1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
|
summary: Ensure that the security rules for private tmp are in place.
details: |
This test verifies that when a snap creates a temporary file in /tmp,
then that file is accessible from other calls of commands from the same
snap and that file is not accessible by other snaps.
# ppc64el disabled because of https://bugs.launchpad.net/snappy/+bug/1655594
# ubuntu-14.04: the test sets up a user session, which requires more recent systemd
systems: [-ubuntu-core-*, -ubuntu-*-ppc64el, -ubuntu-14.04-*]
environment:
SNAP_INSTALL_DIR: $(pwd)/snap-install-dir
prepare: |
echo "Given a basic snap is installed"
"$TESTSTOOLS"/snaps-state install-local test-snapd-sh
echo "And another basic snap is installed"
mkdir -p "$SNAP_INSTALL_DIR"
cp -ra "$TESTSLIB"/snaps/test-snapd-sh/* "$SNAP_INSTALL_DIR"
sed -i 's/test-snapd-sh/not-test-snapd-sh/g' "$SNAP_INSTALL_DIR/meta/snap.yaml"
snap pack "$SNAP_INSTALL_DIR"
snap install --dangerous not-test-snapd-sh_1.0_all.snap
tests.session -u test prepare
restore: |
rm -rf "$SNAP_INSTALL_DIR" /tmp/foo /tmp/snap-private-tmp/snap.not-test-snapd-sh /tmp/snap-private-tmp/snap.test-snapd-sh/
tests.session -u test restore
execute: |
SNAP_MOUNT_DIR="$(os.paths snap-mount-dir)"
echo "When a temporary file is created by one snap"
expect -d -f tmp-create.exp "$SNAP_MOUNT_DIR"
LIBEXEC_DIR="$(os.paths libexec-dir)"
if [ -e "$LIBEXEC_DIR/snapd/snap-discard-ns" ]; then
echo "Then that file is accessible from other calls of commands from the same snap"
if ! test-snapd-sh.sh -c 'stat /tmp/foo' 2>same-stat.error; then
echo "Expected the file to be present"
exit 1
fi
else
echo "Then that file is not accessible from other calls of commands from the same snap"
if test-snapd-sh.sh -c 'stat /tmp/foo' 2>same-stat.error; then
echo "Expected the file to be absent"
exit 1
fi
fi
echo "And that file is not accessible by other snaps"
if not-test-snapd-sh.sh -c 'stat /tmp/foo' 2>other-stat.error; then
echo "Expected error not present"
exit 1
fi
MATCH "stat: cannot stat '/tmp/foo': No such file or directory" < other-stat.error
|
