Merge lp:~alexmurray/snappy-hub/update-for-snapd-2.51.6 into lp:~snappy-debug-developers/snappy-hub/snappy-debug

[Alex Murray]

[Seth Arnold (seth-arnold)]

A comment inline in one place, but it applies to several similar segments. Thanks.

=== modified file 'data/policy/classic/16/apparmor/account-control'
--- data/policy/classic/16/apparmor/account-control	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/account-control	2021-08-25 03:55:24 +0000
@@ -14,7 +14,7 @@
 /etc/pam.d/{,*} r,
 
 # Needed by chpasswd
-/lib/@{multiarch}/security/* ixr,
+/{,usr/}lib/@{multiarch}/security/* ixr,
 
 # Useradd needs netlink
 network netlink raw,
 
=== modified file 'data/policy/classic/16/apparmor/block-devices'
--- data/policy/classic/16/apparmor/block-devices	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/block-devices	2021-08-25 03:55:24 +0000
@@ -4,6 +4,7 @@
 /run/udev/data/b[0-9]*:[0-9]* r,
 /sys/block/ r,
 /sys/devices/**/block/** r,
+/sys/devices/platform/soc/**/mmc_host/** r,
 
 # Access to raw devices, not individual partitions
 /dev/hd[a-t] rw,                                          # IDE, MFM, RLL
 
=== modified file 'data/policy/classic/16/apparmor/camera'
--- data/policy/classic/16/apparmor/camera	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/camera	2021-08-25 03:55:24 +0000
@@ -17,4 +17,5 @@
 /run/udev/data/+usb:* r,
 /sys/class/video4linux/ r,
 /sys/devices/pci**/usb*/**/video4linux/** r,
+/sys/devices/platform/**/usb*/**/video4linux/** r,
 
 
=== added file 'data/policy/classic/16/apparmor/dm-crypt'
--- data/policy/classic/16/apparmor/dm-crypt	1970-01-01 00:00:00 +0000
+++ data/policy/classic/16/apparmor/dm-crypt	2021-08-25 03:55:24 +0000
@@ -0,0 +1,18 @@
+# Allow mapper access
+/dev/mapper/control rw,
+/dev/dm-[0-9]* rw,
+# allow use of cryptsetup from core snap
+/{,usr/}sbin/cryptsetup ixr,
+# Mount points could be in /run/media/<user>/* or /media/<user>/*
+/run/systemd/seats/* r,
+/{,run/}media/{,**} rw,
+mount options=(ro,nosuid,nodev) /dev/dm-[0-9]* -> /{,run/}media/**,
+mount options=(rw,nosuid,nodev) /dev/dm-[0-9]* -> /{,run/}media/**,
+
+#  exec mount/umount to do the actual operations
+/{,usr/}bin/mount ixr,
+/{,usr/}bin/umount ixr,
+
+# mount/umount (via libmount) track some mount info in these files
+/run/mount/utab* wrlk,
+
 
=== modified file 'data/policy/classic/16/apparmor/docker-support'
--- data/policy/classic/16/apparmor/docker-support	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/docker-support	2021-08-25 03:55:24 +0000
@@ -86,7 +86,7 @@
 
 # Docker needs to be able to create and load the profile it applies to
 # containers ("docker-default")
-/sbin/apparmor_parser ixr,
+/{,usr/}sbin/apparmor_parser ixr,
 /etc/apparmor.d/cache/ r,            # apparmor 2.12 and below
 /etc/apparmor.d/cache/.features r,
 /etc/apparmor.d/{,cache/}docker* rw,
@@ -145,3 +145,12 @@
 # containerd to use this path for various account information for pods.
 /run/secrets/kubernetes.io/{,**} rk,
 
