{"action":"created","comment":{"url":"https://api.github.com/repos/snapcore/snap-confine/pulls/comments/69090812","id":69090812,"diff_hunk":"@@ -0,0 +1,117 @@\n+==============\n+ snap-confine\n+==============\n+\n+-----------------------------------------------\n+internal tool for confining snappy applications\n+-----------------------------------------------\n+\n+:Author: zygmunt.krynicki@canonical.com\n+:Date:   2016-06-27\n+:Copyright: Canonical Ltd.\n+:Version: 1.0.33\n+:Manual section: 5\n+:Manual group: snappy\n+\n+SYNOPSIS\n+========\n+\n+\tsnap-confine SECURITY_TAG COMMAND [...ARGUMENTS]\n+\n+DESCRIPTION\n+===========\n+\n+The `snap-confine` is a program used internally by `snapd` to construct a\n+confined execution environment for snap applications.\n+\n+OPTIONS\n+=======\n+\n+The `snap-confine` program does not support any options.\n+\n+FEATURES\n+========\n+\n+Apparmor profiles\n+-----------------\n+\n+`snap-confine` switches to the apparmor profile `$SECURITY_TAG`. The profile is\n+**mandatory** and `snap-confine` will refuse to run without it.\n+\n+has to be loaded into the kernel prior to using `snap-confine`. Typically this\n+is arranged for by `snapd`. The profile contains rich description of what the\n+application process is allowed to do, this includes system calls, file paths,\n+access patterns, linux capabilities, etc. The apparmor profile can also do\n+extensive dbus mediation. Refer to apparmor documentation for more details.\n+\n+Seccomp profiles\n+----------------\n+\n+`snap-confine` looks for the `/var/lib/snapd/seccomp/profiles/$SECURITY_TAG`\n+file. This file is **mandatory** and `snap-confine` will refuse to run without\n+it.\n+\n+The file is read and parsed using a custom syntax that describes the set of\n+allowed system calls and optionally their arguments. The profile is then used\n+to confine the started application. \n+\n+As a security precaution disallowed system calls cause the started application\n+executable to be killed by the kernel. In the future this restriction may be\n+lifted to return `EPERM` instead.\n+\n+Mount profiles\n+--------------\n+\n+`snap-confine` looks for the `/var/lib/snapd/mount/$SECURITY_TAG.fstab` file.\n+If present it is read, parsed and treated like a typical `fstab(5)` file.\n+The mount directives listed there are executed in order. All directives must\n+succeed as any failure will abort execution.\n+\n+By default all mount entries start with the following flags: `bind`, `ro`,\n+`nodev`, `nosuid`.  Some of those flags can be reversed by an appropriate\n+option (e.g. `rw` can cause the mount point to be writable).\n+\n+As a security precaution only `bind` mounts are supported at this time.\n+\n+ENVIRONMENT\n+===========\n+\n+`snap-confine` responds to the following environment variables\n+\n+`UBUNTU_CORE_LAUNCHER_DEBUG`:\n+\tWhen defined the program will print additional diagnostic information about\n+\tthe actions being performed. All the output goes to stderr.\n+\n+The following variables are only used when `snap-confine` is not setuid root.\n+This is only applicable when testing the program itself.\n+\n+`SNAPPY_LAUNCHER_INSIDE_TESTS`:","path":"docs/snap-confine.rst","position":88,"original_position":88,"commit_id":"a4a551a50594c9fd4d7a94985ff1931b981e0a27","original_commit_id":"a4a551a50594c9fd4d7a94985ff1931b981e0a27","user":{"login":"mvo5","id":914418,"avatar_url":"https://avatars.githubusercontent.com/u/914418?v=3","gravatar_id":"","url":"https://api.github.com/users/mvo5","html_url":"https://github.com/mvo5","followers_url":"https://api.github.com/users/mvo5/followers","following_url":"https://api.github.com/users/mvo5/following{/other_user}","gists_url":"https://api.github.com/users/mvo5/gists{/gist_id}","starred_url":"https://api.github.com/users/mvo5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mvo5/subscriptions","organizations_url":"https://api.github.com/users/mvo5/orgs","repos_url":"https://api.github.com/users/mvo5/repos","events_url":"https://api.github.com/users/mvo5/events{/privacy}","received_events_url":"https://api.github.com/users/mvo5/received_events","type":"User","site_admin":false},"body":"Maybe we should just not mention those? WIth the new (very nice) unittest work we may kill them in the future I