Merge ~morphis/snappy-hwe-snaps/+git/network-manager:f/add-firewall-control-iface into ~snappy-hwe-team/snappy-hwe-snaps/+git/network-manager:master

[Simon Fels]

Add firewall-control interface to allow NetworkManager accessing the iptables binary from the core snap to modify the system iptables configuration

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:4036095b846ab48d52b13ebeab4df52954604682
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1322/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/511
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1230/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/1153
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-cleanup-snap/168

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1322/rebuild

review: Approve (continuous-integration)

[System Enablement Bot (system-enablement-ci-bot)]

FAILED: Continuous integration, rev:1b168b391c2b34cc67c7dd66772736107f4bbce4
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1324/
Executed test runs:
    FAILURE: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/513/console
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1231/console
    FAILURE: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/1154/console
    None: https://jenkins.canonical.com/system-enablement/job/generic-cleanup-snap/169/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1324/rebuild

review: Needs Fixing (continuous-integration)

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

LGTM

review: Approve

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:1b168b391c2b34cc67c7dd66772736107f4bbce4
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1325/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/514
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1232/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/1155
    None: https://jenkins.canonical.com/system-enablement/job/generic-cleanup-snap/170/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1325/rebuild

review: Approve (continuous-integration)

diff --git a/snapcraft.yaml b/snapcraft.yaml
index fc22731..9e0dcc3 100644
--- a/snapcraft.yaml
+++ b/snapcraft.yaml
@@ -31,7 +31,7 @@ apps:
     command: bin/networkmanager
     daemon: simple
     slots: [service]
-    plugs: [modem-manager, ppp, network-setup-observe, wpa]
+    plugs: [modem-manager, ppp, network-setup-observe, wpa, firewall-control]
     # FIXME: This will create currently a symlink inside /snap/bin
     # which points nowhere as the service isn't exposed as application
     # for the user. Instead snapd needs to gain support to handle
diff --git a/tests/lib/prepare.sh b/tests/lib/prepare.sh
index 57d24b5..12a76da 100644
--- a/tests/lib/prepare.sh
+++ b/tests/lib/prepare.sh
@@ -27,6 +27,9 @@ rm -f /home/network-manager/snapd-state.tar.gz
 rm -f /home/network-manager/nm-state.tar.gz
 
 snap_install network-manager
+# FIXME: Until the store snap-declaration is updated we need to connect
+# this plug manually.
+snap connect network-manager:firewall-control
 
 # Snapshot of the current snapd state for a later restore
 systemctl stop snapd.service snapd.socket
diff --git a/tests/lib/utilities.sh b/tests/lib/utilities.sh
index 8ca1418..14dbebb 100644
--- a/tests/lib/utilities.sh
+++ b/tests/lib/utilities.sh
@@ -59,4 +59,4 @@ mac_to_ipv6() {
   mac=${mac#*:*:}
   ipv6_address=$ipv6_address${mac%:*}${mac##*:}
   echo $ipv6_address
-}
\ No newline at end of file
+}
diff --git a/tests/main/can-exec-iptables/task.yaml b/tests/main/can-exec-iptables/task.yaml
new file mode 100644
index 0000000..878df5d
--- /dev/null
+++ b/tests/main/can-exec-iptables/task.yaml
@@ -0,0 +1,10 @@
+summary: Verify the NetworkManager snap is allowed to modify the iptables firewall configuration
+
+execute: |
+    # Running a simple command in the runtime environment of our service
+    # binary will tell us if we're allowed to execute the iptables binary
+    # from the core snap or not.
+    snap run --shell network-manager.networkmanager <<EOF
+    set -ex
+    /sbin/iptables -L
+    EOF
diff --git a/tests/main/installation/task.yaml b/tests/main/installation/task.yaml
index 2f1fe97..0dc8cf8 100644
--- a/tests/main/installation/task.yaml
+++ b/tests/main/installation/task.yaml
@@ -12,4 +12,6 @@ execute: |
     # Ensure all necessary plugs/slots are connected
     snap interfaces | grep -Pzq ":network-setup-observe +network-manager"
     snap interfaces | grep -Pzq ":ppp +network-manager"
+    snap interfaces | grep -Pzq ":firewall-control +network-manager"
+    snap interfaces | grep -Pzq ":network-setup-observe +network-manager"
     snap interfaces | grep -Pzq "network-manager:service +network-manager:nmcli"