+# Allow using the 'autobind' feature of bind() (eg, for journald via go-systemd)
+# unix (bind) type=dgram addr=auto,
+# TODO: when snapd vendors in AppArmor userspace, then enable the new syntax
+# above which allows only "empty"/automatic addresses, for now we simply permit
+# all addresses with SOCK_DGRAM type, which leaks info for other addresses than
+# what docker tries to use
+# see https://bugs.launchpad.net/snapd/+bug/1867216
+unix (bind) type=dgram,
+
 
=== modified file 'data/policy/classic/16/apparmor/greengrass-support'
--- data/policy/classic/16/apparmor/greengrass-support	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/greengrass-support	2021-08-25 03:55:24 +0000
@@ -49,7 +49,7 @@
 
 # cgroup accesses
 # greengrassd extensively uses cgroups to confine it's containers (AKA lambdas)
-# and needs to read what cgroups are available; we allow reading any cgroup, 
+# and needs to read what cgroups are available; we allow reading any cgroup,
 # but limit writes below
 # also note that currently greengrass is not implemented in such a way that it
 # can stack it's cgroups inside the cgroup that snapd would normally enforce
@@ -75,10 +75,10 @@
 # specific rule for cpuset files
 owner /old_rootfs/sys/fs/cgroup/cpuset/{,system.slice/}cpuset.{cpus,mems} rw,
 
-# the wrapper scripts need to use mount/umount and pivot_root from the 
+# the wrapper scripts need to use mount/umount and pivot_root from the
 # core snap
-/bin/{,u}mount ixr,
-/sbin/pivot_root ixr,
+/{,usr/}bin/{,u}mount ixr,
+/{,usr/}sbin/pivot_root ixr,
 
 # allow pivot_root'ing into the rootfs prepared for the greengrass daemon
 # parallel-installs: SNAP_{DATA,COMMON} are remapped, need to use SNAP_NAME, for
@@ -119,9 +119,9 @@
 # completeness allow SNAP_INSTANCE_NAME too
 mount options=(rw, bind) /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** ,
 mount options=(rw, rbind) /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/** ,
-# also allow mounting new files anywhere underneath the rootfs of the target 
+# also allow mounting new files anywhere underneath the rootfs of the target
 # overlayfs directory, which is the rootfs of the container
-# this is for allowing local resource access which first makes a mount at 
+# this is for allowing local resource access which first makes a mount at
 # the target destination and then a bind mount from the source to the destination
 # the source destination mount will be allowed under the above rule
 mount -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/*/ggc-writable/packages/*/rootfs/merged/**,
@@ -168,7 +168,7 @@
 mount options=(rw, bind) /run/ -> /run/,
 
 # mounts for resolv.conf inside the container
-# we have to manually do this otherwise the go DNS resolver fails to work, because it isn't configured to 
+# we have to manually do this otherwise the go DNS resolver fails to work, because it isn't configured to
 # use the system DNS server and attempts to do DNS resolution itself, manually inspecting /etc/resolv.conf
 mount options=(ro, bind) /run/systemd/resolve/stub-resolv.conf -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/*/rootfs/etc/resolv.conf,
 mount options=(ro, bind) /run/resolvconf/resolv.conf -> /var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/*/rootfs/etc/resolv.conf,
@@ -177,7 +177,7 @@
 # pivot_root for the container initialization into the rootfs
 # note that the actual syscall is pivotroot(".",".")
 # so the oldroot is the same as the new root
-pivot_root 
+pivot_root
 	oldroot=/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/*/ggc-writable/packages/*/rootfs/merged/
 	/var/snap/{@{SNAP_NAME},@{SNAP_INSTANCE_NAME}}/*/ggc-writable/packages/*/rootfs/merged/,
 
@@ -213,12 +213,12 @@
 # and /run is explicitly disallowed for use by layouts
 # also note that technically this access is post-pivot_root, but during the setup
 # for the mount ns that the snap performs (not snapd), /var/run is bind mounted
-# from outside the pivot_root to inside the pivot_root, so this will always 
+# from outside the pivot_root to inside the pivot_root, so this will always
 # access the same files inside or outside the pivot_root
 owner /{var/,}run/greengrassd.pid rw,
 
