1

I'm currently leading an effort to make our application available as a snap for Ubuntu Core 16.04 LTS. I'm presently developing on:

(classic)mike@localhost:~/$ uname -a
Linux localhost.localdomain 4.4.0-1030-raspi2 #37-Ubuntu SMP Thu Oct 20     15:06:25 UTC 2016 armv7l armv7l armv7l GNU/Linux

(classic)mike@localhost:~/$ snap --version
snap    2.28.5
snapd   2.29.3
series  16
kernel  4.4.0-1030-raspi2

Please note that the raspberry pi is not our final target platform but it makes a suitable POC for the time being.

My question is in regards to connecting non-auto-connect snap interfaces, more specifically, how to do it from either code (c) or at service start via systemd. I am familiar with how to connect snaps from the command line:

snap connect [snap_name]:mount-observe :mount-observe

However, our application runs as a service - the command line will not be available to manually connect this interface, and access to this, and other plugs, is mandatory for the normal function of our application. I'm very eager to find a way to connect these 'non-auto' plugs through some other mechanism.

I have tried running something like:

sprintf(command, "snap connect %s:mount-observe :mount-observe", SNAP_NAME);
system(command);

From c code and I have also tried running:

snap connect [snap_name]:mount-observe :mount-observe

in a script via snapcraft.yaml:

app:
  command: bin/my-wrapper-that-will-call-my-app.sh

but neither seems to provide the desired result. I will see Security Policy exceptions like:

    Log: apparmor="ALLOWED" operation="exec" profile="snap.snap_name.my-service" name="/usr/bin/snap" pid=24603 comm="sh" requested_mask="x" denied_mask="x" fsuid=0 ouid=0 target="snap.snap_name.my-service-service//null-/usr/bin/snap"
    File: /usr/bin/snap (exec)
    Suggestions:
    * adjust snap to ship 'snap'
    * adjust program to use relative paths if the snap already ships 'snap'

and, although I'm running in devmode, still do not see my plugs connected from 'snap interfaces' output.

I was unable to find any reference to this type of usage in the documentation - what am I missing? Is my workflow not possible? How can I connect interfaces without requiring interaction from the user at the command line - please consider that my application is a service - my install base will not have command line access.

Best regards, Mike James

1

The Ubuntu security team is very much involved with the development of interfaces. The only ones that are automatically connected by default are the ones that either pose relatively little risk (e.g. network) or cause significant breakage in the typical application (e.g. x11). The ones that aren't automatically connected are that way for a reason: they can be abused and aren't required for the typical application. As a result of the possibility for abuse, connecting interfaces from within the snap kind of defeats the entire purpose of confinement, which explains why you've been unable to do it!

There are two ways to get privileged interfaces connected. Either your user needs to opt into it (i.e. connect the interface manually), or you can request a more thorough vetting from the security team by creating a forum topic in the "store" category of the forum, asking for an exception to be made for your snap, and have these interfaces automatically connected. It's not a rubber stamp; you'll need to provide justification for using them, but such exceptions aren't unusual.

| improve this answer | |
  • Thank you very very much! That is a perfectly reasonable restriction - my only confusion was that I was unable to locate such an explanation in the available documentation. I will follow up with the appropriate channels offline. If you are in a position to add your answer to the interfaces documentation, I feel it would be very helpful for future developers - Thanks again! (I'll provide the PGP key next time:)) – Mike James Nov 25 '17 at 21:06
  • Thanks Mike, I've proposed a blurb to the interfaces doc. – Kyle Nov 26 '17 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.