Add security settings

.github/workflows/build.yaml

@@ -16,6 +16,7 @@ jobs:
         run: |
           sudo snap install yq
           sudo snap install rockcraft --classic --edge  --revision=687
+          sudo snap install charmcraft --classic --revision 1349
       - name: Build ROCK
         run: |
           app_version=$(yq '.version' rockcraft.yaml)

.github/workflows/integration.yaml

@@ -27,13 +27,19 @@ jobs:
         uses: charmed-kubernetes/actions-operator@main
         with:
           provider: microk8s
+          channel: "1.27-strict/stable"
+          bootstrap-constraints: "cores=2 mem=2G"
+          juju-channel: 3.1/stable
           # This is needed until
           # https://bugs.launchpad.net/juju/+bug/1977582 is fixed
-          bootstrap-options: "--agent-version 2.9.29"
+          bootstrap-options: "--agent-version 3.1.5"
+      - name: Pin charmcraft version
+        run: |
+          sudo snap refresh --channel=2.2 charmcraft
       - uses: actions/download-artifact@v3
         with:
           name: mongodb-rock
       - name: Install tox
         run: python3 -m pip install tox
       - name: Integration Tests
-        run: sg microk8s -c "tox -e ${{ matrix.env }}"
+        run: sg snap_microk8s -c "tox -e ${{ matrix.env }}"

rockcraft.yaml

@@ -5,52 +5,66 @@ base: ubuntu:22.04 # the base environment for this ROCK
 version: "5.0.14-12" # just for humans. Semantic versioning is recommended
 summary: MongoDB in a rock. # 79 char long summary
 description: |
-    MongoDB is a source-available cross-platform
-    document-oriented database program. Classified
-    as a NoSQL database program, MongoDB uses JSON
-    -like documents with optional schemas.
+  MongoDB is a source-available cross-platform
+  document-oriented database program. Classified
+  as a NoSQL database program, MongoDB uses JSON
+  -like documents with optional schemas.
 license: Apache-2.0 # your application's SPDX license
 entrypoint:
-    - /usr/bin/setpriv
-    - --clear-groups
-    - --reuid
-    - mongodb
-    - --regid
-    - mongodb
-    - --
-    - /usr/bin/mongod
+  - /usr/bin/setpriv
+  - --clear-groups
+  - --reuid
+  - mongodb
+  - --regid
+  - mongodb
+  - --
+  - /usr/bin/mongod
 
 platforms: # The platforms this ROCK should be built on and run on
-    amd64:
+  amd64:
 
 parts:
-    mongo-snap:
-        plugin: nil
-        stage-snaps:
-            - charmed-mongodb/5/edge
-        overlay-packages:
-            - ca-certificates
-    dep-debs:
-        plugin: nil
-        stage-packages:
-            - util-linux
-            - libssh-4
-            - libbrotli1
-    non-root-user:
-        plugin: nil
-        after: [mongo-snap]
-        overlay-script: |
-            # Create a user in the $CRAFT_OVERLAY chroot
-            groupadd -R $CRAFT_OVERLAY -g  584788 mongodb
-            useradd -R $CRAFT_OVERLAY -M -r -g mongodb -u 584788 mongodb
-        override-prime: |
-            craftctl default
-            # Give permission and create the required directories
-            mkdir -p $CRAFT_PRIME/data/db
-            chmod 0755 $CRAFT_PRIME/data/db
-            chown -R 584788:584788 $CRAFT_PRIME/data/db
-    rock-license:
-        plugin: dump
-        source: licenses
-        organize:
-            LICENSE-rock: licenses/LICENSE-rock
+  mongo-snap:
+    plugin: nil
+    stage-snaps:
+      - charmed-mongodb/5/edge
+    overlay-packages:
+      - ca-certificates
+  dep-debs:
+    plugin: nil
+    stage-packages:
+      - libssh-4
+      - libbrotli1
+  non-root-user:
+    plugin: nil
+    after: [mongo-snap]
+    overlay-script: |
+      # Create a user in the $CRAFT_OVERLAY chroot
+      groupadd -R $CRAFT_OVERLAY -g  584788 mongodb
+      useradd -R $CRAFT_OVERLAY -M -r -g mongodb -u 584788 mongodb
+    override-prime: |
+      craftctl default
+      # Give permission and create the required directories
+      mkdir -p $CRAFT_PRIME/data/db
+      chmod 0755 $CRAFT_PRIME/data/db
+      chown -R 584788:584788 $CRAFT_PRIME/data/db
+      # enable security monitoring
+      rocks=usr/share/rocks/
+      mkdir -p ${rocks}
+      ## for deb packages
+      declare -a arr=()
+      arr+=('${db:Status-Abbrev},')
+      arr+=('${binary:Package},')
+      arr+=('${Version},')
+      arr+=('${source:Package},')
+      arr+=('${Source:Version}\n')
+      dpkg-query -W -f "${arr[*]}" > ${rocks}/dpkg.query
+      ## for snap packages
+      cp snap.charmed-mongodb/manifest.yaml ${rocks}
+      cp snap.charmed-mongodb/snapcraft.yaml ${rocks}
+
+  rock-license:
+    plugin: dump
+    source: licenses
+    organize:
+      LICENSE-rock: licenses/LICENSE-rock