github.com/rigado/snapd@v2.42.5-go-mod+incompatible/interfaces/builtin/personal_files_test.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2018 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin_test 21 22 import ( 23 "strings" 24 25 . "gopkg.in/check.v1" 26 27 "github.com/snapcore/snapd/interfaces" 28 "github.com/snapcore/snapd/interfaces/apparmor" 29 "github.com/snapcore/snapd/interfaces/builtin" 30 "github.com/snapcore/snapd/snap" 31 "github.com/snapcore/snapd/snap/snaptest" 32 "github.com/snapcore/snapd/testutil" 33 ) 34 35 type personalFilesInterfaceSuite struct { 36 iface interfaces.Interface 37 slot *interfaces.ConnectedSlot 38 slotInfo *snap.SlotInfo 39 plug *interfaces.ConnectedPlug 40 plugInfo *snap.PlugInfo 41 } 42 43 var _ = Suite(&personalFilesInterfaceSuite{ 44 iface: builtin.MustInterface("personal-files"), 45 }) 46 47 func (s *personalFilesInterfaceSuite) SetUpTest(c *C) { 48 const mockPlugSnapInfo = `name: other 49 version: 1.0 50 plugs: 51 personal-files: 52 read: [$HOME/.read-dir, $HOME/.read-file] 53 write: [$HOME/.write-dir, $HOME/.write-file] 54 apps: 55 app: 56 command: foo 57 plugs: [personal-files] 58 ` 59 s.slotInfo = &snap.SlotInfo{ 60 Snap: &snap.Info{SuggestedName: "core", SnapType: snap.TypeOS}, 61 Name: "personal-files", 62 Interface: "personal-files", 63 } 64 s.slot = interfaces.NewConnectedSlot(s.slotInfo, nil, nil) 65 plugSnap := snaptest.MockInfo(c, mockPlugSnapInfo, nil) 66 s.plugInfo = plugSnap.Plugs["personal-files"] 67 s.plug = interfaces.NewConnectedPlug(s.plugInfo, nil, nil) 68 } 69 70 func (s *personalFilesInterfaceSuite) TestName(c *C) { 71 c.Assert(s.iface.Name(), Equals, "personal-files") 72 } 73 74 func (s *personalFilesInterfaceSuite) TestConnectedPlugAppArmor(c *C) { 75 apparmorSpec := &apparmor.Specification{} 76 err := apparmorSpec.AddConnectedPlug(s.iface, s.plug, s.slot) 77 c.Assert(err, IsNil) 78 c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other.app"}) 79 c.Check(apparmorSpec.SnippetForTag("snap.other.app"), Equals, ` 80 # Description: Can access specific personal files or directories in the 81 # users's home directory. 82 # This is restricted because it gives file access to arbitrary locations. 83 owner "@{HOME}/.read-dir{,/,/**}" rk, 84 owner "@{HOME}/.read-file{,/,/**}" rk, 85 owner "@{HOME}/.write-dir{,/,/**}" rwkl, 86 owner "@{HOME}/.write-file{,/,/**}" rwkl, 87 `) 88 } 89 90 func (s *personalFilesInterfaceSuite) TestSanitizeSlot(c *C) { 91 c.Assert(interfaces.BeforePrepareSlot(s.iface, s.slotInfo), IsNil) 92 } 93 94 func (s *personalFilesInterfaceSuite) TestSanitizePlug(c *C) { 95 c.Assert(interfaces.BeforePreparePlug(s.iface, s.plugInfo), IsNil) 96 } 97 98 func (s *personalFilesInterfaceSuite) TestSanitizePlugHappy(c *C) { 99 const mockSnapYaml = `name: personal-files-plug-snap 100 version: 1.0 101 plugs: 102 personal-files: 103 read: ["$HOME/file1", "$HOME/.hidden1"] 104 write: ["$HOME/dir1", "$HOME/.hidden2"] 105 ` 106 info := snaptest.MockInfo(c, mockSnapYaml, nil) 107 plug := info.Plugs["personal-files"] 108 c.Assert(interfaces.BeforePreparePlug(s.iface, plug), IsNil) 109 } 110 111 func (s *personalFilesInterfaceSuite) TestSanitizePlugUnhappy(c *C) { 112 const mockSnapYaml = `name: personal-files-plug-snap 113 version: 1.0 114 plugs: 115 personal-files: 116 $t 117 ` 118 errPrefix := `cannot add personal-files plug: ` 119 var testCases = []struct { 120 inp string 121 errStr string 122 }{ 123 {`read: ""`, `"read" must be a list of strings`}, 124 {`read: [ 123 ]`, `"read" must be a list of strings`}, 125 {`read: [ "$HOME/foo/./bar" ]`, `cannot use "\$HOME/foo/./bar": try "\$HOME/foo/bar"`}, 126 {`read: [ "../foo" ]`, `"../foo" must start with "\$HOME/"`}, 127 {`read: [ "/foo[" ]`, `"/foo\[" contains a reserved apparmor char from .*`}, 128 {`write: ""`, `"write" must be a list of strings`}, 129 {`write: bar`, `"write" must be a list of strings`}, 130 {`read: [ "~/foo" ]`, `"~/foo" cannot contain "~"`}, 131 {`read: [ "$HOME/foo/~/foo" ]`, `"\$HOME/foo/~/foo" cannot contain "~"`}, 132 {`read: [ "$HOME/foo/../foo" ]`, `cannot use "\$HOME/foo/../foo": try "\$HOME/foo"`}, 133 {`read: [ "$HOME/home/$HOME/foo" ]`, `\$HOME must only be used at the start of the path of "\$HOME/home/\$HOME/foo"`}, 134 {`read: [ "$HOME/sweet/$HOME" ]`, `\$HOME must only be used at the start of the path of "\$HOME/sweet/\$HOME"`}, 135 {`read: [ "/@{FOO}" ]`, `"/@{FOO}" contains a reserved apparmor char from .*`}, 136 {`read: [ "/home/@{HOME}/foo" ]`, `"/home/@{HOME}/foo" contains a reserved apparmor char from .*`}, 137 {`read: [ "${HOME}/foo" ]`, `"\${HOME}/foo" contains a reserved apparmor char from .*`}, 138 {`read: [ "$HOME" ]`, `"\$HOME" must start with "\$HOME/"`}, 139 } 140 141 for _, t := range testCases { 142 yml := strings.Replace(mockSnapYaml, "$t", t.inp, -1) 143 info := snaptest.MockInfo(c, yml, nil) 144 plug := info.Plugs["personal-files"] 145 146 c.Check(interfaces.BeforePreparePlug(s.iface, plug), ErrorMatches, errPrefix+t.errStr, Commentf("unexpected error for %q", t.inp)) 147 } 148 } 149 150 func (s *personalFilesInterfaceSuite) TestInterfaces(c *C) { 151 c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface) 152 }