guess?","created_at":"2016-06-30T08:19:19Z","updated_at":"2016-06-30T08:19:19Z","html_url":"https://github.com/snapcore/snap-confine/pull/52#discussion_r69090812","pull_request_url":"https://api.github.com/repos/snapcore/snap-confine/pulls/52","_links":{"self":{"href":"https://api.github.com/repos/snapcore/snap-confine/pulls/comments/69090812"},"html":{"href":"https://github.com/snapcore/snap-confine/pull/52#discussion_r69090812"},"pull_request":{"href":"https://api.github.com/repos/snapcore/snap-confine/pulls/52"}}},"pull_request":{"url":"https://api.github.com/repos/snapcore/snap-confine/pulls/52","id":75433693,"html_url":"https://github.com/snapcore/snap-confine/pull/52","diff_url":"https://github.com/snapcore/snap-confine/pull/52.diff","patch_url":"https://github.com/snapcore/snap-confine/pull/52.patch","issue_url":"https://api.github.com/repos/snapcore/snap-confine/issues/52","number":52,"state":"open","locked":false,"title":"Add a manual page for snap-confine","user":{"login":"zyga","id":784262,"avatar_url":"https://avatars.githubusercontent.com/u/784262?v=3","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"body":"While snap-confine is not typically exposed on PATH, having a manual\r\npage will help to demystify some of the things happening inside.\r\n\r\nI plan to land this small version an then expand it with more details\r\nabout how the execution environment looks like.\r\n\r\nSigned-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>","created_at":"2016-06-28T08:00:44Z","updated_at":"2016-06-30T08:19:19Z","closed_at":null,"merged_at":null,"merge_commit_sha":"b4846e983511b79b0afe59caaf3803812c7d4c56","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/snapcore/snap-confine/pulls/52/commits","review_comments_url":"https://api.github.com/repos/snapcore/snap-confine/pulls/52/comments","review_comment_url":"https://api.github.com/repos/snapcore/snap-confine/pulls/comments{/number}","comments_url":"https://api.github.com/repos/snapcore/snap-confine/issues/52/comments","statuses_url":"https://api.github.com/repos/snapcore/snap-confine/statuses/a4a551a50594c9fd4d7a94985ff1931b981e0a27","head":{"label":"snapcore:docs","ref":"docs","sha":"a4a551a50594c9fd4d7a94985ff1931b981e0a27","user":{"login":"snapcore","id":19532717,"avatar_url":"https://avatars.githubusercontent.com/u/19532717?v=3","gravatar_id":"","url":"https://api.github.com/users/snapcore","html_url":"https://github.com/snapcore","followers_url":"https://api.github.com/users/snapcore/followers","following_url":"https://api.github.com/users/snapcore/following{/other_user}","gists_url":"https://api.github.com/users/snapcore/gists{/gist_id}","starred_url":"https://api.github.com/users/snapcore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snapcore/subscriptions","organizations_url":"https://api.github.com/users/snapcore/orgs","repos_url":"https://api.github.com/users/snapcore/repos","events_url":"https://api.github.com/users/snapcore/events{/privacy}","received_events_url":"https://api.github.com/users/snapcore/received_events","type":"Organization","site_admin":false},"repo":{"id":59485230,"name":"snap-confine","full_name":"snapcore/snap-confine","owner":{"login":"snapcore","id":19532717,"avatar_url":"https://avatars.githubusercontent.com/u/19532717?v=3","gravatar_id":"","url":"https://api.github.com/users/snapcore","html_url":"https://github.com/snapcore","followers_url":"https://api.github.com/users/snapcore/followers","following_url":"https://api.github.com/users/snapcore/following{/other_user}","gists_url":"https://api.github.com/users/snapcore/gists{/gist_id}","starred_url":"https://api.github.com/users/snapcore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snapcore/subscriptions","organizations_url":"https://api.github.com/users/snapcore/orgs","repos_url":"https://api.github.com/users/snapcore/repos","events_url":"https://api.github.com/users/snapcore/events{/privacy}","received_events_url":"https://api.github.com/users/snapcore/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/snapcore/snap-confine","description":"Runner for snaps","fork":false,"url":"https://api.github.com/repos/snapcore/snap-confine","forks_url":"https://api.github.com/repos/snapcore/snap-confine/forks","keys_url":"https://api.github.com/repos/snapcore/snap-confine/keys{/key_id}","collaborators_url":"https://api.github.com/repos/snapcore/snap-confine/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/snapcore/snap-confine/teams","hooks_url":"https://api.github.com/repos/snapcore/snap-confine/hooks","issue_events_url":"https://api.github.com/repos/snapcore/snap-confine/issues/events{/number}","events_url":"https://api.github.com/repos/snapcore/snap-confine/events","assignees_url":"https://api.github.com/repos/snapcore/snap-confine/assignees{/user}","branches_url":"https://api