github.com/chipaca/snappy@v0.0.0-20210104084008-1f06296fe8ad/interfaces/builtin/x11_test.go (about)

     1  // -*- Mode: Go; indent-tabs-mode: t -*-
     2  
     3  /*
     4   * Copyright (C) 2016-2018 Canonical Ltd
     5   *
     6   * This program is free software: you can redistribute it and/or modify
     7   * it under the terms of the GNU General Public License version 3 as
     8   * published by the Free Software Foundation.
     9   *
    10   * This program is distributed in the hope that it will be useful,
    11   * but WITHOUT ANY WARRANTY; without even the implied warranty of
    12   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    13   * GNU General Public License for more details.
    14   *
    15   * You should have received a copy of the GNU General Public License
    16   * along with this program.  If not, see <http://www.gnu.org/licenses/>.
    17   *
    18   */
    19  
    20  package builtin_test
    21  
    22  import (
    23  	. "gopkg.in/check.v1"
    24  
    25  	"github.com/snapcore/snapd/interfaces"
    26  	"github.com/snapcore/snapd/interfaces/apparmor"
    27  	"github.com/snapcore/snapd/interfaces/builtin"
    28  	"github.com/snapcore/snapd/interfaces/mount"
    29  	"github.com/snapcore/snapd/interfaces/seccomp"
    30  	"github.com/snapcore/snapd/interfaces/udev"
    31  	"github.com/snapcore/snapd/osutil"
    32  	"github.com/snapcore/snapd/release"
    33  	"github.com/snapcore/snapd/snap"
    34  	"github.com/snapcore/snapd/testutil"
    35  )
    36  
    37  type X11InterfaceSuite struct {
    38  	iface           interfaces.Interface
    39  	coreSlotInfo    *snap.SlotInfo
    40  	coreSlot        *interfaces.ConnectedSlot
    41  	corePlugInfo    *snap.PlugInfo
    42  	corePlug        *interfaces.ConnectedPlug
    43  	classicSlotInfo *snap.SlotInfo
    44  	classicSlot     *interfaces.ConnectedSlot
    45  	plugInfo        *snap.PlugInfo
    46  	plug            *interfaces.ConnectedPlug
    47  }
    48  
    49  var _ = Suite(&X11InterfaceSuite{
    50  	iface: builtin.MustInterface("x11"),
    51  })
    52  
    53  const x11MockPlugSnapInfoYaml = `name: consumer
    54  version: 0
    55  apps:
    56   app:
    57    plugs: [x11]
    58  `
    59  
    60  // an x11 slot on an x11 snap (as installed on a core/all-snap system)
    61  const x11CoreYaml = `name: x11
    62  version: 0
    63  apps:
    64   app:
    65    slots: [x11-provider]
    66    plugs: [x11-consumer]
    67  plugs:
    68    x11-consumer:
    69      interface: x11
    70  slots:
    71    x11-provider:
    72      interface: x11
    73  `
    74  
    75  // an x11 slot on the core snap (as automatically added on classic)
    76  const x11ClassicYaml = `name: core
    77  version: 0
    78  type: os
    79  slots:
    80   x11:
    81    interface: x11
    82  `
    83  
    84  func (s *X11InterfaceSuite) SetUpTest(c *C) {
    85  	s.plug, s.plugInfo = MockConnectedPlug(c, x11MockPlugSnapInfoYaml, nil, "x11")
    86  	s.coreSlot, s.coreSlotInfo = MockConnectedSlot(c, x11CoreYaml, nil, "x11-provider")
    87  	s.corePlug, s.corePlugInfo = MockConnectedPlug(c, x11CoreYaml, nil, "x11-consumer")
    88  	s.classicSlot, s.classicSlotInfo = MockConnectedSlot(c, x11ClassicYaml, nil, "x11")
    89  }
    90  
    91  func (s *X11InterfaceSuite) TestName(c *C) {
    92  	c.Assert(s.iface.Name(), Equals, "x11")
    93  }
    94  
    95  func (s *X11InterfaceSuite) TestSanitizeSlot(c *C) {
    96  	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.coreSlotInfo), IsNil)
    97  	c.Assert(interfaces.BeforePrepareSlot(s.iface, s.classicSlotInfo), IsNil)
    98  }
    99  
   100  func (s *X11InterfaceSuite) TestSanitizePlug(c *C) {
   101  	c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil)
   102  }
   103  
   104  func (s *X11InterfaceSuite) TestMountSpec(c *C) {
   105  	// case A: x11 slot is provided by the system
   106  	spec := &mount.Specification{}
   107  	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil)
   108  	c.Assert(spec.MountEntries(), DeepEquals, []osutil.MountEntry{{
   109  		Name:    "/var/lib/snapd/hostfs/tmp/.X11-unix",
   110  		Dir:     "/tmp/.X11-unix",
   111  		Options: []string{"bind", "ro"},
   112  	}})
   113  	c.Assert(spec.UserMountEntries(), HasLen, 0)
   114  
   115  	// case B: x11 slot is provided by another snap on the system
   116  	spec = &mount.Specification{}
   117  	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
   118  	c.Assert(spec.MountEntries(), DeepEquals, []osutil.MountEntry{{
   119  		Name:    "/var/lib/snapd/hostfs/tmp/snap.x11/tmp/.X11-unix",
   120  		Dir:     "/tmp/.X11-unix",
   121  		Options: []string{"bind", "ro"},
   122  	}})
   123  	c.Assert(spec.UserMountEntries(), HasLen, 0)
   124  
   125  	// case C: x11 slot is both provided and consumed by a snap on the system.
