Skip to content

Scripted client chooses the wrong interface in prompt filter #305

Description

@olivercalder

I'm working on adding a new integration test spread variant for special characters, to test the snapd fix which escapes special characters in prompts.

Snapd PR: canonical/snapd#16854

This addresses canonical/desktop-security-center#188

However, prompting-client.scripted is decoding the second prompt filter in the sequence as a camera prompt, instead of a home prompt:

Attempt to read the first file
+ snap run --shell prompting-client.scripted -c cat /home/test/integration-tests/tmp.52HHn4492c/'[アニメ][ゲーム動画].mkv'
+ FIRST_OUTPUT=a file with square brackets and unicode
+ echo Attempt to read the second file
Attempt to read the second file
+ snap run --shell prompting-client.scripted -c cat /home/test/integration-tests/tmp.52HHn4492c/'foo*?()[]{}\'
failed prompt sequence: expected next prompt to have interface=camera but got home

script: {
  "version": 1,
  "prompt-filter": {
    "snap": "prompting-client",
    "interface": "home",
    "constraints": {
      "path": "/home/test/integration-tests/tmp.52HHn4492c/.*"
    }
  },
  "prompts": [
    {
      "prompt-filter": {
        "constraints": {
          "path": "/home/test/integration-tests/tmp.52HHn4492c/\\\\\\[アニメ\\\\\\]\\\\\\[ゲーム動画\\\\\\].mkv",
          "requested-permissions": [ "read" ]
        }
      },
      "reply": {
        "action": "allow",
        "lifespan": "single",
        "constraints": {
          "path-pattern": "/home/test/integration-tests/tmp.52HHn4492c/\\[アニメ\\]\\[ゲーム動画\\].mkv",
          "permissions": [ "read" ]
        }
      }
    },
    {
      "prompt-filter": {
        "constraints": {
          "path": "/home/test/integration-tests/tmp.52HHn4492c/foo\\\\*\\\\?()\\\\[\\\\]\\\\{\\\\}\\\\\\\\",
          "requested-permissions": [ "read" ]
        }
      },
      "reply": {
        "action": "allow",
        "lifespan": "single",
        "constraints": {
          "path-pattern": "/home/test/integration-tests/tmp.52HHn4492c/foo\\*\\?()\\[\\]\\{\\}\\\\",
          "permissions": [ "read" ]
        }
      }
    }
  ]
}

failed
cat: '/home/test/integration-tests/tmp.52HHn4492c/foo*?()[]{}\': Permission denied

Link to failure in CI: https://github.com/canonical/snapd/actions/runs/24409321016/job/71305198912?pr=16854#step:25:204

This can be reproduced locally by doing the following:

  1. Ensure snapcraft is installed with lxd initialized
  2. snap install image-garden
  3. sudo snap set image-garden spread-variant=plus
  4. sudo snap alias image-garden.spread spread
  5. git clone https://github.com/olivercalder/snapd -b prompting-escape-prompt-path and cd into the project directory
  6. ./run-spread -v garden:ubuntu-24.04-64:tests/main/apparmor-prompting-integration-tests:special_characters
  7. (If you'd like to re-run after tweaking code in tests, you can use NO_REBUILD=1 to prevent the snapd snap from being rebuilt, which takes a while)

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions