// -*- Mode: Go; indent-tabs-mode: t -*-

/*
 * Copyright (C) 2016-2017 Canonical Ltd
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 3 as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

package builtin

const coreSupportSummary = `special permissions for the core snap`

const coreSupportBaseDeclarationPlugs = `
  core-support:
    allow-installation:
      plug-snap-type:
        - core
`

const coreSupportBaseDeclarationSlots = `
  core-support:
    allow-installation:
      slot-snap-type:
        - core
    deny-auto-connection: true
`

const coreSupportConnectedPlugAppArmor = `
# Description: Can control all aspects of systemd via the systemctl command,
# update rsyslog configuration, update systemd-timesyncd configuration and
# update/apply sysctl configuration. The interface allows execution of the
# systemctl binary unconfined and modifying all sysctl configuration. As such,
# this gives device ownership to the snap.

/bin/systemctl Uxr,

/usr/bin/snapctl ixr,

# Allow modifying rsyslog configuration for such things as remote logging. For
# now, only allow modifying NN-snap*.conf and snap*.conf files.
/etc/rsyslog.d/{,*}                     r,
/etc/rsyslog.d/{,[0-9][0-9]-}snap*.conf w,

# Allow modifying /etc/systemd/timesyncd.conf for adjusting systemd-timesyncd's
# timeservers
/etc/systemd/timesyncd.conf rw,

# Allow modifying sysctl configuration and applying the changes. For now, allow
# reading all sysctl files but only allow modifying NN-snap*.conf and
# snap*.conf files in /etc/sysctl.d.
/etc/sysctl.conf                       r,
/etc/sysctl.d/{,*}                     r,
/etc/sysctl.d/{,[0-9][0-9]-}snap*.conf w,
/{,usr/}{,s}bin/sysctl                 ixr,
@{PROC}/sys/{,**}                      r,
@{PROC}/sys/**                         w,

# Allow modifying logind configuration. For now, allow reading all logind
# configuration but only allow modifying NN-snap*.conf and snap*.conf files
# in /etc/systemd/logind.conf.d. Also allow creating the logind.conf.d
# directory as it may not be there for existing installs (wirtable-path
# magic oddness).
/etc/systemd/logind.conf                             r,
/etc/systemd/logind.conf.d/                          rw,
/etc/systemd/logind.conf.d/{,*}                      r,
/etc/systemd/logind.conf.d/{,[0-9][0-9]-}snap*.conf* w,

# Allow managing the hostname with a core config option
/etc/hostname                         rw,
/{,usr/}{,s}bin/hostnamectl           ixr,

# Allow sync to be used
/bin/sync ixr,

# Allow modifying swapfile configuration for swapfile.service shipped in
# the core snap, general mgmt of the service is handled via systemctl
/etc/default/swapfile rw,

# Allow read/write access to the pi2 boot config.txt and the directory
# so that it can dirsync it. 
# WARNING: improperly editing this file may render the system unbootable.
owner /boot/uboot/           r,
owner /boot/uboot/config.txt rwk,
owner /boot/uboot/config.txt.* rwk,

# Allow read/write /etc/environment so that proxy configuration can
# be written
owner /etc/              r,
owner /etc/environment   rwk,
owner /etc/environment.* rwk,
`

func init() {
	registerIface(&commonInterface{
		name:                 "core-support",
		summary:              coreSupportSummary,
		implicitOnCore:       true,
		implicitOnClassic:    true,
		baseDeclarationPlugs: coreSupportBaseDeclarationPlugs,
		baseDeclarationSlots: coreSupportBaseDeclarationSlots,
		// NOTE: core-support implicitly contains the rules from network-bind.
		connectedPlugAppArmor: coreSupportConnectedPlugAppArmor + networkBindConnectedPlugAppArmor,
		connectedPlugSecComp:  "" + networkBindConnectedPlugSecComp,
		reservedForOS:         true,
	})
}
