github.com/kubiko/snapd@v0.0.0-20201013125620-d4f3094d9ddf/cmd/snap-confine/spread-tests/main/mount-profiles-bin-snap-source/task.yaml (about)

     1  summary: Apparmor profile prevents bind-mounting from /snap/bin
     2  # This is blacklisted on debian because it relies on apparmor mount mediation
     3  systems: [-debian-8]
     4  prepare: |
     5      echo "Having installed the snapd-hacker-toolbelt snap"
     6      snap install snapd-hacker-toolbelt
     7      echo "We can change its mount profile externally to create bind mount /snap/bin somewhere"
     8      echo "/snap/bin -> /snap/snapd-hacker-toolbelt/mnt"
     9      mkdir -p /var/lib/snapd/mount
    10      echo "/snap/bin /snap/snapd-hacker-toolbelt/current/mnt none bind,ro 0 0" > /var/lib/snapd/mount/snap.snapd-hacker-toolbelt.busybox.fstab
    11  execute: |
    12      cd /
    13      echo "Let's clear the kernel ring buffer"
    14      dmesg -c
    15      echo "We can now run busybox true and expect it to fail"
    16      orig_ratelimit=$(sysctl -n kernel.printk_ratelimit)
    17      sysctl -w kernel.printk_ratelimit=0
    18      not /snap/bin/snapd-hacker-toolbelt.busybox true
    19      sysctl -w kernel.printk_ratelimit=$orig_ratelimit
    20      echo "Not only the command failed because snap-confine failed, we see why!"
    21      dmesg --ctime | grep 'apparmor="DENIED" operation="mount" info="failed srcname match" error=-13 profile="/usr/lib/snapd/snap-confine" name="/snap/snapd-hacker-toolbelt/[0-9]\+/mnt/" pid=[0-9]\+ comm="ubuntu-core-lau" srcname="/snap/bin/" flags="rw, bind"'
    22  restore: |
    23      snap remove --purge snapd-hacker-toolbelt
    24      rm -rf /var/snap/snapd-hacker-toolbelt
    25      rm -f /var/lib/snapd/mount/snap.snapd-hacker-toolbelt.busybox.fstab
    26      dmesg -c