Merge lp:~sergiusens/snappy/seccomp into lp:~snappy-dev/snappy/snappy-moved-to-github

[Sergio Schvezov]

Provide a more specific error than '%f is a directory' when missing a seccomp entry

[lp:~sergiusens/snappy/seccomp]

519. By Sergio Schvezov on 2015-06-24

Provide a more specific error than '%f is a directory' when missing a seccomp entry

[John Lenton (chipaca)]

review: Approve

=== modified file 'snappy/errors.go'
--- snappy/errors.go	2015-06-04 22:21:51 +0000
+++ snappy/errors.go	2015-06-24 17:05:42 +0000
@@ -140,6 +140,8 @@
 
 	// ErrInvalidSeccompPolicy is returned when policy-version and policy-vender are not set together
 	ErrInvalidSeccompPolicy = errors.New("policy-version and policy-vendor must be specified together")
+	// ErrNoSeccompPolicy is returned when an expected seccomp policy is not provided.
+	ErrNoSeccompPolicy = errors.New("no seccomp policy provided")
 )
 
 // ErrArchitectureNotSupported is returned when trying to install a snappy package that

=== modified file 'snappy/security.go'
--- snappy/security.go	2015-06-02 16:31:01 +0000
+++ snappy/security.go	2015-06-24 17:05:42 +0000
@@ -151,6 +151,11 @@
 	syscalls := []string{}
 
 	if sd.SecurityOverride != nil {
+		if sd.SecurityOverride.Seccomp == "" {
+			logger.Noticef("No seccomp policy found")
+			return nil, ErrNoSeccompPolicy
+		}
+
 		fn := filepath.Join(baseDir, sd.SecurityOverride.Seccomp)
 		var s securitySeccompOverride
 		err := readSeccompOverride(fn, &s)

=== modified file 'snappy/security_test.go'
--- snappy/security_test.go	2015-06-08 16:26:25 +0000
+++ snappy/security_test.go	2015-06-24 17:05:42 +0000
@@ -58,6 +58,13 @@
 	c.Assert(string(content), Equals, expected)
 }
 
+func (a *SecurityTestSuite) TestSnappyNoSeccompOverrideEntry(c *C) {
+	sd := SecurityDefinitions{SecurityOverride: &SecurityOverrideDefinition{}}
+
+	_, err := generateSeccompPolicy(c.MkDir(), "appName", sd)
+	c.Assert(err, Equals, ErrNoSeccompPolicy)
+}
+
 // no special security settings generate the default
 func (a *SecurityTestSuite) TestSnappyHandleApparmorSecurityDefault(c *C) {
 	sec := &SecurityDefinitions{}