-# all of the rest of the accesses are made by child containers and as such are 
-# "post-pivot_root", meaning that they aren't accessing these files on the 
+# all of the rest of the accesses are made by child containers and as such are
+# "post-pivot_root", meaning that they aren't accessing these files on the
 # host root filesystem, but rather somewhere inside $SNAP_DATA/rootfs/
 # Note: eventually greengrass will gain the ability to specify child profiles
 # for it's containers and include these rules in that profile so they won't
 
=== modified file 'data/policy/classic/16/apparmor/hardware-observe'
--- data/policy/classic/16/apparmor/hardware-observe	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/hardware-observe	2021-08-25 03:55:24 +0000
@@ -11,7 +11,7 @@
 # used by lspci
 capability sys_admin,
 /etc/modprobe.d/{,*} r,
-/lib/modprobe.d/{,*} r,
+/{,usr/}lib/modprobe.d/{,*} r,
 
 # files in /sys pertaining to hardware (eg, 'lspci -A linux-sysfs')
 /sys/{block,bus,class,devices,firmware}/{,**} r,
 
=== modified file 'data/policy/classic/16/apparmor/kernel-module-control'
--- data/policy/classic/16/apparmor/kernel-module-control	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/kernel-module-control	2021-08-25 03:55:24 +0000
@@ -18,5 +18,5 @@
 # Allow reading information about loaded kernel modules
 /sys/module/{,**} r,
 /etc/modprobe.d/{,**} r,
-/lib/modprobe.d/{,**} r,
+/{,usr/}lib/modprobe.d/{,**} r,
 
 
=== modified file 'data/policy/classic/16/apparmor/kernel-module-observe'
--- data/policy/classic/16/apparmor/kernel-module-observe	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/kernel-module-observe	2021-08-25 03:55:24 +0000
@@ -12,5 +12,5 @@
 # Allow reading information about loaded kernel modules
 /sys/module/{,**} r,
 /etc/modprobe.d/{,**} r,
-/lib/modprobe.d/{,**} r,
+/{,usr/}lib/modprobe.d/{,**} r,
 
 
=== modified file 'data/policy/classic/16/apparmor/kubernetes-support'
--- data/policy/classic/16/apparmor/kubernetes-support	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/kubernetes-support	2021-08-25 03:55:24 +0000
@@ -169,11 +169,12 @@
 /sys/module/ip_vs_sh/initstate r,
 /sys/module/ip_vs_wrr/initstate r,
 
-# Allow using the 'autobind' feature of bind() (eg, for journald).
-#unix (bind) type=dgram addr=none,
-# Due to LP: 1867216, we cannot use the above rule and must instead use this
-# less specific rule that allows bind() to arbitrary SOCK_DGRAM abstract socket
-# names (separate send and receive rules are still required for communicating
-# over the socket).
+# Allow using the 'autobind' feature of bind() (eg, for journald via go-systemd)
+# unix (bind) type=dgram addr=auto,
+# TODO: when snapd vendors in AppArmor userspace, then enable the new syntax
+# above which allows only "empty"/automatic addresses, for now we simply permit
+# all addresses with SOCK_DGRAM type, which leaks info for other addresses than
+# what docker tries to use
+# see https://bugs.launchpad.net/snapd/+bug/1867216
 unix (bind) type=dgram,
 
 
=== modified file 'data/policy/classic/16/apparmor/modem-manager'
--- data/policy/classic/16/apparmor/modem-manager	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/modem-manager	2021-08-25 03:55:24 +0000
@@ -33,10 +33,10 @@
     bus=system
     path=/org/freedesktop/ModemManager1{,/**}
     interface=org.freedesktop.ModemManager1*
-    peer=(label="snap.core."),
+    peer=(label="snap.snapd.*"),
 dbus (receive, send)
     bus=system
     path=/org/freedesktop/ModemManager1{,/**}
     interface=org.freedesktop.DBus.*
-    peer=(label="snap.core."),
+    peer=(label="snap.snapd.*"),
 
