Merge ~sylvain-pineau/checkbox-ng:fix-CVE-2021-44731 into checkbox-ng:master

[Sylvain Pineau]

CVE-2021-44731 adjustments in checkbox.

The systemd service unit responsible to start the `checkbox-cli service` command now runs outside confinement but still provide SNAP and SNAP_DATA env var.

The logic to establish which restart strategy to adopt must change. the deb restart strategy must be evaluated first since the new service unit will be named as for debs.

Doing so will prevent the use of the on_ubuntucore() method (which selects a strategy assuming a real snap runtime).

[Sylvain Pineau (sylvain-pineau)]

self-approved

review: Approve

diff --git a/plainbox/impl/session/restart.py b/plainbox/impl/session/restart.py
index b3c72cd..2cc9c8b 100644
--- a/plainbox/impl/session/restart.py
+++ b/plainbox/impl/session/restart.py
@@ -269,6 +269,16 @@ def detect_restart_strategy(session=None) -> IRestartStrategy:
     :raises LookupError:
         When no such object can be found.
     """
+    # debian and unconfined checkbox-ng.service
+    if session_type == "checkbox-slave":
+        try:
+            subprocess.run(
+                ['systemctl', 'is-active', '--quiet', 'checkbox-ng.service'],
+                check=True)
+            return RemoteDebRestartStrategy()
+        except subprocess.CalledProcessError:
+                pass
+
     # XXX: RemoteSnappyRestartStrategy debug
     remote_restart_stragegy_debug = os.getenv('REMOTE_RESTART_DEBUG')
     if remote_restart_stragegy_debug:
@@ -313,16 +323,6 @@ def detect_restart_strategy(session=None) -> IRestartStrategy:
         else:
             return SnappyRestartStrategy()
 
-    # debian checkbox-ng.service
-    if session_type == "checkbox-slave":
-        try:
-            subprocess.run(
-                ['systemctl', 'is-active', '--quiet', 'checkbox-ng.service'],
-                check=True)
-            return RemoteDebRestartStrategy()
-        except subprocess.CalledProcessError:
-                pass
-
     if os.path.isdir('/etc/xdg/autostart'):
         # NOTE: Assume this is a terminal application
         return XDGRestartStrategy(app_terminal=True)