github.com/meulengracht/snapd@v0.0.0-20210719210640-8bde69bcc84e/interfaces/builtin/classic_support.go (about)

     1  // -*- Mode: Go; indent-tabs-mode: t -*-
     2  
     3  /*
     4   * Copyright (C) 2017 Canonical Ltd
     5   *
     6   * This program is free software: you can redistribute it and/or modify
     7   * it under the terms of the GNU General Public License version 3 as
     8   * published by the Free Software Foundation.
     9   *
    10   * This program is distributed in the hope that it will be useful,
    11   * but WITHOUT ANY WARRANTY; without even the implied warranty of
    12   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    13   * GNU General Public License for more details.
    14   *
    15   * You should have received a copy of the GNU General Public License
    16   * along with this program.  If not, see <http://www.gnu.org/licenses/>.
    17   *
    18   */
    19  
    20  package builtin
    21  
    22  const classicSupportSummary = `special permissions for the classic snap`
    23  
    24  const classicSupportBaseDeclarationPlugs = `
    25    classic-support:
    26      allow-installation: false
    27      deny-auto-connection: true
    28  `
    29  
    30  const classicSupportBaseDeclarationSlots = `
    31    classic-support:
    32      allow-installation:
    33        slot-snap-type:
    34          - core
    35      deny-auto-connection: true
    36  `
    37  
    38  const classicSupportPlugAppArmor = `
    39  # Description: permissions to use classic dimension. This policy is
    40  # intentionally not restricted. This gives device ownership to
    41  # connected snaps.
    42  
    43  # Description: permissions to use classic dimension. This policy is intentionally
    44  # not restricted. This gives device ownership to connected snaps.
    45  
    46  # for 'create'
    47  /{,usr/}bin/unsquashfs ixr,
    48  /var/lib/snapd/snaps/core_*.snap r,
    49  capability chown,
    50  capability fowner,
    51  capability mknod,
    52  
    53  # This allows running anything unconfined
    54  /{,usr/}bin/sudo Uxr,
    55  capability fsetid,
    56  capability dac_override,
    57  
    58  # Allow copying configuration to the chroot
    59  /etc/{,**} r,
    60  /var/lib/extrausers/{,*} r,
    61  
    62  # Allow bind mounting various directories
    63  capability sys_admin,
    64  /{,usr/}bin/mount ixr,
    65  /{,usr/}bin/mountpoint ixr,
    66  /run/mount/utab rw,
    67  @{PROC}/[0-9]*/mountinfo r,
    68  # parallel-installs: SNAP_{DATA,COMMON} are remapped, need to use SNAP_NAME, for
    69  # completeness allow SNAP_INSTANCE_NAME too
    70  mount options=(rw bind) /home/ -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    71  mount options=(rw bind) /run/ -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    72  mount options=(rw bind) /proc/ -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    73  mount options=(rw bind) /sys/ -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    74  mount options=(rw bind) /dev/ -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    75  mount options=(rw bind) / -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    76  mount fstype=devpts options=(rw) devpts -> /dev/pts/,
    77  mount options=(rw rprivate) -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    78  
    79  # reset
    80  /{,usr/}bin/umount ixr,
    81  umount /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/**/,
    82  
    83  # These rules allow running anything unconfined as well as managing systemd
    84  /usr/bin/systemd-run Uxr,
    85  /bin/systemctl Uxr,
    86  `
    87  
    88  const classicSupportPlugSecComp = `
    89  # Description: permissions to use classic dimension. This policy is intentionally
    90  # not restricted. This gives device ownership to connected snaps.
    91  # create
    92  chown
    93  chown32
    94  lchown
    95  lchown32
    96  fchown
    97  fchown32
    98  fchownat
    99  mknod
   100  chroot
   101  
   102  # sudo
   103  bind
   104  sendmsg
   105  sendmmsg
   106  sendto
   107  recvfrom
   108  recvmsg
   109  setgroups
   110  setgroups32
   111  
   112  # classic
   113  mount
   114  getsockopt
   115  
   116  # reset
   117  umount
   118  umount2
   119  `
   120  
   121  func init() {
   122  	registerIface(&commonInterface{
   123  		name:                  "classic-support",
   124  		summary:               classicSupportSummary,
   125  		implicitOnCore:        true,
   126  		implicitOnClassic:     true,
   127  		baseDeclarationPlugs:  classicSupportBaseDeclarationPlugs,
   128  		baseDeclarationSlots:  classicSupportBaseDeclarationSlots,
   129  		connectedPlugAppArmor: classicSupportPlugAppArmor,
   130  		connectedPlugSecComp:  classicSupportPlugSecComp,
   131  	})
   132  }