o/hookstate/ctlcmd: add optional --pid and --apparmor-label arguments to "snapctl is-connected" #9132

jhenstridge · 2020-08-11T09:21:16Z

This PR is an implementation of @pedronis's snapctl is-connected --pid proposal described in this forum thread:

https://forum.snapcraft.io/t/autoconnect-requests-for-pulseaudio/18926/3?u=jamesh

Unlike regular snapctl is-connected, the --pid option only considers connections with the snap identified by the given process ID, as identified by cgroup.SnapNameFromPid. The intention is to allow a snap daemon using local sockets check that the peer it is talking to has connected a given interface.

For example, a Pulse Audio snap may provide audio-record and audio-playback slots whose connection grant access to the daemon's socket. The daemon can issue a snapctl is-connected --pid $pid audio-record to determine whether a particular client has been granted access to the microphone.

In addition to the normal 0/1 exit codes, the command may also return the following:

10: process ID does not refer to a snap
11: plug/slot is not connected, and process ID refers to a classic confined snap.

These both look like "false" to the shell, but can be used by services that want to communicate with host system processes or classic snaps.

There is a placeholder function to check whether to allow the feature to be used with a particular plug/slot. At present, it hard codes it to allow use on slots of interface cups-control, pulseaudio, or audio-record.

tillkamppeter · 2020-08-11T09:55:38Z

CUPS is supposed to allow access from any non-snapped process and any classic-mode-snapped process in addition to standard-snapped processes plugging to "cups-control", so either the mentioned command should return "true" in all these cases or have special answers for non-snapped and classic-mode-snapped processes.

tillkamppeter · 2020-08-11T10:06:34Z

Is it also possible for CUPS to do this with an API call or only by calling this command line tool?

jhenstridge · 2020-08-12T02:07:05Z

CUPS is supposed to allow access from any non-snapped process and any classic-mode-snapped process in addition to standard-snapped processes plugging to "cups-control"

Good point about classic confinement snaps. I agree that for the Pulse Audio and CUPS use cases it would make sense to treat classic snaps like unconfined processes. It does muddy things a bit though, since classic snaps can have plugs and slots.

Is it also possible for CUPS to do this with an API call or only by calling this command line tool?

Yes. The snapd-glib library includes a snapd_client_run_snapctl_sync method. You'd probably need to call snapd_client_set_socket_path first to have the SnapdClient talk to /run/snapd-snap.socket instead of /run/snapd.socket though.

Since you'd be dealing with only a process ID, this would remove the need for determining and parsing the AppArmor label of the peer too.

zyga

Technically this looks correct and feels nice.

I left some comments. Please ping for a full review when not a draft.

overlord/hookstate/ctlcmd/is_connected.go

snap, or pid is a classic snap.

zyga

Quick pass through the spread test (my favourite part of snapd patches)

tests/main/snapctl-is-connected-pid/task.yaml

tillkamppeter · 2020-09-10T14:43:25Z

@jhenstridge, anything still missing to drop the "Draft" status? I am waiting for this to get in, so that the CUPs Snap can finally get into the Snap Store.

…--pid feature

jhenstridge · 2020-09-15T11:15:10Z

I've flipped the PR over to ready for review. I added a check to restrict the feature to one of a few slot types. That check probably should be changed a bit or moved to a more appropriate location, but I'm not sure where exactly.

pedronis · 2020-09-16T18:35:27Z

@jhenstridge I looked at this and spent some time thinking, let's chat about it

…ted-pid

…argument

overlord/hookstate/ctlcmd/is_connected.go

alexmurray · 2021-01-11T08:03:10Z

This looks good to me from a security point of view, there are comprehensive tests and the implementation looks solid. Just waiting to follow up on Samuele's question above before signing off on this with security review.

…ted-pid

alexmurray · 2021-01-13T04:42:48Z

Security review done as per the previous comments / discussion 👍

pedronis

thanks, a couple of comments/questions

overlord/hookstate/ctlcmd/is_connected.go

pedronis

@jhenstridge I answered to your last replies making some suggestions

@pedronis

…switch order as suggested by @pedronis

anonymouse64

a couple terminology changes to use more inclusive language, but other than that lgtm, thanks for working on this

overlord/hookstate/ctlcmd/is_connected_test.go

…4.04 These tests rely on the ability to identify the snap a process ID belongs to, which means either (a) the systemd or unified cgroup name includes the snap name, or (b) the freezer cgroup includes the snap name. On Ubuntu 14.04, processes are not tracked via systemd so (a) fails. And snap-confine does not add classic confined processes to a freezer cgroup, so (b) fails as well. We're still runing the parts of the test that deal with strict confined snaps, since that functions correctly on 14.04.

jhenstridge force-pushed the snapctl-is-connected-pid branch from d972a2b to 9e06d76 Compare August 12, 2020 01:51

jhenstridge force-pushed the snapctl-is-connected-pid branch from 9e06d76 to 2c2e8e2 Compare August 12, 2020 03:28

jhenstridge mentioned this pull request Aug 17, 2020

o/hookstate/ctlcmd: make is-connected check whether the plug or slot exists #9168

Merged

jhenstridge force-pushed the snapctl-is-connected-pid branch from 2c2e8e2 to ee670df Compare August 20, 2020 09:08

zyga reviewed Aug 24, 2020

View reviewed changes

overlord/hookstate/ctlcmd/is_connected.go Outdated Show resolved Hide resolved

overlord/hookstate/ctlcmd/is_connected.go Outdated Show resolved Hide resolved

jhenstridge added 3 commits August 27, 2020 11:31

o/hookstate/ctlcmd: add a --pid option to is-connected

7be93ca

tests: add a test for snapctl is-connected --pid

27c3ee6

o/hookstate/ctlcmd: add distinct exit codes for cases when pid is not a

260dff9

snap, or pid is a classic snap.