.github.com/repos/snapcore/snap-confine/branches{/branch}","tags_url":"https://api.github.com/repos/snapcore/snap-confine/tags","blobs_url":"https://api.github.com/repos/snapcore/snap-confine/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/snapcore/snap-confine/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/snapcore/snap-confine/git/refs{/sha}","trees_url":"https://api.github.com/repos/snapcore/snap-confine/git/trees{/sha}","statuses_url":"https://api.github.com/repos/snapcore/snap-confine/statuses/{sha}","languages_url":"https://api.github.com/repos/snapcore/snap-confine/languages","stargazers_url":"https://api.github.com/repos/snapcore/snap-confine/stargazers","contributors_url":"https://api.github.com/repos/snapcore/snap-confine/contributors","subscribers_url":"https://api.github.com/repos/snapcore/snap-confine/subscribers","subscription_url":"https://api.github.com/repos/snapcore/snap-confine/subscription","commits_url":"https://api.github.com/repos/snapcore/snap-confine/commits{/sha}","git_commits_url":"https://api.github.com/repos/snapcore/snap-confine/git/commits{/sha}","comments_url":"https://api.github.com/repos/snapcore/snap-confine/comments{/number}","issue_comment_url":"https://api.github.com/repos/snapcore/snap-confine/issues/comments{/number}","contents_url":"https://api.github.com/repos/snapcore/snap-confine/contents/{+path}","compare_url":"https://api.github.com/repos/snapcore/snap-confine/compare/{base}...{head}","merges_url":"https://api.github.com/repos/snapcore/snap-confine/merges","archive_url":"https://api.github.com/repos/snapcore/snap-confine/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/snapcore/snap-confine/downloads","issues_url":"https://api.github.com/repos/snapcore/snap-confine/issues{/number}","pulls_url":"https://api.github.com/repos/snapcore/snap-confine/pulls{/number}","milestones_url":"https://api.github.com/repos/snapcore/snap-confine/milestones{/number}","notifications_url":"https://api.github.com/repos/snapcore/snap-confine/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/snapcore/snap-confine/labels{/name}","releases_url":"https://api.github.com/repos/snapcore/snap-confine/releases{/id}","deployments_url":"https://api.github.com/repos/snapcore/snap-confine/deployments","created_at":"2016-05-23T13:29:44Z","updated_at":"2016-06-16T02:13:49Z","pushed_at":"2016-06-30T08:02:10Z","git_url":"git://github.com/snapcore/snap-confine.git","ssh_url":"git@github.com:snapcore/snap-confine.git","clone_url":"https://github.com/snapcore/snap-confine.git","svn_url":"https://github.com/snapcore/snap-confine","homepage":"","size":750,"stargazers_count":1,"watchers_count":1,"language":"C","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":7,"mirror_url":null,"open_issues_count":3,"forks":7,"open_issues":3,"watchers":1,"default_branch":"master"}},"base":{"label":"snapcore:master","ref":"master","sha":"e75ad09bc46f8b80706b4ccbd36ab44d83605085","user":{"login":"snapcore","id":19532717,"avatar_url":"https://avatars.githubusercontent.com/u/19532717?v=3","gravatar_id":"","url":"https://api.github.com/users/snapcore","html_url":"https://github.com/snapcore","followers_url":"https://api.github.com/users/snapcore/followers","following_url":"https://api.github.com/users/snapcore/following{/other_user}","gists_url":"https://api.github.com/users/snapcore/gists{/gist_id}","starred_url":"https://api.github.com/users/snapcore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snapcore/subscriptions","organizations_url":"https://api.github.com/users/snapcore/orgs","repos_url":"https://api.github.com/users/snapcore/repos","events_url":"https://api.github.com/users/snapcore/events{/privacy}","received_events_url":"https://api.github.com/users/snapcore/received_events","type":"Organization","site_admin":false},"repo":{"id":59485230,"name":"snap-confine","full_name":"snapcore/snap-confine","owner":{"login":"snapcore","id":19532717,"avatar_url":"https://avatars.githubusercontent.com/u/19532717?v=3","gravatar_id":"","url":"https://api.github.com/users/snapcore","html_url":"https://github.com/snapcore","followers_url":"https://api.github.com/users/snapcore/followers","following_url":"https://api.github.com/users/snapcore/following{/other_user}","gists_url":"https://api.github.com/users/snapcore/gists{/gist_id}","starred_url":"https://api.github.com/users/snapcore/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snapcore/subscriptions","organizations_url":"https://api.github.com/users/snapcore/orgs","repos_url":"https://api.github.com/users/snapcore/repos","events_url":"https://api.github.com/users/snapcore/events{/privacy}","received_events_url":"https://api.github.com/users/snapcore/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/snapcore/snap-confine","description":"Runner