cannot create $SNAP_USER_DATA when using ecryptfs and sudo

[Zygmunt Krynicki]

[Impact]

The code that creates the $SNAP_USER_DATA directory in snap-confine is prevented from running by the apparmor profile that confines snap-confine itself when the home directory is encrypted and the user runs as root, e.g. via sudo.

This bug is fixed by lowering the restrictions placed on apparmor rules that govern access to the encrypted home directory files. The relevant rules no longer requires the process (running as root) to match the owner of the files (typically the owner of the home directory)

[Test Case]

The test case can be found here:

https://github.com/snapcore/snap-confine/blob/master/spread-tests/user-data-dir-created/task.yaml

This test case needs to be executed manually on a computer with encrypted home directory. Spread does not currently run in such a configuration so a manual check is worth while.

[Regression Potential]

 * Regression potential is minimal as the fix simply makes two apparmor rules less restrictive. The change was reviewed and approved by the security team.

[Other Info]

* This bug is a part of a major SRU that brings snap-confine in Ubuntu 16.04 in line with the current upstream release 1.0.41.

* This bug was included in an earlier SRU and is now fixed in Ubuntu. I am updating the template here to ensure that the process is fully documented from 1.0.38 all the way up to the current upstream release 1.0.41.

* snap-confine is technically an integral part of snapd which has an SRU exception and is allowed to introduce new features and take advantage of accelerated procedure. For more information see https://wiki.ubuntu.com/SnapdUpdates

== # Pre-SRU bug description follows # ==

Because of the two apparmor rules on snap-confine, attempts to create user data directory from snap-confine will fail when the user is using new-style encrypted home directory and sudo to start a snap.

TEST CASE:
1. sudo adduser --encrypt-home test-encrypted
2. Ensure that the test-encrypted user can use sudo, e.g. add it to the sudo group
3. Log in as test-encrypted user
4. Install the hello-world snap
5. Run sudo /snap/bin/hello-world
6. Verify that `hello-world` fails to run
7. Install snap-confine from xenial-propsoed
8. verify that `hello-world` runs now

The following patch makes the problem go away:

diff --git a/debian/usr.bin.snap-confine b/debian/usr.bin.snap-confine
index f3e6308..aeb17bd 100644
--- a/debian/usr.bin.snap-confine
+++ b/debian/usr.bin.snap-confine
@@ -155,6 +155,6 @@
     owner @{HOME}/.Private/ r,
     owner @{HOME}/.Private/** mrixwlk,
     # new-style encrypted $HOME
- owner @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
- owner @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,
+ @{HOMEDIRS}/.ecryptfs/*/.Private/ r,
+ @{HOMEDIRS}/.ecryptfs/*/.Private/** mrixwlk,
 }

[Zygmunt Krynicki (zyga)]

This is fixed by the following patch in a pull request to snap-confine

https://github.com/snapcore/snap-confine/pull/97/commits/450b660ac91d4ced15185dbdbd2b547ae74fdcec

[Adam Conrad (adconrad)]

Hello Zygmunt, or anyone else affected,

Accepted snap-confine into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/snap-confine/1.0.38-0ubuntu0.16.04.8 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Federico Gimenez (fgimenez)]

Verified with latest snap-confine

[Michael Vogt (mvo)]

This is fixed with the 1.0.40 upload to yakkety

[Launchpad Janitor (janitor)]

This bug was fixed in the package snap-confine - 1.0.38-0ubuntu0.16.04.8

---------------
snap-confine (1.0.38-0ubuntu0.16.04.8) xenial; urgency=medium

  * debian/patches/04_not_die_unknown_locations.patch:
    - move to /tmp if the current location can not be preserved
      (LP: #1612684)

snap-confine (1.0.38-0ubuntu0.16.04.7) xenial; urgency=medium

  * fix apparmor rules when a snap is run on new-style encrypted
    home with sudo (LP: #1612291)

snap-confine (1.0.38-0ubuntu0.16.04.6) xenial; urgency=medium

  * fix apparmor rules when a snap is run on encrypted home
    with sudo (LP: #1612291)

snap-confine (1.0.38-0ubuntu0.16.04.5) xenial; urgency=medium

  * 03_fix_snap_user_data_regression.patch:
    - fix regression in autopkgtest with snap-confine when the
      SNAP_USER_DATA directory is not created for services
      (LP: #1612120)

 -- Michael Vogt <email address hidden> Fri, 12 Aug 2016 16:45:17 +0200

[Chris J Arges (arges)]

The verification of the Stable Release Update for snap-confine has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.