1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
summary: Ensure that classic confinement works
details: |
Verify that a snap installed with classic confinment works properly.
Check that it is possible to install classic confinement snaps from the store
and it is possible to refresh a snap with classic confinment.
# Classic confinement isn't working yet on Fedora, Arch linux and Centos
systems: [-ubuntu-core-*]
environment:
CLASSIC_SNAP: test-snapd-classic-confinement
prepare: |
snap pack "$TESTSLIB/snaps/$CLASSIC_SNAP/"
case "$SPREAD_SYSTEM" in
fedora-*|arch-*|centos-*)
# although classic snaps do not work out of the box on fedora,
# Arch linux and Centos, we still want to verify if the basics
# do work if the user symlinks /snap to $SNAP_MOUNT_DIR themselves
SNAP_MOUNT_DIR="$(os.paths snap-mount-dir)"
ln -sf "$SNAP_MOUNT_DIR" /snap
;;
esac
restore: |
case "$SPREAD_SYSTEM" in
fedora-*|arch-*|centos-*)
rm -f /snap
;;
esac
execute: |
echo "Check that classic snaps work only with --classic"
if snap install --dangerous "${CLASSIC_SNAP}_1.0_all.snap"; then
echo "snap install needs --classic to install local snaps with classic confinment"
exit 1
fi
if snap install "$CLASSIC_SNAP"; then
echo "snap install needs --classic to install remote snaps with classic confinment"
exit 1
fi
echo "Check that the classic snap works (it skips the entire sandbox)"
snap install --dangerous --classic "${CLASSIC_SNAP}_1.0_all.snap"
touch /tmp/lala
"$CLASSIC_SNAP" | MATCH lala
snap remove --purge "$CLASSIC_SNAP"
echo "Check that we can install classic confinement snaps from the store"
snap install --classic "$CLASSIC_SNAP"
snap list | MATCH "$CLASSIC_SNAP .*1.0 .*classic"
snap info "$CLASSIC_SNAP"|MATCH "installed:.* 1.0 .*classic"
"$CLASSIC_SNAP" | MATCH lala
echo "Snap refresh from the store also works (2.0 is in beta, 1.0 in stable)"
snap refresh --beta "$CLASSIC_SNAP"
snap list | MATCH "$CLASSIC_SNAP .*2.0 .*classic"
snap info "$CLASSIC_SNAP"|MATCH "installed:.* 2.0 .*classic"
"$CLASSIC_SNAP" | MATCH lala
if os.query is-ubuntu; then
echo "Verify we get 'change_profile unsafe' for classic confinement"
MATCH "change_profile unsafe" < /var/lib/snapd/apparmor/profiles/snap.test-snapd-classic-confinement.test-snapd-classic-confinement
fi
|