 
=== modified file 'data/policy/classic/16/apparmor/multipass-support'
--- data/policy/classic/16/apparmor/multipass-support	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/multipass-support	2021-08-25 03:55:24 +0000
@@ -1,6 +1,6 @@
 # Description: this policy intentionally allows the Multipass daemon to configure AppArmor
 # as Multipass generates AppArmor profiles for the utility processes it spawns.
-/sbin/apparmor_parser ixr,
+/{,usr/}sbin/apparmor_parser ixr,
 /etc/apparmor{,.d}/{,**} r,
 /sys/kernel/security/apparmor/{,**} r,
 /sys/kernel/security/apparmor/.remove w,
 
=== modified file 'data/policy/classic/16/apparmor/network-control'
--- data/policy/classic/16/apparmor/network-control	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/network-control	2021-08-25 03:55:24 +0000
@@ -128,13 +128,13 @@
 /etc/hosts w,
 
 # resolvconf
-/sbin/resolvconf ixr,
+/{,usr/}sbin/resolvconf ixr,
 /run/resolvconf/{,**} rk,
 /run/resolvconf/** w,
 /etc/resolvconf/{,**} r,
-/lib/resolvconf/* ix,
+/{,usr/}lib/resolvconf/* ix,
 # Required by resolvconf
-/bin/run-parts ixr,
+/{,usr/}bin/run-parts ixr,
 /etc/resolvconf/update.d/* ix,
 
 # wpa_suplicant
 
=== modified file 'data/policy/classic/16/apparmor/network-setup-control'
--- data/policy/classic/16/apparmor/network-setup-control	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/network-setup-control	2021-08-25 03:55:24 +0000
@@ -1,5 +1,18 @@
 # Description: Can read/write netplan configuration files
 
+# Allow use of the netplan binary from the base snap. With this interface, this 
+# is expected to be able to apply and generate new network configuration, as 
+# well as get information about the current network configuration.
+/usr/sbin/netplan ixr,
+# core18+ has /usr/sbin/netplan as a symlink to this script
+/usr/share/netplan/netplan.script ixr,
+# netplan related files
+/usr/share/netplan/ r,
+/usr/share/netplan/** r,
+
+# Netplan uses busctl internally, so allow using that as well
+/usr/bin/busctl ixr,
+
 /etc/netplan/{,**} rw,
 /etc/network/{,**} rw,
 /etc/systemd/network/{,**} rw,
 
=== modified file 'data/policy/classic/16/apparmor/network-setup-observe'
--- data/policy/classic/16/apparmor/network-setup-observe	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/network-setup-observe	2021-08-25 03:55:24 +0000
@@ -1,5 +1,19 @@
 # Description: Can read netplan configuration files
 
+# Allow use of the netplan binary from the base snap. With this interface, this 
+# is expected to be able to only get information about the current network 
+# configuration and not generate or apply it like is allowed with 
+# network-setup-control.
+/usr/sbin/netplan ixr,
+# core18+ has /usr/sbin/netplan as a symlink to this script
+/usr/share/netplan/netplan.script ixr,
+# netplan related files
+/usr/share/netplan/ r,
+/usr/share/netplan/** r,
+
+# Netplan uses busctl internally, so allow using that as well
+/usr/bin/busctl ixr,
+
 /etc/netplan/{,**} r,
 /etc/network/{,**} r,
 /etc/systemd/network/{,**} r,
 
=== modified file 'data/policy/classic/16/apparmor/ofono'
--- data/policy/classic/16/apparmor/ofono	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/ofono	2021-08-25 03:55:24 +0000
@@ -25,7 +25,7 @@
     bus=system
     path=/{,**}
     interface=org.ofono.*
-    peer=(label="snap.core."),
+    peer=(label="snap.snapd.*"),
 
