i/builtin: allow access to /var/lib/iscsi/nodes (#17350)

* i/builtin: allow access to /var/lib/icsi/nodes

Newer openiSCSI stores its persistent node database in
/var/lib/iscsi/nodes (https://salsa.debian.org/linux-blocks-team/open-iscsi/-/commit/74f7df689b2c53f9509bc2959804b30887038db9). This adapts the iscsi-initiator to allow access to that
path and binds mounts the /var/lib/snapd/hostfs... path to the expected
place.

Signed-off-by: Miguel Pires <miguel.pires@canonical.com>

Author: miguelpires

interfaces/builtin/iscsi_initiator.go

@@ -19,6 +19,14 @@
 
 package builtin
 
+import (
+	"path/filepath"
+
+	"github.com/snapcore/snapd/interfaces"
+	"github.com/snapcore/snapd/interfaces/apparmor"
+	"github.com/snapcore/snapd/osutil"
+)
+
 /*
  * The iscsi-initiator interface allows snaps to act as iSCSI initiators,
  * enabling them to discover, connect to, and manage iSCSI targets for
@@ -60,8 +68,8 @@ const iscsiInitiatorConnectedPlugAppArmor = `
 /etc/iscsi/isns/ rwk,
 /etc/iscsi/isns/** rw,
 # iSCSI target node information for persistent connections
-/etc/iscsi/nodes/ rwk,
-/etc/iscsi/nodes/** rw,
+/{etc,var/lib}/iscsi/nodes/ rwk,
+/{etc,var/lib}/iscsi/nodes/** rw,
 
 # Runtime files and locks for iSCSI daemon operation
 /run/lock/iscsi/ rw,
@@ -103,7 +111,30 @@ func init() {
 		implicitOnClassic:        true,
 		baseDeclarationSlots:     iscsiInitiatorBaseDeclarationSlots,
 		baseDeclarationPlugs:     iscsiInitiatorBaseDeclarationPlugs,
-		connectedPlugAppArmor:    iscsiInitiatorConnectedPlugAppArmor,
 		connectedPlugKModModules: iscsiInitiatorConnectedPlugKmod,
+		// expose the host's iSCSI persistent node database at /var/lib/iscsi/nodes,
+		// if one exists
+		connectedPlugMount: []osutil.MountEntry{{
+			Name:    filepath.Join("/var/lib/snapd/hostfs", nodesDBDebianPath),
+			Dir:     nodesDBDebianPath,
+			Options: []string{"bind", "rw"},
+		}},
 	}})
 }
+
+const nodesDBDebianPath = "/var/lib/iscsi/nodes"
+
+// AppArmorConnectedPlug updates the snap-update-ns rules to allow the bind
+// mount of the iscsi node DB to the correct location.
+func (iface *iscsiInitiatorInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
+	spec.AddSnippet(iscsiInitiatorConnectedPlugAppArmor)
+
+	emit := spec.AddUpdateNSf
+	emit("  # Bind-mount host's iSCSI persistent node database\n")
+	emit("  mount options=(bind, rw) /var/lib/snapd/hostfs%[1]s/ -> %[1]s/,\n", nodesDBDebianPath)
+	emit("  umount %s/,\n", nodesDBDebianPath)
+	// /var/lib/iscsi/nodes/ does not exist in the snap's base, so we need to
+	// add writable-mimic rules for snap-update-ns to create it.
+	apparmor.GenWritableProfile(emit, nodesDBDebianPath, 1)
+	return nil
+}

interfaces/builtin/iscsi_initiator_test.go

@@ -20,13 +20,17 @@
 package builtin_test
 
 import (
+	"strings"
+
 	. "gopkg.in/check.v1"
 
