{"action":"created","comment":{"url":"https://api.github.com/repos/ubuntu-core/snappy/pulls/comments/57722785","id":57722785,"diff_hunk":"@@ -0,0 +1,175 @@\n+// -*- Mode: Go; indent-tabs-mode: t -*-\n+\n+/*\n+ * Copyright (C) 2016 Canonical Ltd\n+ *\n+ * This program is free software: you can redistribute it and/or modify\n+ * it under the terms of the GNU General Public License version 3 as\n+ * published by the Free Software Foundation.\n+ *\n+ * This program is distributed in the hope that it will be useful,\n+ * but WITHOUT ANY WARRANTY; without even the implied warranty of\n+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n+ * GNU General Public License for more details.\n+ *\n+ * You should have received a copy of the GNU General Public License\n+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.\n+ *\n+ */\n+\n+// Package apparmor implements integration between snappy and\n+// ubuntu-core-launcher around apparmor.\n+//\n+// Snappy creates apparmor profiles for each application (for each snap)\n+// present in the system.  Upon each execution of ubuntu-core-launcher, the\n+// profile is attached to the running process. Prior to that the profile must\n+// be parsed, compiled and loaded into the kernel using the support tool\n+// \"apparmor_parser\".\n+//\n+// Each apparmor profile contains a simple <header><content><footer> structure.\n+// The header specified an identifier that is relevant to the kernel. The\n+// identifier can be either the full path of the executable or an abstract\n+// identifier not related to the executable name.\n+//\n+// The actual profiles are stored in /var/lib/snappy/apparmor/profiles.\n+// This directory is also hard-coded in ubuntu-core-launcher.\n+//\n+// NOTE: A systemd job (TODO: specify which) loads all snappy-specific apparmor\n+// profiles into the kernel during the boot process.\n+package apparmor\n+\n+import (\n+\t\"bytes\"\n+\t\"fmt\"\n+\t\"path/filepath\"\n+\n+\t\"github.com/ubuntu-core/snappy/dirs\"\n+\t\"github.com/ubuntu-core/snappy/interfaces\"\n+\t\"github.com/ubuntu-core/snappy/osutil\"\n+\t\"github.com/ubuntu-core/snappy/snap\"\n+)\n+\n+// Backend is responsible for maintaining apparmor profiles for ubuntu-core-launcher.\n+type Backend struct {\n+\t// Custom template exists to support old-security which goes\n+\t// beyond what is possible with pure security snippets.\n+\t//\n+\t// If non-empty then it overrides the built-in template.\n+\tCustomTemplate string\n+}\n+\n+// Configure creates and loads security artefacts specific to a given snap. The\n+// snap can be in developer mode to make security violations non-fatal to the\n+// offending application process.\n+//\n+// This method should be called after changing plug, slots, connections between\n+// them or application present in the snap.\n+func (b *Backend) Configure(snapInfo *snap.Info, repo *interfaces.Repository, developerMode bool) error {\n+\t// Get the snippets that apply to this snap\n+\tsnippets, err := repo.SecuritySnippetsForSnap(snapInfo.Name, b.SecuritySystem())\n+\tif err != nil {\n+\t\treturn fmt.Errorf(\"cannot obtain security snippets for snap %q: %s\", snapInfo.Name, err)\n+\t}\n+\t// Get the files that this snap should have\n+\tcontent, err := b.CombineSnippets(snapInfo, developerMode, snippets)\n+\tif err != nil {\n+\t\treturn fmt.Errorf(\"cannot obtain expected security files for snap %q: %s\", snapInfo.Name, err)\n+\t}\n+\tchanged, removed, err := osutil.EnsureDirState(b.Directory(), b.FileGlob(snapInfo), content)\n+\tif err != nil {\n+\t\treturn fmt.Errorf(\"cannot synchronize security files for snap %q: %s\", snapInfo.Name, err)\n+\t}\n+\terr = b.ObserveChanges(changed, removed)\n+\tif err != nil {\n+\t\treturn err\n+\t}\n+\treturn nil\n+}\n+\n+// Deconfigure removes security artefacts of a given snap.\n+func (b *Backend) Deconfigure(snapInfo *snap.Info) error {\n+\t_, removed, err := osutil.EnsureDirState(b.Directory(), b.FileGlob(snapInfo), nil)\n+\tif err != nil {\n+\t\treturn fmt.Errorf(\"cannot synchronize security files for snap %q: %s\", snapInfo.Name, err)\n+\t}\n+\terr = b.ObserveChanges(nil, removed)\n+\tif err != nil {\n+\t\treturn err\n+\t}\n+\treturn nil\n+}\n+\n+// CombineSnippets combines security snippets collected from all the interfaces\n+// affecting a given snap into a content map applicable to EnsureDirState. The\n+// backend delegates writing those files to higher layers.