   126  	spec = &mount.Specification{}
   127  	c.Assert(spec.AddConnectedPlug(s.iface, s.corePlug, s.coreSlot), IsNil)
   128  	c.Assert(spec.MountEntries(), HasLen, 0)
   129  	c.Assert(spec.UserMountEntries(), HasLen, 0)
   130  }
   131  
   132  func (s *X11InterfaceSuite) TestAppArmorSpec(c *C) {
   133  	// case A: x11 slot is provided by the classic system
   134  	restore := release.MockOnClassic(true)
   135  	defer restore()
   136  
   137  	// Plug side connection permissions
   138  	spec := &apparmor.Specification{}
   139  	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil)
   140  	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
   141  	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "fontconfig")
   142  	c.Assert(spec.UpdateNS(), HasLen, 1)
   143  	c.Assert(spec.UpdateNS()[0], testutil.Contains, `mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/.X11-unix/ -> /tmp/.X11-unix/,`)
   144  
   145  	// case B: x11 slot is provided by another snap on the system
   146  	restore = release.MockOnClassic(false)
   147  	defer restore()
   148  
   149  	// Plug side connection permissions
   150  	spec = &apparmor.Specification{}
   151  	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.coreSlot), IsNil)
   152  	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
   153  	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "fontconfig")
   154  	c.Assert(spec.UpdateNS(), HasLen, 1)
   155  	c.Assert(spec.UpdateNS()[0], testutil.Contains, `mount options=(rw, bind) /var/lib/snapd/hostfs/tmp/snap.x11/tmp/.X11-unix/ -> /tmp/.X11-unix/,`)
   156  
   157  	// Slot side connection permissions
   158  	spec = &apparmor.Specification{}
   159  	c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.coreSlot), IsNil)
   160  	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"})
   161  	c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, `peer=(label="snap.consumer.app"),`)
   162  	c.Assert(spec.UpdateNS(), HasLen, 0)
   163  
   164  	// Slot side permantent permissions
   165  	spec = &apparmor.Specification{}
   166  	c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil)
   167  	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"})
   168  	c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, "capability sys_tty_config,")
   169  	c.Assert(spec.UpdateNS(), HasLen, 0)
   170  
   171  	// case C: x11 slot is both provided and consumed by a snap on the system.
   172  	spec = &apparmor.Specification{}
   173  	c.Assert(spec.AddConnectedPlug(s.iface, s.corePlug, s.coreSlot), IsNil)
   174  	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.x11.app"})
   175  	c.Assert(spec.SnippetForTag("snap.x11.app"), testutil.Contains, "fontconfig")
   176  	// Self-connection does not need bind mounts, so no additional permissions are provided to snap-update-ns.
   177  	c.Assert(spec.UpdateNS(), HasLen, 0)
   178  }
   179  
   180  func (s *X11InterfaceSuite) TestAppArmorSpecOnClassic(c *C) {
   181  	// on a classic system with x11 slot coming from the core snap.
   182  	restore := release.MockOnClassic(true)
   183  	defer restore()
   184  
   185  	// connected plug to classic slot
   186  	spec := &apparmor.Specification{}
   187  	c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil)
   188  	c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
   189  	c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, "owner /run/user/[0-9]*/.Xauthority r,")
   190  
   191  	// connected classic slot to plug
   192  	spec = &apparmor.Specification{}
   193  	c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.classicSlot), IsNil)
   194  	c.Assert(spec.SecurityTags(), HasLen, 0)
   195  
   196  	// permanent classic slot
   197  	spec = &apparmor.Specification{}
   198  	c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil)
   199  	c.Assert(spec.SecurityTags(), HasLen, 0)
   200  }
   201  
   202  func (s *X11InterfaceSuite) TestSecCompOnClassic(c *C) {
   203  	// on a classic system with x11 slot coming from the core snap.