 	"github.com/snapcore/snapd/interfaces"
 	"github.com/snapcore/snapd/interfaces/apparmor"
 	"github.com/snapcore/snapd/interfaces/builtin"
 	"github.com/snapcore/snapd/interfaces/kmod"
+	"github.com/snapcore/snapd/interfaces/mount"
 	"github.com/snapcore/snapd/interfaces/udev"
+	"github.com/snapcore/snapd/osutil"
 	"github.com/snapcore/snapd/snap"
 	"github.com/snapcore/snapd/testutil"
 )
@@ -94,8 +98,8 @@ func (s *iscsiInitiatorInterfaceSuite) TestConnectedPlugSnippet(c *C) {
 	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/etc/iscsi/static/** rw,")
 	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/etc/iscsi/isns/ rwk,")
 	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/etc/iscsi/isns/** rw,")
-	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/etc/iscsi/nodes/ rwk,")
-	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/etc/iscsi/nodes/** rw,")
+	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/{etc,var/lib}/iscsi/nodes/ rwk,")
+	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/{etc,var/lib}/iscsi/nodes/** rw,")
 	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/run/lock/iscsi/** rwlk,")
 	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/sys/class/iscsi_session/** rw,")
 	c.Assert(apparmorSpec.SnippetForTag("snap.other.app"), testutil.Contains, "/sys/class/iscsi_host/** r,")
@@ -133,3 +137,22 @@ func (s *iscsiInitiatorInterfaceSuite) TestUDevConnectedPlug(c *C) {
 func (s *iscsiInitiatorInterfaceSuite) TestInterfaces(c *C) {
 	c.Check(builtin.Interfaces(), testutil.DeepContains, s.iface)
 }
+
+func (s *iscsiInitiatorInterfaceSuite) TestMountEntryAndNsRule(c *C) {
+	const nsSnippet = "mount options=(bind, rw) /var/lib/snapd/hostfs/var/lib/iscsi/nodes/ -> /var/lib/iscsi/nodes/,"
+
+	mountSpec := &mount.Specification{}
+	c.Assert(mountSpec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+	c.Check(mountSpec.MountEntries(), DeepEquals, []osutil.MountEntry{{
+		Name:    "/var/lib/snapd/hostfs/var/lib/iscsi/nodes",
+		Dir:     "/var/lib/iscsi/nodes",
+		Options: []string{"bind", "rw"},
+	}})
+
+	appSet, err := interfaces.NewSnapAppSet(s.plug.Snap(), nil)
+	c.Assert(err, IsNil)
+	aaSpec := apparmor.NewSpecification(appSet)
+	c.Assert(aaSpec.AddConnectedPlug(s.iface, s.plug, s.slot), IsNil)
+
+	c.Check(strings.Join(aaSpec.UpdateNS(), "\n"), testutil.Contains, nsSnippet)
+}

tests/main/interfaces-iscsi-initiator/task.yaml

@@ -35,6 +35,8 @@ prepare: |
   tests.cleanup defer "$TESTSTOOLS"/fs-state restore-dir /etc/iscsi/static
   "$TESTSTOOLS"/fs-state mock-dir /etc/iscsi/isns
   tests.cleanup defer "$TESTSTOOLS"/fs-state restore-dir /etc/iscsi/isns
+  "$TESTSTOOLS"/fs-state mock-dir /var/lib/iscsi/nodes
+  tests.cleanup defer "$TESTSTOOLS"/fs-state restore-dir /var/lib/iscsi/nodes
   "$TESTSTOOLS"/fs-state mock-dir /etc/iscsi/nodes
   tests.cleanup defer "$TESTSTOOLS"/fs-state restore-dir /etc/iscsi/nodes
   "$TESTSTOOLS"/fs-state mock-file /etc/iscsi/initiatorname.iscsi
@@ -69,6 +71,7 @@ execute: |
 
   echo "And the snap is able to access iSCSI nodes directory"
   "$TEST_SNAP".client -c "ls /etc/iscsi/nodes"
+  "$TEST_SNAP".client -c "ls /var/lib/iscsi/nodes"
 
   echo "And the snap is able to access additional Open-iSCSI persistent state"
   "$TEST_SNAP".client -c "ls /etc/iscsi/ifaces"