\n+func (b *Backend) CombineSnippets(snapInfo *snap.Info, developerMode bool, snippets map[string][][]byte) (content map[string]*osutil.FileState, err error) {\n+\tfor _, appInfo := range snapInfo.Apps {\n+\t\ts := make([][]byte, 0, len(snippets[appInfo.Name])+2)\n+\t\ts = append(s, b.aaHeader(appInfo, developerMode))\n+\t\ts = append(s, snippets[appInfo.Name]...)\n+\t\ts = append(s, []byte(\"}\\n\"))\n+\t\tfileContent := bytes.Join(s, []byte(\"\\n\"))\n+\t\tif content == nil {\n+\t\t\tcontent = make(map[string]*osutil.FileState)\n+\t\t}\n+\t\tcontent[b.FileName(appInfo)] = &osutil.FileState{\n+\t\t\tContent: fileContent,\n+\t\t\tMode:    0644,\n+\t\t}\n+\t}\n+\treturn content, nil\n+}\n+\n+// ObserveChanges informs the backend about changes made to the set of managed\n+// files by a higher layer.\n+//\n+// The backend may choose to react to those changes immediately or to buffer\n+// them until the higher layer signals that no more changes are coming by\n+// calling FinishChanges.\n+//\n+// Buffering the changes is desirable when a constant cost can be incurred\n+// regardless of the number of changes made.\n+func (b *Backend) ObserveChanges(changed, removed []string) error {\n+\t// Reload changed profiles\n+\tfor _, baseName := range changed {\n+\t\tfname := filepath.Join(b.Directory(), baseName)\n+\t\terr := LoadProfile(fname)\n+\t\tif err != nil {\n+\t\t\treturn fmt.Errorf(\"cannot load apparmor profile %q: %s\", baseName, err)\n+\t\t}\n+\t}\n+\t// Unload removed profiles\n+\tfor _, baseName := range removed {\n+\t\t// XXX: This depends on FileName() and ProfileName() returning the same\n+\t\t// value. This is true since both of those use SecurityTag().\n+\t\tprofile := Profile{Name: baseName}\n+\t\terr := profile.Unload()","path":"interfaces/apparmor/backend.go","position":146,"original_position":146,"commit_id":"0da90c82558705b3798258b71adf29cd127f1a4c","original_commit_id":"02a83d5e8d56c19192ffd15299b0c62406283962","user":{"login":"zyga","id":784262,"avatar_url":"https://avatars.githubusercontent.com/u/784262?v=3","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"body":"Agreed.","created_at":"2016-03-29T13:32:18Z","updated_at":"2016-03-29T13:32:18Z","html_url":"https://github.com/ubuntu-core/snappy/pull/744#discussion_r57722785","pull_request_url":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744","_links":{"self":{"href":"https://api.github.com/repos/ubuntu-core/snappy/pulls/comments/57722785"},"html":{"href":"https://github.com/ubuntu-core/snappy/pull/744#discussion_r57722785"},"pull_request":{"href":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744"}}},"pull_request":{"url":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744","id":64107785,"html_url":"https://github.com/ubuntu-core/snappy/pull/744","diff_url":"https://github.com/ubuntu-core/snappy/pull/744.diff","patch_url":"https://github.com/ubuntu-core/snappy/pull/744.patch","issue_url":"https://api.github.com/repos/ubuntu-core/snappy/issues/744","number":744,"state":"open","locked":false,"title":"interfaces,interfaces/apparmor: convert apparmor code to SecurityBackend","user":{"login":"zyga","id":784262,"avatar_url":"https://avatars.githubusercontent.com/u/784262?v=3","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"body":"This branch converts the older apparmor support code into something that looks like the new SecurityBackend. It gains a lot of features, most notably, simplicity of the high-level interface,\r\nbut also support for old-security and much better test coverage.\r\n\r\nSigned-off-by: Zygmunt Krynicki <zygmunt.krynicki@canonical.com>","created_at":"2016-03-24T22:21:00Z","updated_at":"2016-03-29T13:32:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"64e3078fd80ef33275ecdc7446db3eb953281273","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744/commits","review_comments_url":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744/comments","review_comment_url":"https://api.github.com/repos/ubuntu-core/snappy/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ubuntu-core/snappy/issues/744/comments","statuses_url":"https://api.github.com/repos/ubuntu-core/snappy/statuses/0da90c82558705b3798258b71adf29cd127f1a4c","head":{"label":"zyga:security-backend-apparmor","ref":"security-backend-apparmor","sha":"0da90c82558705b3798258b71adf29cd127f1a4c","user":{"login":"zyga","id":784262,"avatar_url":"https://avatars.githubusercontent.com/u/784262?v=3","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"repo":{"id":45263078,"name":"snappy","full_name":"zyga/snappy","owner":{"login":"zyga","id":784262,"avatar_url":"https://avatars.githubusercontent.com/u/784262?v=3","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/zyga/snappy","description":"Snappy