github.com/rigado/snapd@v2.42.5-go-mod+incompatible/interfaces/builtin/udisks2_test.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2016-2017 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin_test 21 22 import ( 23 . "gopkg.in/check.v1" 24 25 "github.com/snapcore/snapd/interfaces" 26 "github.com/snapcore/snapd/interfaces/apparmor" 27 "github.com/snapcore/snapd/interfaces/builtin" 28 "github.com/snapcore/snapd/interfaces/dbus" 29 "github.com/snapcore/snapd/interfaces/seccomp" 30 "github.com/snapcore/snapd/interfaces/udev" 31 "github.com/snapcore/snapd/release" 32 "github.com/snapcore/snapd/snap" 33 "github.com/snapcore/snapd/testutil" 34 ) 35 36 type UDisks2InterfaceSuite struct { 37 iface interfaces.Interface 38 slotInfo *snap.SlotInfo 39 slot *interfaces.ConnectedSlot 40 classicSlotInfo *snap.SlotInfo 41 classicSlot *interfaces.ConnectedSlot 42 plugInfo *snap.PlugInfo 43 plug *interfaces.ConnectedPlug 44 } 45 46 var _ = Suite(&UDisks2InterfaceSuite{ 47 iface: builtin.MustInterface("udisks2"), 48 }) 49 50 const udisks2ConsumerYaml = `name: consumer 51 version: 0 52 apps: 53 app: 54 plugs: [udisks2] 55 ` 56 57 const udisks2ConsumerTwoAppsYaml = `name: consumer 58 version: 0 59 apps: 60 app1: 61 plugs: [udisks2] 62 app2: 63 plugs: [udisks2] 64 ` 65 66 const udisks2ConsumerThreeAppsYaml = `name: consumer 67 version: 0 68 apps: 69 app1: 70 plugs: [udisks2] 71 app2: 72 plugs: [udisks2] 73 app3: 74 ` 75 76 const udisks2ProducerYaml = `name: producer 77 version: 0 78 apps: 79 app: 80 slots: [udisks2] 81 ` 82 83 const udisks2ProducerTwoAppsYaml = `name: producer 84 version: 0 85 apps: 86 app1: 87 slots: [udisks2] 88 app2: 89 slots: [udisks2] 90 ` 91 92 const udisks2ProducerThreeAppsYaml = `name: producer 93 version: 0 94 apps: 95 app1: 96 slots: [udisks2] 97 app2: 98 app3: 99 slots: [udisks2] 100 ` 101 102 const udisks2ClassicYaml = `name: core 103 version: 0 104 type: os 105 slots: 106 udisks2: 107 interface: udisks2 108 ` 109 110 func (s *UDisks2InterfaceSuite) SetUpTest(c *C) { 111 s.plug, s.plugInfo = MockConnectedPlug(c, udisks2ConsumerYaml, nil, "udisks2") 112 s.slot, s.slotInfo = MockConnectedSlot(c, udisks2ProducerYaml, nil, "udisks2") 113 s.classicSlot, s.classicSlotInfo = MockConnectedSlot(c, udisks2ClassicYaml, nil, "udisks2") 114 } 115 116 func (s *UDisks2InterfaceSuite) TestName(c *C) { 117 c.Assert(s.iface.Name(), Equals, "udisks2") 118 } 119 120 func (s *UDisks2InterfaceSuite) TestSanitizeSlot(c *C) { 121 c.Assert(interfaces.BeforePrepareSlot(s.iface, s.slotInfo), IsNil) 122 c.Assert(interfaces.BeforePrepareSlot(s.iface, s.classicSlotInfo), IsNil) 123 } 124 125 func (s *UDisks2InterfaceSuite) TestAppArmorSpec(c *C) { 126 // on a core system with udisks2 slot coming from a regular app snap. 127 restore := release.MockOnClassic(false) 128 defer restore() 129 130 // The label uses short form when exactly one app is bound to the udisks2 slot 131 spec := &apparmor.Specification{} 132 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil) 133 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 134 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `peer=(label="snap.producer.app"),`) 135 136 // The label glob when all apps are bound to the udisks2 slot 137 slot, _ := MockConnectedSlot(c, udisks2ProducerTwoAppsYaml, nil, "udisks2") 138 spec = &apparmor.Specification{} 139 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, slot), IsNil) 140 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 141 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `peer=(label="snap.producer.