wrappers,tests: add ExecCondition=snap routine user-service-precondition - #17380
Open
olivercalder wants to merge 10 commits into
Open
wrappers,tests: add ExecCondition=snap routine user-service-precondition#17380olivercalder wants to merge 10 commits into
olivercalder wants to merge 10 commits into
Conversation
Add a new `logind` package similar to the existing `systemd` package. Add a private function to invoke `loginctl`, and expose a `SessionClass` method which calls `loginctl show-session auto -p Class` and parses the resulting `Class=foo` to return `foo`. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
olivercalder
requested review from
andrewphelpsj,
Copilot,
natibek,
pedronis and
zyga
July 16, 2026 22:40
|
Wed Jul 22 15:26:24 UTC 2026 No spread failures reported |
olivercalder
force-pushed
the
user-service-exec-condition
branch
from
July 16, 2026 23:57
0f02775 to
2dae8ae
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #17380 +/- ##
==========================================
- Coverage 78.92% 78.92% -0.01%
==========================================
Files 1395 1393 -2
Lines 195977 196016 +39
Branches 2466 2466
==========================================
+ Hits 154680 154705 +25
- Misses 32018 32026 +8
- Partials 9279 9285 +6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
bboozzoo
reviewed
Jul 17, 2026
Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
Add a new `snap routine` subcommand designed to exit with an error code if invoked from within a systemd session with class which is`greeter`. The intent is for this to be called from `ExecCondition` stanzas in systemd unit files. Thus, the subcommand is hidden. Because this will be invoked by `systemd` via `ExecCondition` when deciding whether to start the service, the `SuccessExitStatus` also applies. Thus, we need to be sure not to exit with an error code which happens to match one of the success codes. To accomplish this, the new `snap routine user-service-precondition` command includes an optional argument `--error-exit-code` which takes an integer as an argument, defaulting to 1. The caller must ensure that the exit code passed in is not a success exit status. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
In order to exit with a particular error code, a panic was used, which was then caught and the code used to exit cleanly. However, this is unnecessary for `snap routine user-service-precondition`, we can instead simply add a new error type and handle it like other special error cases in `exitCodeFromError`. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
olivercalder
force-pushed
the
user-service-exec-condition
branch
from
July 21, 2026 03:32
2dae8ae to
c41d019
Compare
Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
We want to ensure that user daemon services do not run for user sessions with class greeter. To do this, we add an ExecCondition stanza to user daemon service files which calls `snap routine user-service-precondition`. However, services may also have `SuccessExitStatus` values set, so we need to ensure that `snap routine user-service-precondition` knows not to exit with an error code which would be misunderstood to be a success. Thus, the service unit generator considers `SuccessExitStatus`, and if `1` is a success code, it finds some non-success code and passes that to the `snap routine user-service-precondition` call via the optional `--error-exit-code` argument. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
Signed-off-by: Oliver Calder <oliver.calder@canonical.com>
olivercalder
force-pushed
the
user-service-exec-condition
branch
from
July 22, 2026 14:12
c41d019 to
5efedb6
Compare
pedronis
reviewed
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is based on #17379. It's the third and final in a chain to implement
ExecConditionchecks to prevent user daemons from running within sessions with classgreeter. Spec here: https://docs.google.com/document/d/1PeWQrLDExIb5I7HqDYm1dn9WzQcqksKBn5a6V5ASvoI/editWe want to ensure that user daemon services do not run for user sessions with class greeter. To do this, we add an ExecCondition stanza to user daemon service files which calls
snap routine user-service-precondition.However, services may also have
SuccessExitStatusvalues set, so we need to ensure thatsnap routine user-service-preconditionknows not to exit with an error code which would be misunderstood to be a success. Thus, the service unit generator considersSuccessExitStatus, and if1is a success code, it finds some non-success code and passes that to thesnap routine user-service-preconditioncall via the optional--error-exit-codeargument.CC @aleasto
This work is tracked internally by https://warthogs.atlassian.net/browse/SNAPDENG-37245