interfaces/builtin/opengl: Add support for libhybris setups

For libhybris/Halium distributions to support graphics acceleration we need to
allow loading a huge set of Android libraries which, due to their proprietary
nature, we don't know the exact dependency chain of beforehand. Luckily we
have the OnTouch property to only allow these permissions to be applied on
Ubuntu Touch systems where this might be needed. snap-confine already prepares
the environment appropriately for us, we just need to punch holes into the
security policy of the OpenGL-consuming Snap.

This allows loading proprietary Android OpenGL ES drivers on Ubuntu Touch.

Author: fredldotme

interfaces/builtin/opengl.go

@@ -27,6 +27,7 @@ import (
 	"github.com/snapcore/snapd/interfaces/apparmor"
 	"github.com/snapcore/snapd/interfaces/mount"
 	"github.com/snapcore/snapd/osutil"
+	"github.com/snapcore/snapd/release"
 )
 
 const openglSummary = `allows access to OpenGL stack`
@@ -217,6 +218,33 @@ unix (send, receive) type=dgram peer=(addr="@var/run/nvidia-xdriver-*"),
 /run/nvidia-persistenced/socket rw,
 `
 
+const openglHybrisConnectedPlugAppArmor = `
+# Hybris support
+/android{,/**} r,
+/{,android/}system/build.prop r,
+/{,android/}vendor/lib{,64}/**           r,
+/{,android/}vendor/lib{,64}/**.so        m,
+/{,android/}system/lib{,64}/**           r,
+/{,android/}system/lib{,64}/**.so        m,
+/{,android/}system/vendor/lib{,64}/**    r,
+/{,android/}system/vendor/lib{,64}/**.so m,
+/{,android/}odm/lib{,64}/**    r,
+/{,android/}odm/lib{,64}/**.so m,
+/{,android/}apex/com.android.*/lib{,64}/**     r,
+/{,android/}apex/com.android.*/lib{,64}/**.so  m,
+/{,dev/}socket/property_service rw, # attach_disconnected path
+/{,dev/}socket/logdw rw, # attach_disconnected path
+/{,dev/}__properties__/** r, # attach_disconnected path
+/dev/{,binderfs/}binder rw,
+/dev/{,binderfs/}hwbinder rw,
+/dev/ashmem rw,
+/dev/ion rw,
+/dev/kgsl-3d0 rw,
+/sys/devices/platform/soc/**/kgsl/kgsl-3d0/gpu_model rw,
+`
+
+
+
 type openglInterface struct {
 	commonInterface
 }
@@ -251,6 +279,14 @@ var openglConnectedPlugUDev = []string{
 	`SUBSYSTEM=="kfd", KERNEL=="kfd"`,
 }
 
+// Set up hybris/Halium device access for GLES to work on Touch
+var openglHybrisConnectedPlugUDev = []string{
+	`KERNEL=="kgsl-3d0"`,
+	`KERNEL=="ion"`,
+	`KERNEL=="binder"`,
+	`KERNEL=="hwbinder"`,
+}
+
 // Those two are the same, but in theory they are separate and can move (or
 // could move) dependently. The first path is as seen on the initial mount
 // namespace of the host. The second path is as seen inside the per-snap mount
@@ -263,6 +299,10 @@ const (
 func (iface *openglInterface) AppArmorConnectedPlug(spec *apparmor.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
 	spec.AddSnippet(openglConnectedPlugAppArmor)
 
+	if release.OnTouch {
+		spec.AddSnippet(openglHybrisConnectedPlugAppArmor)
+	}
+
 	// Allow mounting the Nvidia driver profiles directory
 	hostNvProfilesDir := filepath.Join(dirs.GlobalRootDir, nvProfilesDirInHostNs)
 	if !osutil.IsDirectory(hostNvProfilesDir) {
@@ -301,14 +341,18 @@ func (iface *openglInterface) MountConnectedPlug(spec *mount.Specification, plug
 }
 
 func init() {
+	connectedPlugUDev := openglConnectedPlugUDev
+	if release.OnTouch {
+		connectedPlugUDev = append(openglConnectedPlugUDev, openglHybrisConnectedPlugUDev...)
+	}
 	registerIface(&openglInterface{
 		commonInterface: commonInterface{
 			name:                 "opengl",
 			summary:              openglSummary,
 			implicitOnCore:       true,
 			implicitOnClassic:    true,
 			baseDeclarationSlots: openglBaseDeclarationSlots,
-			connectedPlugUDev:    openglConnectedPlugUDev,
+			connectedPlugUDev:    connectedPlugUDev,
 		},
 	})
 }