run-checks: check priority override on ifaces w/ mountinfo rules (#17340)

* run-checks: check prio override on ifaces w/ mountinfo rules

Interfaces that grant access to /proc/self/mountinfo (explicitly or not)
must have a prioritized override (see basePrioritizedSnippets in
interfaces/apparmor/template.go) which swaps out the deny rule.
Otherwise, the deny rule wins out and the interface does not work as
intended.
This adds a static check to run-checks that tries to maintain this
invariant by looking for interfaces that grant /proc/self/mountinfo,
even if by granting broader access (/proc/**, allow file, etc), and
checking whether the file also contains the corresponding override.

Signed-off-by: Miguel Pires <miguel.pires@canonical.com>

Author: miguelpires

run-checks

@@ -182,6 +182,58 @@ missing_interface_spread_test() {
     done
 }
 
+check_mountinfo_override() {
+    # This check verifies that interfaces that grant access to /proc/self/mountinfo
+    # (directly or not) also have a prioritized override (see basePrioritizedSnippets
+    # in interfaces/apparmor/template.go for why this is necessary). We do this
+    # by looking for a "AddPrioritizedSnippet(*, apparmor.MountInfoKey, ...)" call
+    # for any such interfaces.
+
+    local missing_override=""
+    local f
+    for f in interfaces/builtin/*.go; do
+        if [[ "$f" == *"_test.go" ]]; then
+            continue
+        fi
+
+        local out
+        out=$(awk '
+            # if a prioritized override is present, we can stop early
+            /AddPrioritizedSnippet\(.* apparmor\.MountInfoKey/ { m=""; exit }
+
+            # We look for the following types of rules:
+            #   * Explicit mountinfo rules. For example, any combination of:
+            #      owner /proc/self/mountinfo r,
+            #      @{PROC}/@{pid} rw,
+            #      /proc/1234/mountinfo
+            #   * References to the "mountInfoSnippet" variable which contains
+            #      the same rules as the previous item
+            #   * Broad /proc grants:
+            #      owner @{PROC}/** r,
+            #      /proc/** rw,
+            #   * Relevant "allow" rules:
+            #      allow file
+            #      allow all
+
+            /^[[:space:]]*(owner[[:space:]]+)?(\/proc|@\{PROC\})\/(self|@\{pid\}|[0-9]+)\/mountinfo[[:space:]][a-z]*r[a-z]*,/ ||
+            /^[[:space:]]*(owner[[:space:]]+)?(\/proc|@\{PROC\})\/\*\*[[:space:]][a-z]*r[a-z]*,/ ||
+            /^[[:space:]]*allow[[:space:]]+(file|all),[[:space:]]*$/ ||
+            /mountInfoSnippet/ { m = m "      " NR ":" $0 ORS }
+            END { if (m != "") printf "  - %s:\n%s", FILENAME, m }
+        ' "$f")
+        [ -n "$out" ] && missing_override+="${out}"$'\n'
+    done
+
+    if [ -n "$missing_override" ]; then
+        echo "" >&2
+        echo "These interfaces allow access to /proc/*/mountinfo (specifically or not)" >&2
+        echo "without adding the allow rule as a prioritized snippet" >&2
+        echo "(see basePrioritizedSnippets in interfaces/apparmor/template.go):" >&2
+        printf "%s" "$missing_override" >&2
+        return 1
+    fi
+}
+
 forbidden_cmd_go_deps() {
     local -a forbidden_deps=(
         "github.com/snapcore/snapd/testutil"
@@ -389,6 +441,9 @@ if [ "$STATIC" = 1 ]; then
     echo ">> [Go] Checking cmd binaries for forbidden dependencies"
     forbidden_cmd_go_deps
 
+    echo ">> [Go] Checking interfaces that grant mountinfo access use a prioritized override"
+    check_mountinfo_override
+
     if command -v shellcheck >/dev/null; then
         exclude_tools_path=tests/lib/external/snapd-testing-tools
         echo ">> [Bash] Checking shell scripts"