Should allow running programs from /usr/lib and /usr/libexec

[smcv]

Describe the bug

Please see ValveSoftware/steam-runtime#586, which is a broader issue in which a user reports that Dota 2 (in a Steam Linux Runtime container) doesn't work in the Snap-packaged version of Steam.

The part I'm referring to in this particular issue report is:

        "error" : "Failed to execute child process “/usr/libexec/steam-runtime-tools-0/i386-linux-gnu-detect-lib” (Permission denied)"
        "error" : "Failed to execute child process “/usr/libexec/steam-runtime-tools-0/i386-linux-gnu-detect-platform” (Permission denied)"

To Reproduce
I've been unable to start Steam as a Snap app successfully myself, but presumably something like this:

Install and run Steam as a Snap app. Retrieve Steam -> Help -> System Information.

Expected behavior
Diagnostic programs in the Steam Linux Runtime container's /usr/libexec/ should be runnable. We don't currently install diagnostic programs into /usr/lib, but we might in future, and if we do, those should be runnable too.

In fact https://github.com/snapcore/snapd/blob/master/interfaces/builtin/steam_support.go appears to allow running anything matching /usr/bin/** or /usr/sbin/**, but not /usr/libexec/** or /usr/lib/**.

Granting ixr access to all of /usr would be a lot more future-proof: we cannot predict what pressure-vessel will need to do to accommodate future OSs, app frameworks and games. There is no security benefit in preventing access to any of this - the same files can be accessed via $HOME anyway - so the only thing that's being achieved by having such a fine-grained AppArmor profile is to stop future versions of Steam from working reliably.

[kenvandine]

@alexmurray what are your thoughts on allowing ixr for /usr in the steam-support interface as a means to future proof the steam snap?

[alexmurray]

@kenvandine I don't see any good reason to not allow such a change - AFAIU this content is all controlled via steam and it could just as easily put something into /usr/libexec as /usr within the pressure-vessel container so I think this would be a reasonable change.

[ashuntu]

canonical/snapd#12823 was merged and should be live in snapd edge.