canonical/microcloud

Cannot read preseed file when using snap in confined mode

roosterfish opened this issue · 8 comments

roosterfish commented

When following the microcloud/test/suites/basic.sh test suite you can run microcloud init --preseed /root/preseed.yaml in order to load the preseed file. If the snap is not installed using --devmode accessing this file fails with permission denied and the following error from apparmor:

[25737.777721] audit: type=1400 audit(1697721622.896:3717): apparmor="ALLOWED" operation="open" class="file" namespace="root//lxd-c1_<var-snap-lxd-common-lxd>" profile="snap.microcloud.microcloud" name="/root/preseed.yml" pid=1426161 comm="microcloud" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1001000

Is there a special directory for the preseed file so that it can be accessed by the snap?

tomponline commented

@masnax please can you check that preseed is working without --devmode thanks

masnax commented

Shoot, yeah due to the snap confinement the preseed file would need to be read from /var/snap/microcloud. @tomponline are you familiar with how LXD handles reading files from outside the snap confinement?

  • 😕1
tomponline commented

LXD has access to the host filesystem by /var/lib/snapd/hostfs and our associated shared.HostPath() function.
But I dont think MicroCloud has that sort of global access, so I suspect you'll need to talk to the snapd team about using a content interface - or can you not modify microcloud to accept the preseed via stdin (like lxd init does btw).:

      --preseed                 Pre-seed mode, expects YAML config from stdin

This would side step the issue and be consistent with LXD - two wins in my book.

  • 👍2
tomponline commented

Also does this mean you've not run the tests on the actual latest/edge version?

masnax commented

Yeah I wrote the tests expecting to build the snap each time, since the whole test-suite relies on snaps. Thanks to muscle memory I used --devmode, but it should really be --dangerous after installing the published snap so the confinement rules are maintained.

tomponline commented

Right ok please can you update and re-run to check for any other issues. Thanks

tomponline commented

The test suite should also have a default mode where it uses latest/edge like we do in lxd-ci so there's no need to have the actual microcloud source on the test system.

roosterfish commented

I guess this can be closed as fixed by #197?

  • 👍1