StealthOS/subiquity
StealthOS
/
subiquity
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

subiquitycore/log: use 'root' as group for strictly confined snaps 

When setting up the logging in a strictly confined snap, use the 'root' group,
rather than 'adm'. This will not interfere with the sandbox's policy but also
does not result in providing wider access to the logs.

Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
This commit is contained in:
Maciej Borzecki 2024-02-05 16:05:30 +01:00
parent 53180bbc35
commit 5c266cc38c
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
subiquitycore/log.py
View File

@ -23,7 +23,14 @@ def setup_logger(dir, base="subiquity"):
os.makedirs(dir, exist_ok=True) os.makedirs(dir, exist_ok=True)
# Create the log directory in such a way that users in the group may # Create the log directory in such a way that users in the group may
# write to this directory in the installation environment. # write to this directory in the installation environment.
set_log_perms(dir, mode=0o770, group="adm") log_dir_group = "adm"
if os.getenv("SNAP_CONFINEMENT", "classic") == "strict":
# strictly confined snaps are peculiar in the way that we will not be
# able to chown the location as any other group than 'root', this if
# fine though as the snap is already run as the root user and
# effectively the logs location will be more closed
log_dir_group = "root"
set_log_perms(dir, mode=0o770, group=log_dir_group)
logger = logging.getLogger("") logger = logging.getLogger("")
logger.setLevel(logging.DEBUG) logger.setLevel(logging.DEBUG)