snapstate: do not allow classic mode for strict snaps

overlord/snapstate/check_snap.go

@@ -129,6 +129,10 @@ func (e *SnapNeedsClassicSystemError) Error() string {
 // determine whether the flags (and system overrides thereof) are
 // compatible with the given *snap.Info
 func validateFlagsForInfo(info *snap.Info, snapst *SnapState, flags Flags) error {
+	if flags.Classic && !info.NeedsClassic() {
+		return fmt.Errorf("classic confinment requested for a non classic confined snap")
+	}
+
 	switch c := info.Confinement; c {
 	case snap.StrictConfinement, "":
 		// strict is always fine

overlord/snapstate/check_snap_test.go

@@ -540,6 +540,27 @@ confinement: classic
 	c.Assert(err, ErrorMatches, ".* requires classic confinement which is only available on classic systems")
 }
 
+func (s *checkSnapSuite) TestCheckSnapErrorClassicModeForStrictOrDevmode(c *C) {
+	const yaml = `name: hello
+version: 1.10
+confinement: strict
+`
+	info, err := snap.InfoFromSnapYaml([]byte(yaml))
+	c.Assert(err, IsNil)
+
+	var openSnapFile = func(path string, si *snap.SideInfo) (*snap.Info, snap.Container, error) {
+		c.Check(path, Equals, "snap-path")
+		c.Check(si, IsNil)
+		return info, emptyContainer(c), nil
+	}
+	restore := snapstate.MockOpenSnapFile(openSnapFile)
+	defer restore()
+
+	err = snapstate.CheckSnap(s.st, "snap-path", "hello", nil, nil, snapstate.Flags{Classic: true})
+
+	c.Assert(err, ErrorMatches, "classic confinment requested for a non classic confined snap")
+}
+
 func (s *checkSnapSuite) TestCheckSnapKernelUpdate(c *C) {
 	reset := release.MockOnClassic(false)
 	defer reset()

tests/main/install-errors/task.yaml

@@ -76,3 +76,10 @@ execute: |
         exit 1
     fi
     MATCH 'characters that look like dashes but are not' < stderr.out
+
+    echo "Installing a strict snap in classic mode does not work"
+    if snap install --classic test-snapd-tools 2>stderr.out; then
+        echo "snap install ––classic test-snapd-tools should have failed but did not"
+        exit 1
+    fi
+    MATCH 'classic confinment requested for a non classic confined snap' < stderr.out