is the software at the heart of Ubuntu Core.","fork":true,"url":"https://api.github.com/repos/zyga/snappy","forks_url":"https://api.github.com/repos/zyga/snappy/forks","keys_url":"https://api.github.com/repos/zyga/snappy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/zyga/snappy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/zyga/snappy/teams","hooks_url":"https://api.github.com/repos/zyga/snappy/hooks","issue_events_url":"https://api.github.com/repos/zyga/snappy/issues/events{/number}","events_url":"https://api.github.com/repos/zyga/snappy/events","assignees_url":"https://api.github.com/repos/zyga/snappy/assignees{/user}","branches_url":"https://api.github.com/repos/zyga/snappy/branches{/branch}","tags_url":"https://api.github.com/repos/zyga/snappy/tags","blobs_url":"https://api.github.com/repos/zyga/snappy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/zyga/snappy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/zyga/snappy/git/refs{/sha}","trees_url":"https://api.github.com/repos/zyga/snappy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/zyga/snappy/statuses/{sha}","languages_url":"https://api.github.com/repos/zyga/snappy/languages","stargazers_url":"https://api.github.com/repos/zyga/snappy/stargazers","contributors_url":"https://api.github.com/repos/zyga/snappy/contributors","subscribers_url":"https://api.github.com/repos/zyga/snappy/subscribers","subscription_url":"https://api.github.com/repos/zyga/snappy/subscription","commits_url":"https://api.github.com/repos/zyga/snappy/commits{/sha}","git_commits_url":"https://api.github.com/repos/zyga/snappy/git/commits{/sha}","comments_url":"https://api.github.com/repos/zyga/snappy/comments{/number}","issue_comment_url":"https://api.github.com/repos/zyga/snappy/issues/comments{/number}","contents_url":"https://api.github.com/repos/zyga/snappy/contents/{+path}","compare_url":"https://api.github.com/repos/zyga/snappy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/zyga/snappy/merges","archive_url":"https://api.github.com/repos/zyga/snappy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/zyga/snappy/downloads","issues_url":"https://api.github.com/repos/zyga/snappy/issues{/number}","pulls_url":"https://api.github.com/repos/zyga/snappy/pulls{/number}","milestones_url":"https://api.github.com/repos/zyga/snappy/milestones{/number}","notifications_url":"https://api.github.com/repos/zyga/snappy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/zyga/snappy/labels{/name}","releases_url":"https://api.github.com/repos/zyga/snappy/releases{/id}","deployments_url":"https://api.github.com/repos/zyga/snappy/deployments","created_at":"2015-10-30T16:30:25Z","updated_at":"2016-03-09T07:58:32Z","pushed_at":"2016-03-29T13:30:49Z","git_url":"git://github.com/zyga/snappy.git","ssh_url":"git@github.com:zyga/snappy.git","clone_url":"https://github.com/zyga/snappy.git","svn_url":"https://github.com/zyga/snappy","homepage":null,"size":26794,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"ubuntu-core:master","ref":"master","sha":"480309611937236932a8f0b9fa0e4d1a6d7e8daa","user":{"login":"ubuntu-core","id":15022473,"avatar_url":"https://avatars.githubusercontent.com/u/15022473?v=3","gravatar_id":"","url":"https://api.github.com/users/ubuntu-core","html_url":"https://github.com/ubuntu-core","followers_url":"https://api.github.com/users/ubuntu-core/followers","following_url":"https://api.github.com/users/ubuntu-core/following{/other_user}","gists_url":"https://api.github.com/users/ubuntu-core/gists{/gist_id}","starred_url":"https://api.github.com/users/ubuntu-core/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ubuntu-core/subscriptions","organizations_url":"https://api.github.com/users/ubuntu-core/orgs","repos_url":"https://api.github.com/users/ubuntu-core/repos","events_url":"https://api.github.com/users/ubuntu-core/events{/privacy}","received_events_url":"https://api.github.com/users/ubuntu-core/received_events","type":"Organization","site_admin":false},"repo":{"id":44672744,"name":"snappy","full_name":"ubuntu-core/snappy","owner":{"login":"ubuntu-core","id":15022473,"avatar_url":"https://avatars.githubusercontent.com/u/15022473?v=3","gravatar_id":"","url":"https://api.github.com/users/ubuntu-core","html_url":"https://github.com/ubuntu-core","followers_url":"https://api.github.com/users/ubuntu-core/followers","following_url":"https://api.github.com/users/ubuntu-core/following{/other_user}","gists_url":"https://api.github.com/users/ubuntu-core/gists{/gist_id}","starred_url":"https://api.github.com/users/ubuntu-core/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ubuntu-core/subscriptions","organizations_url":"https://api.github.com/users/ubuntu-core/orgs","repos_url":"https://api.github.com/users/ubuntu-core/repos","events_url":"https://api.github.com/users/ubuntu-core/events{/privacy}","received_events_url":"https://api.github.com/users/ubuntu-core/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ubuntu-core/snappy","description":"Snappy