jhenstridge force-pushed the snapctl-is-connected-pid branch from ee670df to 260dff9 Compare August 27, 2020 05:10

tests: test special exit codes for "snapctl is-connected --pid"

f02503d

jhenstridge force-pushed the snapctl-is-connected-pid branch from 74e395e to f02503d Compare August 28, 2020 02:34

tests: fix up test for fedora/arch/centos

352e7de

zyga reviewed Aug 28, 2020

View reviewed changes

tests: spread test cleanups suggested by @zyga

f10bd08

jhenstridge force-pushed the snapctl-is-connected-pid branch from 819ab76 to f10bd08 Compare August 28, 2020 07:26

pedronis self-requested a review September 3, 2020 08:30

pedronis added the Needs Samuele review Needs a review from Samuele before it can land label Sep 3, 2020

o/hookstate/ctlcmd: add a simple whitelist of allowed interfaces for …

0712f41

…--pid feature

jhenstridge marked this pull request as ready for review September 15, 2020 10:52

pedronis added Needs security review Can only be merged once security gave a :+1: ⛔ Blocked labels Sep 17, 2020

jhenstridge added 3 commits October 6, 2020 17:13

Merge remote-tracking branch 'upstream/master' into snapctl-is-connec…

6ffb292

…ted-pid

o/hookstate/ctlcmd: extend is-connected to handle a --apparmor-label …

6114ea4

…argument

tests: test that --apparmor-label option works

12f6264

jhenstridge changed the title ~~o/hookstate/ctlcmd: add optional --pid argument to "snapctl is-connected"~~ o/hookstate/ctlcmd: add optional --pid and --apparmor-label arguments to "snapctl is-connected" Oct 6, 2020

jhenstridge force-pushed the snapctl-is-connected-pid branch 2 times, most recently from d9f68cb to 722e2c3 Compare October 7, 2020 09:51

tests: fix shellcheck warning in test

d90122e

jhenstridge force-pushed the snapctl-is-connected-pid branch from 722e2c3 to d90122e Compare October 7, 2020 13:05

pedronis reviewed Nov 18, 2020

View reviewed changes

overlord/hookstate/ctlcmd/is_connected.go Show resolved Hide resolved

pedronis self-requested a review January 11, 2021 15:39

Merge remote-tracking branch 'upstream/master' into snapctl-is-connec…

854cbb6

…ted-pid

alexmurray removed the Needs security review Can only be merged once security gave a :+1: label Jan 13, 2021

anonymouse64 self-requested a review January 19, 2021 14:10

pedronis approved these changes Jan 26, 2021

View reviewed changes

overlord/hookstate/ctlcmd/is_connected.go Outdated Show resolved Hide resolved

overlord/hookstate/ctlcmd/is_connected.go Outdated Show resolved Hide resolved

pedronis removed the ⛔ Blocked label Jan 26, 2021

pedronis reviewed Jan 27, 2021

View reviewed changes

overlord/hookstate/ctlcmd/is_connected.go Show resolved Hide resolved

pedronis self-requested a review January 28, 2021 09:51

pedronis reviewed Jan 28, 2021

View reviewed changes

jhenstridge added 2 commits January 29, 2021 10:59

overlord/hookstate/ctlcmd: add constants for special exit codes, and …

0289f89

…switch order as suggested by @pedronis

overlord/hookstate/ctlcmd: improve documentation

f51b136

anonymouse64 approved these changes Feb 2, 2021

View reviewed changes

o/hookstate/ctlcmd: update comments to use more inclusive language

b318e51

jhenstridge force-pushed the snapctl-is-connected-pid branch from bfba67b to 90587ed Compare February 3, 2021 05:41

jhenstridge force-pushed the snapctl-is-connected-pid branch from 90587ed to f3c91c9 Compare February 3, 2021 08:33

jhenstridge merged commit 53e00c4 into canonical:master Feb 3, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

o/hookstate/ctlcmd: add optional --pid and --apparmor-label arguments to "snapctl is-connected" #9132

o/hookstate/ctlcmd: add optional --pid and --apparmor-label arguments to "snapctl is-connected" #9132

jhenstridge commented Aug 11, 2020 •

edited

Loading

tillkamppeter commented Aug 11, 2020

tillkamppeter commented Aug 11, 2020

jhenstridge commented Aug 12, 2020

zyga left a comment

zyga left a comment

tillkamppeter commented Sep 10, 2020

jhenstridge commented Sep 15, 2020

pedronis commented Sep 16, 2020

alexmurray commented Jan 11, 2021

alexmurray commented Jan 13, 2021

pedronis left a comment

pedronis left a comment

anonymouse64 left a comment

o/hookstate/ctlcmd: add optional --pid and --apparmor-label arguments to "snapctl is-connected" #9132

o/hookstate/ctlcmd: add optional --pid and --apparmor-label arguments to "snapctl is-connected" #9132

Conversation

jhenstridge commented Aug 11, 2020 • edited Loading

tillkamppeter commented Aug 11, 2020

tillkamppeter commented Aug 11, 2020

jhenstridge commented Aug 12, 2020

zyga left a comment

Choose a reason for hiding this comment

zyga left a comment

Choose a reason for hiding this comment

tillkamppeter commented Sep 10, 2020

jhenstridge commented Sep 15, 2020

pedronis commented Sep 16, 2020

alexmurray commented Jan 11, 2021

alexmurray commented Jan 13, 2021

pedronis left a comment

Choose a reason for hiding this comment

pedronis left a comment

Choose a reason for hiding this comment

anonymouse64 left a comment

Choose a reason for hiding this comment

jhenstridge commented Aug 11, 2020 •

edited

Loading