github.com/kubiko/snapd@v0.0.0-20201013125620-d4f3094d9ddf/interfaces/builtin/block_devices.go (about)

     1  // -*- Mode: Go; indent-tabs-mode: t -*-
     2  
     3  /*
     4   * Copyright (C) 2019 Canonical Ltd
     5   *
     6   * This program is free software: you can redistribute it and/or modify
     7   * it under the terms of the GNU General Public License version 3 as
     8   * published by the Free Software Foundation.
     9   *
    10   * This program is distributed in the hope that it will be useful,
    11   * but WITHOUT ANY WARRANTY; without even the implied warranty of
    12   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    13   * GNU General Public License for more details.
    14   *
    15   * You should have received a copy of the GNU General Public License
    16   * along with this program.  If not, see <http://www.gnu.org/licenses/>.
    17   *
    18   */
    19  
    20  package builtin
    21  
    22  // Only allow raw disk devices; not loop, ram, CDROM, generic SCSI, network,
    23  // tape, raid, etc devices or disk partitions. For some devices, allow controller
    24  // character devices since they are used to configure the corresponding block
    25  // device.
    26  const blockDevicesSummary = `allows access to disk block devices`
    27  
    28  const blockDevicesBaseDeclarationPlugs = `
    29    block-devices:
    30      allow-installation: false
    31      deny-auto-connection: true
    32  `
    33  
    34  const blockDevicesBaseDeclarationSlots = `
    35    block-devices:
    36      allow-installation:
    37        slot-snap-type:
    38          - core
    39      deny-auto-connection: true
    40  `
    41  
    42  // https://www.kernel.org/doc/Documentation/admin-guide/devices.txt
    43  // For now, only list common devices and skip the following:
    44  // /dev/mfm{a,b} rw,                        # Acorn MFM
    45  // /dev/ad[a-p] rw,                         # ACSI
    46  // /dev/pd[a-d] rw,                         # Parallel port IDE
    47  // /dev/pf[0-3] rw,                         # Parallel port ATAPI
    48  // /dev/ub[a-z] rw,                         # USB block device
    49  const blockDevicesConnectedPlugAppArmor = `
    50  # Description: Allow write access to raw disk block devices.
    51  
    52  @{PROC}/devices r,
    53  /run/udev/data/b[0-9]*:[0-9]* r,
    54  /sys/block/ r,
    55  /sys/devices/**/block/** r,
    56  
    57  # Access to raw devices, not individual partitions
    58  /dev/hd[a-t] rw,                                          # IDE, MFM, RLL
    59  /dev/sd{,[a-h]}[a-z] rw,                                  # SCSI
    60  /dev/sdi[a-v] rw,                                         # SCSI continued
    61  /dev/i2o/hd{,[a-c]}[a-z] rw,                              # I2O hard disk
    62  /dev/i2o/hdd[a-x] rw,                                     # I2O hard disk continued
    63  /dev/mmcblk[0-9]{,[0-9],[0-9][0-9]} rw,                   # MMC (up to 1000 devices)
    64  /dev/vd[a-z] rw,                                          # virtio
    65  
    66  # Allow /dev/nvmeXnY namespace block devices. Please note this grants access to all
    67  # NVMe namespace block devices and that the numeric suffix on the character device
    68  # does not necessarily correspond to a namespace block device with the same suffix
    69  # From 'man nvme-format' : 
    70  #   Note, the numeric suffix on the character device, for example the 0 in
    71  #   /dev/nvme0, does NOT indicate this device handle is the parent controller
    72  #   of any namespaces with the same suffix. The namespace handle's numeral may
    73  #   be coming from the subsystem identifier, which is independent of the
    74  #   controller's identifier. Do not assume any particular device relationship
    75  #   based on their names. If you do, you may irrevocably erase data on an
    76  #   unintended device.
    77  /dev/nvme{[0-9],[1-9][0-9]}n{[1-9],[1-5][0-9],6[0-3]} rw, # NVMe (up to 100 devices, with 1-63 namespaces)
    78  
    79  # Allow /dev/nvmeX controller character devices. These character devices allow
    80  # manipulation of the block devices that we also allow above, so grouping this
    81  # access here makes sense, whereas access to individual partitions is delegated
    82  # to the raw-volume interface.
    83  /dev/nvme{[0-9],[1-9][0-9]} rw,                           # NVMe (up to 100 devices)
    84  
    85  # SCSI device commands, et al
    86  capability sys_rawio,
    87  
    88  # Perform various privileged block-device ioctl operations
    89  capability sys_admin,
    90  
    91  # Devices for various controllers used with ioctl()
    92  /dev/mpt2ctl{,_wd} rw,
    93  /dev/megaraid_sas_ioctl_node rw,
    94  `
    95  
    96  var blockDevicesConnectedPlugUDev = []string{
    97  	`SUBSYSTEM=="block"`,
    98  	// these additional subsystems may not directly be block devices but they
    99  	// allow for manipulation of the block devices and so are grouped here as
   100  	// well
   101  	`SUBSYSTEM=="nvme"`,
   102  	`KERNEL=="mpt2ctl*"`,
   103  	`KERNEL=="megaraid_sas_ioctl_node"`,
   104  }
   105  
   106  type blockDevicesInterface struct {
   107  	commonInterface
   108  }
   109  
   110  func init() {
   111  	registerIface(&blockDevicesInterface{commonInterface{
   112  		name:                  "block-devices",
   113  		summary:               blockDevicesSummary,
   114  		implicitOnCore:        true,
   115  		implicitOnClassic:     true,
   116  		baseDeclarationPlugs:  blockDevicesBaseDeclarationPlugs,
   117  		baseDeclarationSlots:  blockDevicesBaseDeclarationSlots,
   118  		connectedPlugAppArmor: blockDevicesConnectedPlugAppArmor,
   119  		connectedPlugUDev:     blockDevicesConnectedPlugUDev,
   120  	}})
   121  }