   204  	restore := release.MockOnClassic(true)
   205  	defer restore()
   206  
   207  	seccompSpec := &seccomp.Specification{}
   208  	err := seccompSpec.AddPermanentSlot(s.iface, s.classicSlotInfo)
   209  	c.Assert(err, IsNil)
   210  	err = seccompSpec.AddConnectedPlug(s.iface, s.plug, s.classicSlot)
   211  	c.Assert(err, IsNil)
   212  
   213  	// app snap has additional seccomp rules
   214  	c.Assert(seccompSpec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"})
   215  	c.Assert(seccompSpec.SnippetForTag("snap.consumer.app"), testutil.Contains, "bind\n")
   216  }
   217  
   218  func (s *X11InterfaceSuite) TestSecCompOnCore(c *C) {
   219  	// on a core system with x11 slot coming from a snap.
   220  	restore := release.MockOnClassic(false)
   221  	defer restore()
   222  
   223  	seccompSpec := &seccomp.Specification{}
   224  	err := seccompSpec.AddPermanentSlot(s.iface, s.coreSlotInfo)
   225  	c.Assert(err, IsNil)
   226  	err = seccompSpec.AddConnectedPlug(s.iface, s.plug, s.coreSlot)
   227  	c.Assert(err, IsNil)
   228  
   229  	// both app and x11 have secomp rules set
   230  	c.Assert(seccompSpec.SecurityTags(), DeepEquals, []string{"snap.consumer.app", "snap.x11.app"})
   231  	c.Assert(seccompSpec.SnippetForTag("snap.x11.app"), testutil.Contains, "listen\n")
   232  	c.Assert(seccompSpec.SnippetForTag("snap.consumer.app"), testutil.Contains, "bind\n")
   233  }
   234  
   235  func (s *X11InterfaceSuite) TestUDev(c *C) {
   236  	// on a core system with x11 slot coming from a regular app snap.
   237  	restore := release.MockOnClassic(false)
   238  	defer restore()
   239  
   240  	spec := &udev.Specification{}
   241  	c.Assert(spec.AddPermanentSlot(s.iface, s.coreSlotInfo), IsNil)
   242  	c.Assert(spec.Snippets(), HasLen, 6)
   243  	c.Assert(spec.Snippets(), testutil.Contains, `# x11
   244  KERNEL=="event[0-9]*", TAG+="snap_x11_app"`)
   245  	c.Assert(spec.Snippets(), testutil.Contains, `# x11
   246  KERNEL=="mice", TAG+="snap_x11_app"`)
   247  	c.Assert(spec.Snippets(), testutil.Contains, `# x11
   248  KERNEL=="mouse[0-9]*", TAG+="snap_x11_app"`)
   249  	c.Assert(spec.Snippets(), testutil.Contains, `# x11
   250  KERNEL=="ts[0-9]*", TAG+="snap_x11_app"`)
   251  	c.Assert(spec.Snippets(), testutil.Contains, `# x11
   252  KERNEL=="tty[0-9]*", TAG+="snap_x11_app"`)
   253  	c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_x11_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_x11_app $devpath $major:$minor"`)
   254  	c.Assert(spec.TriggeredSubsystems(), DeepEquals, []string{"input"})
   255  
   256  	// on a classic system with x11 slot coming from the core snap.
   257  	restore = release.MockOnClassic(true)
   258  	defer restore()
   259  
   260  	spec = &udev.Specification{}
   261  	c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil)
   262  	c.Assert(spec.Snippets(), HasLen, 0)
   263  	c.Assert(spec.TriggeredSubsystems(), IsNil)
   264  }
   265  
   266  func (s *X11InterfaceSuite) TestStaticInfo(c *C) {
   267  	si := interfaces.StaticInfoOf(s.iface)
   268  	c.Assert(si.ImplicitOnCore, Equals, false)
   269  	c.Assert(si.ImplicitOnClassic, Equals, true)
   270  	c.Assert(si.Summary, Equals, `allows interacting with or running as an X11 server`)
   271  	c.Assert(si.BaseDeclarationSlots, testutil.Contains, "x11")
   272  }
   273  
   274  func (s *X11InterfaceSuite) TestAutoConnect(c *C) {
   275  	c.Assert(s.iface.AutoConnect(s.plugInfo, s.coreSlotInfo), Equals, true)
   276  	c.Assert(s.iface.AutoConnect(s.plugInfo, s.classicSlotInfo), Equals, true)
   277  }
   278  
   279  func (s *X11InterfaceSuite) TestInterfaces(c *C) {
   280  	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
   281  }