 # Allow clients to introspect the service on non-classic (due to the path,
 # allowing on classic would reveal too much for unconfined)
@@ -34,5 +34,5 @@
     path=/
     interface=org.freedesktop.DBus.Introspectable
     member=Introspect
-    peer=(label="snap.core."),
+    peer=(label="snap.snapd.*"),
 
 
=== modified file 'data/policy/classic/16/apparmor/opengl'
--- data/policy/classic/16/apparmor/opengl	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/opengl	2021-08-25 03:55:24 +0000
@@ -81,7 +81,10 @@
 
 # Xilinx zocl DRM driver
 # https://github.com/Xilinx/XRT/tree/master/src/runtime_src/core/edge/drm
-/sys/devices/platform/amba_pl@[0-9]*/amba_pl@[0-9]*:zyxclmm_drm/* r,
+/sys/devices/platform/amba{,_pl@[0-9]*}/amba{,_pl@[0-9]*}:zyxclmm_drm/* r,
+
+# Imagination PowerVR driver
+/dev/pvr_sync rw,
 
 # OpenCL ICD files
 /etc/OpenCL/vendors/ r,
 
=== modified file 'data/policy/classic/16/apparmor/ppp'
--- data/policy/classic/16/apparmor/ppp	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/ppp	2021-08-25 03:55:24 +0000
@@ -10,7 +10,7 @@
 /run/ppp* rwk,
 /var/run/ppp* rwk,
 /var/log/ppp* rw,
-/bin/run-parts ix,
+/{,usr/}bin/run-parts ix,
 @{PROC}/@{pid}/loginuid r,
 capability setgid,
 capability setuid,
 
=== added file 'data/policy/classic/16/apparmor/raw-input'
--- data/policy/classic/16/apparmor/raw-input	1970-01-01 00:00:00 +0000
+++ data/policy/classic/16/apparmor/raw-input	2021-08-25 03:55:24 +0000
@@ -0,0 +1,13 @@
+# Description: Allow reading and writing to raw input devices
+
+/dev/input/* rw,
+
+# Allow reading for supported event reports for all input devices. See
+# https://www.kernel.org/doc/Documentation/input/event-codes.txt
+/sys/devices/**/input[0-9]*/capabilities/* r,
+
+# For using udev
+network netlink raw,
+/run/udev/data/c13:[0-9]* r,
+/run/udev/data/+input:input[0-9]* r,
+
 
=== added file 'data/policy/classic/16/apparmor/sd-control'
--- data/policy/classic/16/apparmor/sd-control	1970-01-01 00:00:00 +0000
+++ data/policy/classic/16/apparmor/sd-control	2021-08-25 03:55:24 +0000
@@ -0,0 +1,6 @@
+# Description: can manage and control the SD cards using the DualSD driver.
+
+# The main DualSD device node is used to control certain aspects of SD cards on
+# the system.
+/dev/DualSD rw,
+
 
=== modified file 'data/policy/classic/16/apparmor/system-observe'
--- data/policy/classic/16/apparmor/system-observe	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/system-observe	2021-08-25 03:55:24 +0000
@@ -22,6 +22,7 @@
 @{PROC}/modules r,
 @{PROC}/stat r,
 @{PROC}/vmstat r,
+@{PROC}/zoneinfo r,
 @{PROC}/diskstats r,
 @{PROC}/kallsyms r,
 @{PROC}/partitions r,
 
