1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
summary: Checks parallel installation of classic snaps
details: |
Snapd allows installation of the same snap more than once by combining the
same snap name with different values of an instance key.
With classic confinement and parallel instances used together we _do_ set up
a limited mount namespace and use it to mask the fact that instances are in
use for the directory where snap applications are mounted and for the
directory with instance wide data (/var/snap). Remaining locations are
unaffected by the special mount namespace and instead we provide
applications with the right environment variables that do encode the
instance key, such as $SNAP_USER_DATA and $SNAP_USER_COMMON.
The test installs a snap twice, and inspects that the applications can be
invoked separately, obtain tailored environment variables which are aware of
the difference in the instance key, read and write data to separate
directories and that while the directories to not always show up as the
instance-key-aware names on the inside of the snap execution environment, on
the outside the names are indeed correct and do contain the instance key. In
other words, the two applications are separate and have separate state.
# core does not support classic confinement
systems: [-ubuntu-core-*]
prepare: |
# ensure we have no snap user data directories yet
rm -rf /home/test/snap
rm -rf /root/snap
rm -rf /var/snap/test-snapd-classic-confinement
rm -rf /var/snap/test-snapd-classic-confinement_foo
snap pack "$TESTSLIB/snaps/test-snapd-classic-confinement/"
case "$SPREAD_SYSTEM" in
fedora-*|arch-*|centos-*)
# although classic snaps do not work out of the box on fedora,
# we still want to verify if the basics do work if the user
# symlinks /snap to $SNAP_MOUNT_DIR themselves
SNAP_MOUNT_DIR="$(os.paths snap-mount-dir)"
ln -sf "$SNAP_MOUNT_DIR" /snap
;;
esac
snap set system experimental.parallel-instances=true
restore: |
snap unset system experimental.parallel-instances
case "$SPREAD_SYSTEM" in
fedora-*|arch-*|centos-*)
rm -f /snap
;;
esac
execute: |
"$TESTSTOOLS"/snaps-state install-local test-snapd-classic-confinement --classic
"$TESTSTOOLS"/snaps-state install-local-as test-snapd-classic-confinement test-snapd-classic-confinement_foo --classic
su test -l -c '! test -d ~/snap/test-snapd-classic-confinement'
su test -l -c '! test -d ~/snap/test-snapd-classic-confinement_foo'
not test -d ~/snap/test-snapd-classic-confinement
not test -d ~/snap/test-snapd-classic-confinement_foo
# running the snap as a user works
su test -l -c "test-snapd-classic-confinement_foo.sh -c 'echo foo'" | MATCH foo
# user directory was created
su test -l -c 'test -d ~/snap/test-snapd-classic-confinement_foo'
# running as root works
test-snapd-classic-confinement_foo.sh -c "echo foo" | MATCH foo
# instance environment variables are correctly set up
su test -l -c 'test-snapd-classic-confinement_foo.sh -c env' > snap_foo-env.txt
MATCH 'SNAP_INSTANCE_NAME=test-snapd-classic-confinement_foo' < snap_foo-env.txt
MATCH 'SNAP_NAME=test-snapd-classic-confinement' < snap_foo-env.txt
MATCH 'SNAP_INSTANCE_KEY=foo' < snap_foo-env.txt
MATCH 'SNAP=/snap/test-snapd-classic-confinement/x1' < snap_foo-env.txt
MATCH 'SNAP_COMMON=/var/snap/test-snapd-classic-confinement/common' < snap_foo-env.txt
MATCH 'SNAP_DATA=/var/snap/test-snapd-classic-confinement/x1' < snap_foo-env.txt
MATCH 'SNAP_USER_DATA=/home/test/snap/test-snapd-classic-confinement_foo/x1' < snap_foo-env.txt
MATCH 'SNAP_USER_COMMON=/home/test/snap/test-snapd-classic-confinement_foo/common' < snap_foo-env.txt
echo canary-instance-common > /var/snap/test-snapd-classic-confinement_foo/common/data
echo canary-instance-rev > /var/snap/test-snapd-classic-confinement_foo/x1/data
echo canary-regular-common > /var/snap/test-snapd-classic-confinement/common/data
echo canary-regular-rev > /var/snap/test-snapd-classic-confinement/x1/data
# instance can read and write data
su test -l -c "test-snapd-classic-confinement_foo.sh -c 'cat \$SNAP_COMMON/data'" | MATCH canary-instance-common
su test -l -c "test-snapd-classic-confinement_foo.sh -c 'cat \$SNAP_DATA/data'" | MATCH canary-instance-rev
# shellcheck disable=SC2016
test-snapd-classic-confinement_foo.sh -c "echo \"hello from instance \$SNAP_INSTANCE_NAME\" > \$SNAP_DATA/hello"
MATCH 'hello from instance test-snapd-classic-confinement_foo' < /var/snap/test-snapd-classic-confinement_foo/x1/hello
# non-instance sees the right data
su test -l -c "test-snapd-classic-confinement.sh -c 'cat \$SNAP_COMMON/data'" | MATCH canary-regular-common
su test -l -c "test-snapd-classic-confinement.sh -c 'cat \$SNAP_DATA/data'" | MATCH canary-regular-rev
# and does not see instance specific data
# shellcheck disable=SC2016
not test-snapd-classic-confinement.sh -c "test -e \$SNAP_COMMON/foobar/hello"
|
