil.Contains, `# x11 252 KERNEL=="tty[0-9]*", TAG+="snap_x11_app"`) 253 c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_x11_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_x11_app $devpath $major:$minor"`) 254 c.Assert(spec.TriggeredSubsystems(), DeepEquals, []string{"input"}) 255 256 // on a classic system with x11 slot coming from the core snap. 257 restore = release.MockOnClassic(true) 258 defer restore() 259 260 spec = &udev.Specification{} 261 c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil) 262 c.Assert(spec.Snippets(), HasLen, 0) 263 c.Assert(spec.TriggeredSubsystems(), IsNil) 264 } 265 266 func (s *X11InterfaceSuite) TestStaticInfo(c *C) { 267 si := interfaces.StaticInfoOf(s.iface) 268 c.Assert(si.ImplicitOnCore, Equals, false) 269 c.Assert(si.ImplicitOnClassic, Equals, true) 270 c.Assert(si.Summary, Equals, `allows interacting with or running as an X11 server`) 271 c.Assert(si.BaseDeclarationSlots, testutil.Contains, "x11") 272 } 273 274 func (s *X11InterfaceSuite) TestAutoConnect(c *C) { 275 c.Assert(s.iface.AutoConnect(s.plugInfo, s.coreSlotInfo), Equals, true) 276 c.Assert(s.iface.AutoConnect(s.plugInfo, s.classicSlotInfo), Equals, true) 277 } 278 279 func (s *X11InterfaceSuite) TestInterfaces(c *C) { 280 c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface) 281 }