{"action":"created","issue":{"url":"https://api.github.com/repos/snapcore/snapd/issues/2969","repository_url":"https://api.github.com/repos/snapcore/snapd","labels_url":"https://api.github.com/repos/snapcore/snapd/issues/2969/labels{/name}","comments_url":"https://api.github.com/repos/snapcore/snapd/issues/2969/comments","events_url":"https://api.github.com/repos/snapcore/snapd/issues/2969/events","html_url":"https://github.com/snapcore/snapd/pull/2969","id":211239360,"number":2969,"title":"interfaces: mediate netlink sockets via seccomp","user":{"login":"jdstrand","id":1663079,"avatar_url":"https://avatars3.githubusercontent.com/u/1663079?v=3","gravatar_id":"","url":"https://api.github.com/users/jdstrand","html_url":"https://github.com/jdstrand","followers_url":"https://api.github.com/users/jdstrand/followers","following_url":"https://api.github.com/users/jdstrand/following{/other_user}","gists_url":"https://api.github.com/users/jdstrand/gists{/gist_id}","starred_url":"https://api.github.com/users/jdstrand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdstrand/subscriptions","organizations_url":"https://api.github.com/users/jdstrand/orgs","repos_url":"https://api.github.com/users/jdstrand/repos","events_url":"https://api.github.com/users/jdstrand/events{/privacy}","received_events_url":"https://api.github.com/users/jdstrand/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2017-03-01T23:15:28Z","updated_at":"2017-03-04T10:07:52Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/snapcore/snapd/pulls/2969","html_url":"https://github.com/snapcore/snapd/pull/2969","diff_url":"https://github.com/snapcore/snapd/pull/2969.diff","patch_url":"https://github.com/snapcore/snapd/pull/2969.patch"},"body":"AppArmor only has coarse-grained mediation for the `type` for netlink (`man 7 netlink`) sockets but it is useful to be able to mediate by the netlink_family as well. This branch achieves that by introducing support for `socket AF_NETLINK - NETLINK_*` seccomp rules by:\r\n\r\n- adding all the missing AF_* (and PF_*) mappings (see `include/linux/socket.h` from the kernel)\r\n- adding NETLINK_* family mappings\r\n- adding socket AF_... for everything except AF_NETLINK in the default template. This allows us to continue to rely on AppArmor for mediation of non-netlink sockets\r\n- adjusting account-control to use NETLINK_AUDIT (from libaudit1)\r\n- adjusting bluez to use NETLINK_KOBJECT_UEVENT for udev (also fix a bug in the apparmor policy to allow 'network netlink raw')\r\n- adjusting firewall-control to use NETLINK_ROUTE and NETLINK_* families related to firewalling\r\n- adjusting fwupd to use NETLINK_KOBJECT_UEVENT for udev\r\n- adjusting mir to use NETLINK_KOBJECT_UEVENT for udev\r\n- adjusting modem-manager to use NETLINK_KOBJECT_UEVENT for udev (also fix a bug in the apparmor policy to allow 'network netlink raw')\r\n- adjusting network and network-bind to use NETWORK_ROUTE (for monitoring address changes, etc)\r\n- adjusting network-control to use NETLINK_* families related to networking\r\n- adjusting network-manager to use all netlink families (which is what is allowed by the current apparmor policy. Remove redundant netlink rules from apparmor policy)\r\n- adjusting network-observe to use NETWORK_ROUTE (for arp) and NETWORK_INET_DIAG (for ss) and add 'ss' binary to policy\r\n- adjusting ofono to use  NETLINK_ROUTE and NETLINK_KOBJECT_UEVENT for udev\r\n- adjusting pulseaudio to use NETLINK_KOBJECT_UEVENT for udev\r\n- adjusting udisks2 to use NETLINK_KOBJECT_UEVENT for udev\r\n- adjusting upower-observe to use NETLINK_KOBJECT_UEVENT for udev\r\n- adjusting docker, lxd, hardware-observe and network-observe to use NETLINK_GENERIC based on codesearch\r\n- adding the netlink-audit interface to support NETLINK_AUDIT\r\n- adding the netlink-connector interface to support NETLINK_CONNECTOR\r\n\r\nWe omit PF_* in the policy since those are synonymous with AF_*. We do not use 'socket !AF_NETLINK' in the default template because that doesn't work well with an interface that uses 'socket AF_NETLINK').\r\n\r\nImportantly, `network netlink` AppArmor rules were not in the default policy or most of the interfaces and the changes to policy outside of the template are for permanent slot policy for slot implementations for those that had 'network netlink' rules (and modem-manager and bluez that were mistakenly missing them). We do allow NETLINK_ROUTE in network-bind but continue to disallow netlink rules there to avoid KILLing java servers which attempt it but otherwise fail gracefully.\r\n\r\nSince there are applications in codesearch.debian.net known to use NETLINK_AUDIT and NETLINK_CONNECTOR, add two new interfaces for them.\r\n\r\nTesting performed:\r\n- account-control: useradd (NETLINK_AUDIT) - DONE\r\n- bluez: bluez (NETLINK_KOBJECT_UEVENT) - DONE (it starts)\r\n- firewall-control: iptables: DONE (only for NETLINK_ROUTE)\r\n- fwupd: uefi-fw-tools - DONE (it starts)\r\n- mir: mir-libs --edge and mir-kiosk --edge - DONE (it starts)\r\n- network: wuzz - DONE\r\n- network-bind: minecraft-server-jdstrand - DONE\r\n- network-control: arp (NETLINK_ROUTE), ping - DONE\r\n- network-manager: nmcli - DONE\r\n- network-observe: arp (NETLINK_ROUTE), ping, ss (NETLINK_INET_DIAG) - DONE\r\n- ofono: ofono --edge - DONE (it starts)\r\n- pulseaudio: pulseaudio - sudo pulseaudio.pactl stat - DONE\r\n- udisks2: udisks2 - sudo udisks2.udisksctl info -b /dev/vda - DONE\r\n- upower-observe: upower --edge - DONE (it starts)\r\n- verified applications run with the new policy for all updated interfaces\r\n\r\nWhile this PR is useful in and of itself because we can finely-mediate netlink sockets for our slot implementations, account-control, network-control and network-observe, this functionality is most important for adding NETLINK_KOBJECT_UEVENT for udev to x11/unity7 to support QtSystem applications on X. Since there is some conditional logic that is going to be introduced there, it will be in a separate PR."},"comment":{"url":"https://api.github.com/repos/snapcore/snapd/issues/comments/284141712","html_url":"https://github.com/snapcore/snapd/pull/2969#issuecomment-284141712","issue_url":"https://api.github.com/repos/snapcore/snapd/issues/2969","id":284141712,"user":{"login":"zyga","id":784262,"avatar_url":"https://avatars3.githubusercontent.com/u/784262?v=3","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"created_at":"2017-03-04T10:07:52Z","updated_at":"2017-03-04T10:07:52Z","body":"Just FYI, this cannot land unless we run snap-confine from the core snap."}}
{"actor":{"display_login":"zyga"}}