github.com/rigado/snapd@v2.42.5-go-mod+incompatible/interfaces/builtin/removable_media.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2018 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin 21 22 const removableMediaSummary = `allows access to mounted removable storage` 23 24 const removableMediaBaseDeclarationSlots = ` 25 removable-media: 26 allow-installation: 27 slot-snap-type: 28 - core 29 deny-auto-connection: true 30 ` 31 32 const removableMediaConnectedPlugAppArmor = ` 33 # Description: Can access removable storage filesystems 34 35 # Allow read-access to /run/ for navigating to removable media. 36 /run/ r, 37 38 # Allow read on /run/media/ for navigating to the mount points. While this 39 # allows enumerating users, this is already allowed via /etc/passwd and getent. 40 /{,run/}media/ r, 41 42 # Mount points could be in /run/media/<user>/* or /media/<user>/* 43 /{,run/}media/*/ r, 44 /{,run/}media/*/** rwkl, 45 46 # Allow read-only access to /mnt to enumerate items. 47 /mnt/ r, 48 # Allow write access to anything under /mnt 49 /mnt/** rwkl, 50 ` 51 52 func init() { 53 registerIface(&commonInterface{ 54 name: "removable-media", 55 summary: removableMediaSummary, 56 implicitOnCore: true, 57 implicitOnClassic: true, 58 baseDeclarationSlots: removableMediaBaseDeclarationSlots, 59 connectedPlugAppArmor: removableMediaConnectedPlugAppArmor, 60 reservedForOS: true, 61 }) 62 }