*"),`) 142 143 // The label uses alternation when some, but not all, apps is bound to the udisks2 slot 144 slot, _ = MockConnectedSlot(c, udisks2ProducerThreeAppsYaml, nil, "udisks2") 145 spec = &apparmor.Specification{} 146 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, slot), IsNil) 147 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 148 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `peer=(label="snap.producer.{app1,app3}"),`) 149 150 // The label uses short form when exactly one app is bound to the udisks2 plug 151 spec = &apparmor.Specification{} 152 c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.slot), IsNil) 153 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.producer.app"}) 154 c.Assert(spec.SnippetForTag("snap.producer.app"), testutil.Contains, `peer=(label="snap.consumer.app"),`) 155 156 // The label glob when all apps are bound to the udisks2 plug 157 plug, _ := MockConnectedPlug(c, udisks2ConsumerTwoAppsYaml, nil, "udisks2") 158 spec = &apparmor.Specification{} 159 c.Assert(spec.AddConnectedSlot(s.iface, plug, s.slot), IsNil) 160 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.producer.app"}) 161 c.Assert(spec.SnippetForTag("snap.producer.app"), testutil.Contains, `peer=(label="snap.consumer.*"),`) 162 163 // The label uses alternation when some, but not all, apps is bound to the udisks2 plug 164 plug, _ = MockConnectedPlug(c, udisks2ConsumerThreeAppsYaml, nil, "udisks2") 165 spec = &apparmor.Specification{} 166 c.Assert(spec.AddConnectedSlot(s.iface, plug, s.slot), IsNil) 167 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.producer.app"}) 168 c.Assert(spec.SnippetForTag("snap.producer.app"), testutil.Contains, `peer=(label="snap.consumer.{app1,app2}"),`) 169 170 // permanent slot have a non-nil security snippet for apparmor 171 spec = &apparmor.Specification{} 172 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil) 173 c.Assert(spec.AddPermanentSlot(s.iface, s.slotInfo), IsNil) 174 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app", "snap.producer.app"}) 175 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `peer=(label="snap.producer.app"),`) 176 c.Assert(spec.SnippetForTag("snap.producer.app"), testutil.Contains, `peer=(label=unconfined),`) 177 } 178 179 func (s *UDisks2InterfaceSuite) TestAppArmorSpecOnClassic(c *C) { 180 // on a core system with udisks2 slot coming from a the classic distro. 181 restore := release.MockOnClassic(true) 182 defer restore() 183 184 // connected plug to core slot 185 spec := &apparmor.Specification{} 186 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil) 187 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 188 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `peer=(label=unconfined),`) 189 190 // connected classic slot to plug 191 spec = &apparmor.Specification{} 192 c.Assert(spec.AddConnectedSlot(s.iface, s.plug, s.classicSlot), IsNil) 193 c.Assert(spec.SecurityTags(), HasLen, 0) 194 195 // permanent classic slot 196 spec = &apparmor.Specification{} 197 c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil) 198 c.Assert(spec.SecurityTags(), HasLen, 0) 199 } 200 201 func (s *UDisks2InterfaceSuite) TestDBusSpec(c *C) { 202 // on a core system with udisks2 slot coming from a regular app snap. 203 restore := release.MockOnClassic(false) 204 defer restore() 205 206 spec := &dbus.Specification{} 207 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil) 208 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.consumer.app"}) 209 c.Assert(spec.SnippetForTag("snap.consumer.app"), testutil.Contains, `<policy context="default">`) 210 