=== added file 'data/policy/classic/16/apparmor/tee'
--- data/policy/classic/16/apparmor/tee	1970-01-01 00:00:00 +0000
+++ data/policy/classic/16/apparmor/tee	2021-08-25 03:55:24 +0000
@@ -0,0 +1,9 @@
+# Description: for those who need to talk to the TEE subsystem over
+# /dev/tee[0-9]* and/or /dev/teepriv[0-0]*
+
+/dev/tee[0-9]* rw,
+/dev/teepriv[0-9]* rw,
+
+# Qualcomm equivalent qseecom (Qualcomm Secure Execution Environment Communicator)
+/dev/qseecom rw,
+
 
=== modified file 'data/policy/classic/16/apparmor/time-control'
--- data/policy/classic/16/apparmor/time-control	2021-03-24 13:55:25 +0000
+++ data/policy/classic/16/apparmor/time-control	2021-08-25 03:55:24 +0000
@@ -67,5 +67,5 @@
 # write to the audit subsystem. We omit 'capability audit_write'
 # and 'capability net_admin' here. Applications requiring audit
 # logging should plug 'netlink-audit'.
-/sbin/hwclock ixr,
+/{,usr/}sbin/hwclock ixr,
 
 
=== added file 'data/policy/classic/16/seccomp/dm-crypt'
--- data/policy/classic/16/seccomp/dm-crypt	1970-01-01 00:00:00 +0000
+++ data/policy/classic/16/seccomp/dm-crypt	2021-08-25 03:55:24 +0000
@@ -0,0 +1,6 @@
+# Description: Allow kernel keyring manipulation
+add_key
+keyctl
+request_key
+
+
 
=== modified file 'data/policy/classic/16/seccomp/greengrass-support'
--- data/policy/classic/16/seccomp/greengrass-support	2019-11-26 19:16:08 +0000
+++ data/policy/classic/16/seccomp/greengrass-support	2021-08-25 03:55:24 +0000
@@ -32,7 +32,7 @@
 # by greengrassd.
 keyctl
 
-# special character device creation is necessary for creating the overlayfs 
+# special character device creation is necessary for creating the overlayfs
 # mounts
 # Unfortunately this grants device ownership to the snap.
 mknod - |S_IFCHR -
 
=== added file 'data/policy/classic/16/seccomp/raw-input'
--- data/policy/classic/16/seccomp/raw-input	1970-01-01 00:00:00 +0000
+++ data/policy/classic/16/seccomp/raw-input	2021-08-25 03:55:24 +0000
@@ -0,0 +1,6 @@
+# Description: Allow handling input devices.
+# for udev
+bind
+socket AF_NETLINK - NETLINK_KOBJECT_UEVENT
+
+
 
