Merge lp:~jdstrand/snap-confine/ubuntu-core-launcher.complain-as-unrestricted into lp:~snappy-dev/snap-confine/trunk

[Jamie Strandboge]

 * implement @complain as a synonym for @unrestricted since snappy will use
   @complain to toggle developer mode. This allows snaps to work in developer
   mode while seccomp logging is being developed

[lp:~jdstrand/snap-confine/ubuntu-core-launcher.complain-as-unrestricted]

120. By Jamie Strandboge on 2016-04-13

merge from trunk

[Tyler Hicks (tyhicks)]

Looks good to me.

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2016-04-11 23:10:23 +0000
+++ debian/changelog	2016-04-13 21:44:22 +0000
@@ -1,3 +1,11 @@
+ubuntu-core-launcher (1.0.24) UNRELEASED; urgency=medium
+
+  * implement @complain as a synonym for @unrestricted since snappy will use
+    @complain to toggle developer mode. This allows snaps to work in developer
+    mode while seccomp logging is being developed
+
+ -- Jamie Strandboge <[e-mail]>  Wed, 13 Apr 2016 16:13:20 -0500
+
 ubuntu-core-launcher (1.0.23) xenial; urgency=medium
 
   [ Jamie Strandboge ]

=== modified file 'src/seccomp.c'
--- src/seccomp.c	2016-04-11 23:10:01 +0000
+++ src/seccomp.c	2016-04-13 21:44:22 +0000
@@ -37,6 +37,7 @@
 
 struct preprocess {
 	bool unrestricted;
+	bool complain;
 };
 
 // strip whitespace from the end of the given string (inplace)
@@ -83,6 +84,7 @@
 	size_t lineno = 0;
 
 	p->unrestricted = false;
+	p->complain = false;
 
 	while (fgets(buf, sizeof(buf), f) != NULL) {
 		lineno++;
@@ -95,6 +97,10 @@
 		// seccomp sandbox
 		if (strcmp(buf, "@unrestricted") == 0)
 			p->unrestricted = true;
+
+		// check for special "@complain" rule
+		if (strcmp(buf, "@complain") == 0)
+			p->complain = true;
 	}
 
 	if (fseek(f, 0L, SEEK_SET) != 0)
@@ -164,6 +170,11 @@
 	if (pre.unrestricted)
 		goto out;
 
+	// FIXME: right now complain mode is the equivalent to unrestricted.
+	// We'll want to change this once we seccomp logging is in order.
+	if (pre.complain)
+		goto out;
+
 	char buf[SC_MAX_LINE_LENGTH];
 	while (fgets(buf, sizeof(buf), f) != NULL) {
 		lineno++;

=== added file 'tests/test_complain'
--- tests/test_complain	1970-01-01 00:00:00 +0000
+++ tests/test_complain	2016-04-13 21:44:22 +0000
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+set -e
+
+. $(pwd)/common.sh
+
+cat >$TMP/myprofile <<EOF
+# some comment
+@complain
+EOF
+
+printf "Test that the @complain keyword works"
+if $L appid myprofile /bin/ls / >/dev/null; then
+    PASS
+else
+    FAIL
+fi

=== added file 'tests/test_complain_missed'
--- tests/test_complain_missed	1970-01-01 00:00:00 +0000
+++ tests/test_complain_missed	2016-04-13 21:44:22 +0000
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+set -e
+
+. $(pwd)/common.sh
+
+cat >$TMP/myprofile <<EOF
+# super strict filter
+@complai
+@complaim
+@omplain
+@COMPLAIN
+complain
+EOF
+
+# ensure that the command "true" can not run due to impossible
+# filtering
+
+printf "Test that near misses of complain fail"
+if $L appid myprofile /bin/true 2>/dev/null; then
+    # true returned successfully, our filtering is broken!
+    FAIL
+else
+    # true returend a error code, check dmesg
+    if dmesg|tail -n1|grep -q "audit"; then
+        PASS
+    else
+        FAIL
+    fi
+fi