interfaces,overlord: allow access to kernel snap in profiles #14899
Conversation
In UC24+ the kernel modules and firmware is accessed from symlinks in
/lib/{modules,firmware} that can point to different locations. Make
sure that the files can be read by any snap, as there are actions that
can trigger the automatic loading of modules or firmware from the
kernel. This is also needed so the kernel-modules-control can actually
work as expected.
This option is needed to generate apparmor profiles that allow accessing kernel modules/firmware.
|
Access to component dirs might be tightened so only those of type |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #14899 +/- ##
==========================================
+ Coverage 78.20% 78.21% +0.01%
==========================================
Files 1151 1155 +4
Lines 151396 152853 +1457
==========================================
+ Hits 118402 119557 +1155
- Misses 25662 25910 +248
- Partials 7332 7386 +54
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
| @@ -88,12 +88,19 @@ func (m *InterfaceManager) buildConfinementOptions(st *state.State, snapInfo *sn | |||
| return interfaces.ConfinementOptions{}, fmt.Errorf("cannot get extra mount layouts of snap %q: %s", snapInfo.InstanceName(), err) | |||
| } | |||
|
|
|||
| kernelSnap := "" | |||
There was a problem hiding this comment.
the code here probably needs to take the task so we can do the right thin during remodel
There was a problem hiding this comment.
Good point, fixed now
so remodelling scenarios are handled properly.
alfonsosanchezbeato
force-pushed
the
allow-modules-access
branch
from
7cdf7d5 to
71b8ccd
Compare
In UC24+ the kernel modules and firmware is accessed from symlinks in
/lib/{modules,firmware} that can point to different locations. Make
sure that the files can be read by any snap, as there are actions that
can trigger the automatic loading of modules or firmware from the
kernel. This is also needed so the kernel-modules-control can actually
work as expected.