=== modified file 'policy-app/test-snapd-policy-app-consumer/meta/snap.yaml'
--- policy-app/test-snapd-policy-app-consumer/meta/snap.yaml	2020-03-18 18:33:59 +0000
+++ policy-app/test-snapd-policy-app-consumer/meta/snap.yaml	2021-08-25 03:55:24 +0000
@@ -11,6 +11,9 @@
   adb-support:
     command: bin/run
     plugs: [ adb-support ]
+  allegro-vcu:
+    command: bin/run
+    plugs: [ allegro-vcu ]
   alsa:
     command: bin/run
     plugs: [ alsa ]
@@ -74,6 +77,9 @@
   cpu-control:
     command: bin/run
     plugs: [ cpu-control ]
+  cups:
+    command: bin/run
+    plugs: [ cups ]
   cups-control:
     command: bin/run
     plugs: [ cups-control ]
@@ -98,12 +104,21 @@
   display-control:
     command: bin/run
     plugs: [ display-control ]
+  dm-crypt:
+    command: bin/run
+    plugs: [ dm-crypt ]
   docker:
     command: bin/run
     plugs: [ docker ]
   docker-support:
     command: bin/run
     plugs: [ docker-support ]
+  dsp-control:
+    command: bin/run
+    plugs: [ dsp-control ]
+  fpga:
+    command: bin/run
+    plugs: [ fpga ]
   system-files:
     command: bin/run
     plugs: [ system-files ]
@@ -128,6 +143,9 @@
   accounts-service:
     command: bin/run
     plugs: [ accounts-service ]
+  gconf:
+    command: bin/run
+    plugs: [ gconf ]
   gpg-keys:
     command: bin/run
     plugs: [ gpg-keys ]
@@ -158,9 +176,18 @@
   home:
     command: bin/run
     plugs: [ home ]
+  system-packages-doc:
+    command: bin/run
+    plugs: [ system-packages-doc ]
+  system-source-code:
+    command: bin/run
+    plugs: [ system-source-code ]
   hostname-control:
     command: bin/run
     plugs: [ hostname-control ]
+  hugepages-control:
+    command: bin/run
+    plugs: [ hugepages-control ]
   intel-mei:
     command: bin/run
     plugs: [ intel-mei ]
@@ -176,6 +203,9 @@
   juju-client-observe:
     command: bin/run
     plugs: [ juju-client-observe ]
+  kernel-crypto-api:
+    command: bin/run
+    plugs: [ kernel-crypto-api ]
   kernel-module-control:
     command: bin/run
     plugs: [ kernel-module-control ]
@@ -218,6 +248,9 @@
   maliit:
     command: bin/run
     plugs: [ maliit ]
+  media-control:
+    command: bin/run
+    plugs: [ media-control ]
   media-hub:
     command: bin/run
     plugs: [ media-hub ]
@@ -308,9 +341,15 @@
   process-control:
     command: bin/run
     plugs: [ process-control ]
+  ptp:
+    command: bin/run
+    plugs: [ ptp ]
   pulseaudio:
     command: bin/run
     plugs: [ pulseaudio ]
+  raw-input:
+    command: bin/run
+    plugs: [ raw-input ]
   raw-usb:
     command: bin/run
     plugs: [ raw-usb ]
@@ -338,6 +377,9 @@
   can-bus:
     command: bin/run
     plugs: [ can-bus ]
+  sd-control:
+    command: bin/run
+    plugs: [ sd-control ]
   ssh-keys:
     command: bin/run
     plugs: [ ssh-keys ]
@@ -359,6 +401,9 @@
   dummy:
     command: bin/run
     plugs: [ dummy ]
+  tee:
+    command: bin/run
+    plugs: [ tee ]
   thumbnailer-service:
     command: bin/run
     plugs: [ thumbnailer-service ]
@@ -386,6 +431,9 @@
   uhid:
     command: bin/run
     plugs: [ uhid ]
+  uinput:
+    command: bin/run
+    plugs: [ uinput ]
   uio:
     command: bin/run
     plugs: [ uio ]
@@ -404,6 +452,9 @@
   upower-observe:
     command: bin/run
     plugs: [ upower-observe ]
+  vcio:
+    command: bin/run
+    plugs: [ vcio ]
   wayland:
     command: bin/run
     plugs: [ wayland ]
@@ -437,3 +488,6 @@
     write: [$HOME/dir1]
   dummy:
     interface: dummy
+  sd-control:
+    interface: sd-control
+    flavor: dual-sd
 
=== modified file 'policy-app/test-snapd-policy-app-provider-core/meta/snap.yaml'
--- policy-app/test-snapd-policy-app-provider-core/meta/snap.yaml	2020-03-18 18:33:59 +0000
+++ policy-app/test-snapd-policy-app-provider-core/meta/snap.yaml	2021-08-25 03:55:24 +0000
@@ -15,6 +15,8 @@
     content: test-content
     read:
     - $SNAP/content
+  cups: null
+  cups-control: null
   dbus-session:
     interface: dbus
     bus: session
@@ -67,6 +69,12 @@
   content-read:
     command: bin/run
     slots: [ content-read ]
+  cups:
+    command: bin/run
+    slots: [ cups ]
+  cups-control:
+    command: bin/run
+    slots: [ cups-control ]
   dbus-session:
     command: bin/run
     slots: [ dbus-session ]