github.com/kubiko/snapd@v0.0.0-20201013125620-d4f3094d9ddf/interfaces/builtin/mount_observe.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin 21 22 const mountObserveSummary = `allows reading mount table and quota information` 23 24 const mountObserveBaseDeclarationSlots = ` 25 mount-observe: 26 allow-installation: 27 slot-snap-type: 28 - core 29 deny-auto-connection: true 30 ` 31 32 // http://bazaar.launchpad.net/~ubuntu-security/ubuntu-core-security/trunk/view/head:/data/apparmor/policygroups/ubuntu-core/16.04/mount-observe 33 const mountObserveConnectedPlugAppArmor = ` 34 # Description: Can query system mount and disk quota information. This is 35 # restricted because it gives privileged read access to mount arguments and 36 # should only be used with trusted apps. 37 38 /{,usr/}bin/df ixr, 39 40 # Needed by 'df'. This is an information leak 41 @{PROC}/mounts r, 42 owner @{PROC}/@{pid}/mounts r, 43 owner @{PROC}/@{pid}/mountinfo r, 44 owner @{PROC}/@{pid}/mountstats r, 45 /sys/devices/*/block/{,**} r, 46 47 @{PROC}/swaps r, 48 49 # This is often out of date but some apps insist on using it 50 /etc/mtab r, 51 /etc/fstab r, 52 ` 53 54 const mountObserveConnectedPlugSecComp = ` 55 # Description: Can query system mount and disk quota information. This is 56 # restricted because it gives privileged read access to mount arguments and 57 # should only be used with trusted apps. 58 59 quotactl Q_GETQUOTA - - - 60 quotactl Q_GETINFO - - - 61 quotactl Q_GETFMT - - - 62 quotactl Q_XGETQUOTA - - - 63 quotactl Q_XGETQSTAT - - - 64 ` 65 66 func init() { 67 registerIface(&commonInterface{ 68 name: "mount-observe", 69 summary: mountObserveSummary, 70 implicitOnCore: true, 71 implicitOnClassic: true, 72 baseDeclarationSlots: mountObserveBaseDeclarationSlots, 73 connectedPlugAppArmor: mountObserveConnectedPlugAppArmor, 74 connectedPlugSecComp: mountObserveConnectedPlugSecComp, 75 }) 76 }