is the software at the heart of Ubuntu Core.","fork":false,"url":"https://api.github.com/repos/ubuntu-core/snappy","forks_url":"https://api.github.com/repos/ubuntu-core/snappy/forks","keys_url":"https://api.github.com/repos/ubuntu-core/snappy/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ubuntu-core/snappy/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ubuntu-core/snappy/teams","hooks_url":"https://api.github.com/repos/ubuntu-core/snappy/hooks","issue_events_url":"https://api.github.com/repos/ubuntu-core/snappy/issues/events{/number}","events_url":"https://api.github.com/repos/ubuntu-core/snappy/events","assignees_url":"https://api.github.com/repos/ubuntu-core/snappy/assignees{/user}","branches_url":"https://api.github.com/repos/ubuntu-core/snappy/branches{/branch}","tags_url":"https://api.github.com/repos/ubuntu-core/snappy/tags","blobs_url":"https://api.github.com/repos/ubuntu-core/snappy/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ubuntu-core/snappy/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ubuntu-core/snappy/git/refs{/sha}","trees_url":"https://api.github.com/repos/ubuntu-core/snappy/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ubuntu-core/snappy/statuses/{sha}","languages_url":"https://api.github.com/repos/ubuntu-core/snappy/languages","stargazers_url":"https://api.github.com/repos/ubuntu-core/snappy/stargazers","contributors_url":"https://api.github.com/repos/ubuntu-core/snappy/contributors","subscribers_url":"https://api.github.com/repos/ubuntu-core/snappy/subscribers","subscription_url":"https://api.github.com/repos/ubuntu-core/snappy/subscription","commits_url":"https://api.github.com/repos/ubuntu-core/snappy/commits{/sha}","git_commits_url":"https://api.github.com/repos/ubuntu-core/snappy/git/commits{/sha}","comments_url":"https://api.github.com/repos/ubuntu-core/snappy/comments{/number}","issue_comment_url":"https://api.github.com/repos/ubuntu-core/snappy/issues/comments{/number}","contents_url":"https://api.github.com/repos/ubuntu-core/snappy/contents/{+path}","compare_url":"https://api.github.com/repos/ubuntu-core/snappy/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ubuntu-core/snappy/merges","archive_url":"https://api.github.com/repos/ubuntu-core/snappy/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ubuntu-core/snappy/downloads","issues_url":"https://api.github.com/repos/ubuntu-core/snappy/issues{/number}","pulls_url":"https://api.github.com/repos/ubuntu-core/snappy/pulls{/number}","milestones_url":"https://api.github.com/repos/ubuntu-core/snappy/milestones{/number}","notifications_url":"https://api.github.com/repos/ubuntu-core/snappy/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ubuntu-core/snappy/labels{/name}","releases_url":"https://api.github.com/repos/ubuntu-core/snappy/releases{/id}","deployments_url":"https://api.github.com/repos/ubuntu-core/snappy/deployments","created_at":"2015-10-21T11:51:46Z","updated_at":"2016-03-24T10:07:31Z","pushed_at":"2016-03-29T13:30:50Z","git_url":"git://github.com/ubuntu-core/snappy.git","ssh_url":"git@github.com:ubuntu-core/snappy.git","clone_url":"https://github.com/ubuntu-core/snappy.git","svn_url":"https://github.com/ubuntu-core/snappy","homepage":null,"size":27722,"stargazers_count":59,"watchers_count":59,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":30,"mirror_url":null,"open_issues_count":22,"forks":30,"open_issues":22,"watchers":59,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744"},"html":{"href":"https://github.com/ubuntu-core/snappy/pull/744"},"issue":{"href":"https://api.github.com/repos/ubuntu-core/snappy/issues/744"},"comments":{"href":"https://api.github.com/repos/ubuntu-core/snappy/issues/744/comments"},"review_comments":{"href":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744/comments"},"review_comment":{"href":"https://api.github.com/repos/ubuntu-core/snappy/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ubuntu-core/snappy/pulls/744/commits"},"statuses":{"href":"https://api.github.com/repos/ubuntu-core/snappy/statuses/0da90c82558705b3798258b71adf29cd127f1a4c"}}}}