for snaps","fork":false,"url":"https://api.github.com/repos/snapcore/snap-confine","forks_url":"https://api.github.com/repos/snapcore/snap-confine/forks","keys_url":"https://api.github.com/repos/snapcore/snap-confine/keys{/key_id}","collaborators_url":"https://api.github.com/repos/snapcore/snap-confine/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/snapcore/snap-confine/teams","hooks_url":"https://api.github.com/repos/snapcore/snap-confine/hooks","issue_events_url":"https://api.github.com/repos/snapcore/snap-confine/issues/events{/number}","events_url":"https://api.github.com/repos/snapcore/snap-confine/events","assignees_url":"https://api.github.com/repos/snapcore/snap-confine/assignees{/user}","branches_url":"https://api.github.com/repos/snapcore/snap-confine/branches{/branch}","tags_url":"https://api.github.com/repos/snapcore/snap-confine/tags","blobs_url":"https://api.github.com/repos/snapcore/snap-confine/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/snapcore/snap-confine/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/snapcore/snap-confine/git/refs{/sha}","trees_url":"https://api.github.com/repos/snapcore/snap-confine/git/trees{/sha}","statuses_url":"https://api.github.com/repos/snapcore/snap-confine/statuses/{sha}","languages_url":"https://api.github.com/repos/snapcore/snap-confine/languages","stargazers_url":"https://api.github.com/repos/snapcore/snap-confine/stargazers","contributors_url":"https://api.github.com/repos/snapcore/snap-confine/contributors","subscribers_url":"https://api.github.com/repos/snapcore/snap-confine/subscribers","subscription_url":"https://api.github.com/repos/snapcore/snap-confine/subscription","commits_url":"https://api.github.com/repos/snapcore/snap-confine/commits{/sha}","git_commits_url":"https://api.github.com/repos/snapcore/snap-confine/git/commits{/sha}","comments_url":"https://api.github.com/repos/snapcore/snap-confine/comments{/number}","issue_comment_url":"https://api.github.com/repos/snapcore/snap-confine/issues/comments{/number}","contents_url":"https://api.github.com/repos/snapcore/snap-confine/contents/{+path}","compare_url":"https://api.github.com/repos/snapcore/snap-confine/compare/{base}...{head}","merges_url":"https://api.github.com/repos/snapcore/snap-confine/merges","archive_url":"https://api.github.com/repos/snapcore/snap-confine/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/snapcore/snap-confine/downloads","issues_url":"https://api.github.com/repos/snapcore/snap-confine/issues{/number}","pulls_url":"https://api.github.com/repos/snapcore/snap-confine/pulls{/number}","milestones_url":"https://api.github.com/repos/snapcore/snap-confine/milestones{/number}","notifications_url":"https://api.github.com/repos/snapcore/snap-confine/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/snapcore/snap-confine/labels{/name}","releases_url":"https://api.github.com/repos/snapcore/snap-confine/releases{/id}","deployments_url":"https://api.github.com/repos/snapcore/snap-confine/deployments","created_at":"2016-05-23T13:29:44Z","updated_at":"2016-06-16T02:13:49Z","pushed_at":"2016-06-30T08:02:10Z","git_url":"git://github.com/snapcore/snap-confine.git","ssh_url":"git@github.com:snapcore/snap-confine.git","clone_url":"https://github.com/snapcore/snap-confine.git","svn_url":"https://github.com/snapcore/snap-confine","homepage":"","size":750,"stargazers_count":1,"watchers_count":1,"language":"C","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":7,"mirror_url":null,"open_issues_count":3,"forks":7,"open_issues":3,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/snapcore/snap-confine/pulls/52"},"html":{"href":"https://github.com/snapcore/snap-confine/pull/52"},"issue":{"href":"https://api.github.com/repos/snapcore/snap-confine/issues/52"},"comments":{"href":"https://api.github.com/repos/snapcore/snap-confine/issues/52/comments"},"review_comments":{"href":"https://api.github.com/repos/snapcore/snap-confine/pulls/52/comments"},"review_comment":{"href":"https://api.github.com/repos/snapcore/snap-confine/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/snapcore/snap-confine/pulls/52/commits"},"statuses":{"href":"https://api.github.com/repos/snapcore/snap-confine/statuses/a4a551a50594c9fd4d7a94985ff1931b981e0a27"}}}}
{"actor":{"display_login":"mvo5"}}