snapd 2.25+201705082317.git.3ff5a56~ubuntu16.04.1 breaks seccomp handling

[Oliver Grawert]

trying to configure wifi-ap via "sudo wifi-ap.setup-wizard" on a very recent edge core snap makes seccomp block the "socket" syscall... (the command just hangs silently then)

syslog: http://paste.ubuntu.com/24542320/
wifi-ap seccomp profile: http://paste.ubuntu.com/24542345/

this is with core 1876 (edge) on a pi3 which uses:
ogra@pi3:~$ snap version
snap 2.25+201705082317.git.3ff5a56~ubuntu16.04.1
snapd 2.25+201705082317.git.3ff5a56~ubuntu16.04.1
series 16
kernel 4.4.0-1051-raspi2

rolling back to core 1805 (beta) with:
ogra@pi3:~$ snap version
snap 2.25
snapd 2.25
series 16
kernel 4.4.0-1051-raspi2

makes everything work fine ...
the profile has a FIXME pointing to bug #1446748 ... apparently something related to argument filtering landed recently in snapd, could that cause this issue ?

[Jamie Strandboge (jdstrand)]

Is wifi-ap using a netlink socket? Can you strace it?

[Zygmunt Krynicki (zyga)]

/me puts his 0.99 coin on seccomp killing us on netlink.

# socket AF_NETLINK - -

The profile no longer allows netlink (where it previosuly did) so I bet this is the case.

[Jamie Strandboge (jdstrand)]

The rule that is missing is:

socket AF_NETLINK - NETLINK_ROUTE

This is in several interfaces: network-bind, network-observe, network-control, but the command only plugs 'network'. I'm investigating what the command is doing to understand if the above rule should be added to 'network' or to discuss other options.

[Jamie Strandboge (jdstrand)]

It looks on ARM, these go calls require NETLINK_ROUTE:

- net.Interfaces()
- net.InterfaceAddrs()

Curiously, NETLINK_ROUTE is not needed for these on x86. Technically, these two calls are in the domain of 'network-observe', 'network-bind' and 'network-control' and not 'network'.

For series 16 I think we should add this to 'network' to not break existing applications on ARM that only plugs 'network', in part because both network and network-bind are autoconnected and there is therefore no appreciable difference security-wise wrt install time interface connections.

For series 18 (or whenever we start having different policy), we can consider removing NETLINK_ROUTE from the 'network' policy since that is more correct.

[Jamie Strandboge (jdstrand)]

https://github.com/snapcore/snapd/pull/3285

[Zygmunt Krynicki (zyga)]

Thank you for debugging this. Interesting insight. I would love to know why it is arch specific but I guess that requires a deep dive into the kernel.

[Jamie Strandboge (jdstrand)]

For posterity, it looks like x86 4.10 kernel doesn't need it, but x86 4.4 kernel does along with armhf.

[Zygmunt Krynicki (zyga)]

I'm marking this as fix released since the PR linked above landed and was released along with 2.27.2 (or earlier).