5646 Commits

Author SHA1 Message Date
Alfonso Sánchez-Beato
597f1efcaf interfaces/account-control: grant access to files needed by pam
pam uses /var/log/lastlog for successful log attempts, and
/var/log/tallylog for failures.
2023-03-09 17:03:32 +01:00
Dimitri John Ledkov
a0948bc380 interfaces/nvidia-drivers-support: NVIDIA drivers userspace system setup support (#12591)
* interfaces/nvidia-support: Add support for NVIDIA char devices

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>

* Fix policy tests

* expand nvidiaSupportSummary

* update copyright year

* Rename to nvidia-drivers-support

* Rename files

* go.gofmt fix

---------

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@canonical.com>
2023-03-08 17:11:17 +01:00
Philip Meulengracht
7b1425e376 multiple: Add missing updating of snippets when changing the homedirs.
Move the functionality of /var/lib/snapd/system-params to its own package with unit tests, to get a more structured approach to the file.

Let SetupSnapConfineSnippets itself discover the homedirs instead of passing it as a parameter, this is also more in line with how it already functions with existing features.
2023-03-08 12:11:00 +01:00
Philip Meulengracht
1cfbe4f1fd multiple: review feedback
coding style corrections, simplify empty argument
2023-03-08 12:11:00 +01:00
Alberto Mardegan
3c685edcdc many: update snap-confine profile as homedirs change 2023-03-08 12:11:00 +01:00
Alfonso Sánchez-Beato
2f8931f909 interfaces/hardware-observe: allow readin /proc/tty/driver/*
Each serial driver can leave its own file specifying harware
information in /proc/tty/driver/, in the same format as "serial"
driver, so we should allow reading any of them. Example of files
created there are usbserial, max310x or IMX-uart.
2023-03-08 08:54:55 +01:00
James Henstridge
5641bdcac6 interfaces: grant access to new ibus socket location in desktop-legacy
The ibus input method communicates via a private D-Bus message bus
implemented with glib's D-Bus implementation. With glib >= 2.75.0, this
switched from an abstract namespace unix socket to a regular unix
socket. This commit grants access to the regular unix socket path.

https://launchpad.net/bugs/2008279
2023-03-08 08:51:41 +01:00
Valentin David
b84b30f207 i/b/udisks2: only allow udev file path that would be valid in any sysroot 2023-03-07 17:42:26 +01:00
Valentin David
e06564e94d i/b/udisks2: resolve udev-file path within the snap 2023-03-07 17:42:26 +01:00
Valentin David
10a7924b8a i/b/udisks2: test error when opening udev-file 2023-03-07 17:42:26 +01:00
Valentin David
2e201b740d i/b/udisks2: disallow installation by default if udev-file is set 2023-03-07 17:42:26 +01:00
Valentin David
638998b12e i/b/polkit: Do not check peer name
udisks2 which use the C polkit library, does not send calls to the
peer name but to the peer address directly. So AppArmor can not
properly filter based on peer name.
2023-03-07 17:42:26 +01:00
Valentin David
1d79cac15a i/b/udisks2: add attribute to load udev rules
udisks2 provides its own udev rules, we should install up to date
rules from the snap.
2023-03-07 17:42:26 +01:00
Valentin David
931a191cb7 i/b/udisks2: add missing AppArmor permissions 2023-03-07 17:42:26 +01:00
Valentin David
f92f93f3da i/b/udisks2: allow users to connect to daemon
udisks2 uses polkit to verify if user has the right permission.
2023-03-07 17:42:26 +01:00
Valentin David
87957c6faf i/b/udisks2: allow installation of daemon on classic 2023-03-07 17:42:26 +01:00
Valentin David
079d9a9eba i/b/fwupd: allow to write to some EFI path for some capsules 2023-03-06 16:49:46 +01:00
Alex Murray
0b2ed0b5fc interfaces/apparmor: Add read of /proc/PID/cpuset to base template
See https://forum.snapcraft.io/t/interface-for-reading-proc-pid-cpuset/33886 for
discussion but basically this is unprivileged information that is consistent
with other similar pieces of information already exposed in the base template.

Signed-off-by: Alex Murray <alex.murray@canonical.com>
2023-03-06 16:49:00 +01:00
Marco Trevisan
df9f99f88a desktop-legacy, unity7: Support for indicators activation tokens
It has been added by recent versions

See: https://github.com/KDE/knotifications/blob/master/src/org.kde.StatusNotifierItem.xml
2023-03-06 16:29:16 +01:00
Stephane Graber
e09c89af74 interfaces: Add microovn interface
This interface makes it possible to control MicroOVN.

It will be used by another snap, MicroCloud to bring up MicroOVN
and LXD clusters automatically.

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>
2023-03-06 10:41:49 +01:00
Philip Meulengracht
f22e553350 i/apparmor,s/apparmor: move snap-confine snippet generation to sandbox 2023-03-01 10:15:56 +01:00
Alex Murray
e1c2bbeced interfaces/screen-inhibit-control: Add support for xfce-power-manager
This is required for firefox
https://bugzilla.mozilla.org/show_bug.cgi?id=1785799

Signed-off-by: Alex Murray <alex.murray@canonical.com>
2023-02-21 15:47:36 +01:00
Michael Vogt
436f499a40 interfaces: relax rules for mount-control what for functionfs (#12559)
* interfaces: relax rules for mount-control `what` for functionfs

The `functionfs` `what` rules are too strict. With functionfs
pretty much anything can be in the `what` line so best to not
bother, especially since functionfs requires a explicit mention
in the plug declaration.

* interfaces: refactor so that validateWhatAttr can take more things into consideration

* interfaces: do not allow AppArmorRegex in "what"

* interfaces: improve the error message when functionfs is used
2023-02-20 17:07:43 +01:00
Philip Meulengracht
d01ce2e176 Merge pull request #12557 from valentindavid/valentindavid/fwupd-uefi-dir
i/b/fwupd: allow writing in EFI's fwupd directory
2023-02-16 08:53:07 +01:00
Alfonso Sánchez-Beato
3f4a99827c interfaces/modem-manager: add net_admin capability
This is needed for NETLINK_ROUTE sockets, which started to be used by
ModemManager 1.18.
2023-02-10 15:59:02 +00:00