211 spec = &dbus.Specification{} 212 c.Assert(spec.AddPermanentSlot(s.iface, s.slotInfo), IsNil) 213 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.producer.app"}) 214 c.Assert(spec.SnippetForTag("snap.producer.app"), testutil.Contains, `<policy user="root">`) 215 c.Assert(spec.SnippetForTag("snap.producer.app"), testutil.Contains, `send_interface="org.freedesktop.DBus.Introspectable"`) 216 } 217 218 func (s *UDisks2InterfaceSuite) TestDBusSpecOnClassic(c *C) { 219 // on a core system with udisks2 slot coming from a the classic distro. 220 restore := release.MockOnClassic(true) 221 defer restore() 222 223 // connected plug to core slot 224 spec := &dbus.Specification{} 225 c.Assert(spec.AddConnectedPlug(s.iface, s.plug, s.classicSlot), IsNil) 226 c.Assert(spec.SecurityTags(), HasLen, 0) 227 c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil) 228 c.Assert(spec.SecurityTags(), HasLen, 0) 229 } 230 231 func (s *UDisks2InterfaceSuite) TestUDevSpec(c *C) { 232 // on a core system with udisks2 slot coming from a regular app snap. 233 restore := release.MockOnClassic(false) 234 defer restore() 235 236 spec := &udev.Specification{} 237 c.Assert(spec.AddPermanentSlot(s.iface, s.slotInfo), IsNil) 238 c.Assert(spec.Snippets(), HasLen, 4) 239 c.Assert(spec.Snippets()[0], testutil.Contains, `LABEL="udisks_probe_end"`) 240 c.Assert(spec.Snippets(), testutil.Contains, `# udisks2 241 SUBSYSTEM=="block", TAG+="snap_producer_app"`) 242 c.Assert(spec.Snippets(), testutil.Contains, `# udisks2 243 SUBSYSTEM=="usb", TAG+="snap_producer_app"`) 244 c.Assert(spec.Snippets(), testutil.Contains, `TAG=="snap_producer_app", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_producer_app $devpath $major:$minor"`) 245 } 246 247 func (s *UDisks2InterfaceSuite) TestUDevSpecOnClassic(c *C) { 248 // on a core system with udisks2 slot coming from a the classic distro. 249 restore := release.MockOnClassic(true) 250 defer restore() 251 252 spec := &udev.Specification{} 253 c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil) 254 c.Assert(spec.Snippets(), HasLen, 0) 255 } 256 257 func (s *UDisks2InterfaceSuite) TestSecCompSpec(c *C) { 258 // on a core system with udisks2 slot coming from a regular app snap. 259 restore := release.MockOnClassic(false) 260 defer restore() 261 262 spec := &seccomp.Specification{} 263 c.Assert(spec.AddPermanentSlot(s.iface, s.slotInfo), IsNil) 264 c.Assert(spec.SecurityTags(), DeepEquals, []string{"snap.producer.app"}) 265 c.Assert(spec.SnippetForTag("snap.producer.app"), testutil.Contains, "mount\n") 266 } 267 268 func (s *UDisks2InterfaceSuite) TestSecCompSpecOnClassic(c *C) { 269 // on a core system with udisks2 slot coming from a the classic distro. 270 restore := release.MockOnClassic(true) 271 defer restore() 272 273 spec := &seccomp.Specification{} 274 c.Assert(spec.AddPermanentSlot(s.iface, s.classicSlotInfo), IsNil) 275 c.Assert(spec.SecurityTags(), HasLen, 0) 276 } 277 278 func (s *UDisks2InterfaceSuite) TestStaticInfo(c *C) { 279 si := interfaces.StaticInfoOf(s.iface) 280 c.Assert(si.ImplicitOnCore, Equals, false) 281 c.Assert(si.ImplicitOnClassic, Equals, true) 282 c.Assert(si.Summary, Equals, `allows operating as or interacting with the UDisks2 service`) 283 c.Assert(si.BaseDeclarationSlots, testutil.Contains, "udisks2") 284 } 285 286 func (s *UDisks2InterfaceSuite) TestAutoConnect(c *C) { 287 c.Assert(s.iface.AutoConnect(s.plugInfo, s.slotInfo), Equals, true) 288 } 289 290 func (s *UDisks2InterfaceSuite) TestInterfaces(c *C) { 291 c.Assert(builtin.Interfaces(), testutil.DeepContains, s.iface) 292 }