o/state,daemon: add snap-run-inhibit notice

daemon/access.go

@@ -20,7 +20,10 @@
 package daemon
 
 import (
+	"fmt"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strconv"
 
 	"github.com/snapcore/snapd/client"
@@ -38,6 +41,8 @@ var polkitCheckAuthorization = polkit.CheckAuthorization
 
 var checkPolkitAction = checkPolkitActionImpl
 
+var osReadlink = os.Readlink
+
 func checkPolkitActionImpl(r *http.Request, ucred *ucrednet, action string) *apiError {
 	var flags polkit.CheckFlags
 	allowHeader := r.Header.Get(client.AllowInteractionHeader)
@@ -255,3 +260,41 @@ func (ac interfaceAuthenticatedAccess) CheckAccess(d *Daemon, r *http.Request, u
 
 	return Unauthorized("access denied")
 }
+
+// isRequestFromSnapCmd checks that the request is coming from snap command.
+//
+// It checks that the request process "/proc/PID/exe" points to one of the
+// known locations of the snap command. This not a security-oriented check.
+func isRequestFromSnapCmd(r *http.Request) (bool, error) {
+	ucred, err := ucrednetGet(r.RemoteAddr)
+	if err != nil {
+		return false, err
+	}
+	exe, err := osReadlink(fmt.Sprintf("/proc/%d/exe", ucred.Pid))
+	if err != nil {
+		return false, err
+	}
+
+	// SNAP_REEXEC=0
+	if exe == filepath.Join(dirs.GlobalRootDir, "/usr/bin/snap") {
+		return true, nil
+	}
+
+	// Check if re-exec in snapd
+	path := filepath.Join(dirs.SnapMountDir, "snapd/*/usr/bin/snap")
+	if matched, err := filepath.Match(path, exe); err != nil {
+		return false, err
+	} else if matched {
+		return true, nil
+	}
+
+	// Check if re-exec in core
+	path = filepath.Join(dirs.SnapMountDir, "core/*/usr/bin/snap")
+	if matched, err := filepath.Match(path, exe); err != nil {
+		return false, err
+	} else if matched {
+		return true, nil
+	}
+
+	return false, nil
+}

daemon/api_notices.go

@@ -16,6 +16,7 @@ package daemon
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"math"
@@ -25,19 +26,23 @@ import (
 	"github.com/snapcore/snapd/dirs"
 	"github.com/snapcore/snapd/overlord/auth"
 	"github.com/snapcore/snapd/overlord/state"
+	"github.com/snapcore/snapd/snap/naming"
 	"github.com/snapcore/snapd/strutil"
 )
 
 var noticeReadInterfaces = map[state.NoticeType][]string{
 	state.ChangeUpdateNotice:   {"snap-refresh-observe"},
 	state.RefreshInhibitNotice: {"snap-refresh-observe"},
+	state.SnapRunInhibitNotice: {"snap-refresh-observe"},
 }
 
 var (
 	noticesCmd = &Command{
-		Path:       "/v2/notices",
-		GET:        getNotices,
-		ReadAccess: interfaceOpenAccess{Interfaces: []string{"snap-refresh-observe"}},
+		Path:        "/v2/notices",
+		GET:         getNotices,
+		POST:        postNotices,
+		ReadAccess:  interfaceOpenAccess{Interfaces: []string{"snap-refresh-observe"}},
+		WriteAccess: openAccess{},
 	}
 
 	noticeCmd = &Command{
@@ -47,6 +52,12 @@ var (
 	}
 )
 
+// addedNotice is the result of adding a new notice.
+type addedNotice struct {
+	// ID is the id of the newly added notice.
+	ID string `json:"id"`
+}
+
 func getNotices(c *Command, r *http.Request, user *auth.UserState) Response {
 	query := r.URL.Query()
 
@@ -232,6 +243,71 @@ func allowedNoticeTypesForInterface(iface string) []state.NoticeType {
 	return types
 }
 
+func postNotices(c *Command, r *http.Request, user *auth.UserState) Response {
+	requestUID, err := uidFromRequest(r)
+	if err != nil {
+		return Forbidden("cannot determine UID of request, so cannot create notice")
+	}
+
+	decoder := json.NewDecoder(r.Body)
+	var inst noticeInstruction
+	if err := decoder.Decode(&inst); err != nil {
+		return BadRequest("cannot decode request body into notice instruction: %v", err)
+	}
+
+	st := c.d.overlord.State()
+	st.Lock()
+	defer st.Unlock()
+
+	if err := inst.validate(r); err != nil {
+		return err
+	}
+
+	noticeId, err := st.AddNotice(&requestUID, state.SnapRunInhibitNotice, inst.Key, nil)
+	if err != nil {
+		return InternalError("%v", err)
+	}
+
+	return SyncResponse(addedNotice{ID: noticeId})
+}
+
+type noticeInstruction struct {
+	Action string           `json:"action"`
+	Type   state.NoticeType `json:"type"`
+	Key    string           `json:"key"`
+	// NOTE: Data and RepeatAfter fields are not needed for snap-run-inhibit notices.
+}
+
+func (inst *noticeInstruction) validate(r *http.Request) *apiError {
+	if inst.Action != "add" {
+		return BadRequest("invalid action %q", inst.Action)
+	}
+	if err := state.ValidateNotice(inst.Type, inst.Key, nil); err != nil {
+		return BadRequest("%s", err)
+	}
+
+	switch inst.Type {
+	case state.SnapRunInhibitNotice:
+		return inst.validateSnapRunInhibitNotice(r)
+	default:
+		return BadRequest(`cannot add notice with invalid type %q (can only add "snap-run-inhibit" notices)`, inst.Type)
+	}
+}
+
+func (inst *noticeInstruction) validateSnapRunInhibitNotice(r *http.Request) *apiError {
+	if fromSnapCmd, err := isRequestFromSnapCmd(r); err != nil {
+		return InternalError("cannot check request source: %v", err)
+	} else if !fromSnapCmd {
+		return Forbidden("only snap command can record notices")
+	}
+
+	if err := naming.ValidateInstance(inst.Key); err != nil {
+		return BadRequest("invalid key: %v", err)
+	}
+
+	return nil
+}
+
 func getNotice(c *Command, r *http.Request, user *auth.UserState) Response {
 	requestUID, err := uidFromRequest(r)
 	if err != nil {