Ok, i’ve swapped things around to devmode for now and it’s publishing to edge channel in devmode. After reading through your description a few times I think I follow but could use a little direction.
Given what exists today in the fwupd interface I almost think it makes more sense to have the fwupd snap contain 3 pieces:
- fwupd daemon
- fwupdmgr command line tool
- fwupdtool standalone tool
Then fwupd and fwupdmgr as part of this snap would basically behave and do everything uefi-fw-tools does (and probably supercede the need for it). fwupdtool would be the optional standalone tool as it exists today in the fwupd snap.
So I would think if I took that approach then the fwupd interface can just be extended to do everything needed, fwupd (daemon) would slot fwupd (interface), fwupdmgr (client) would plug fwupd (interface) and fwupdtool would both slot and plug fwupd.
I took a stab at the paths I think would be needed. Do these all make sense to come into the fwupd interface?
diff --git a/interfaces/builtin/fwupd.go b/interfaces/builtin/fwupd.go
index ea137ea63..7d82674c7 100644
--- a/interfaces/builtin/fwupd.go
+++ b/interfaces/builtin/fwupd.go
@@ -52,11 +52,42 @@ const fwupdPermanentSlotAppArmor = `
# For udev
network netlink raw,
+ # Access usb devices
+ /sys/bus/usb/devices/, r
+
# File accesses
# Allow access for EFI System Resource Table in the UEFI 2.5+ specification
/sys/firmware/efi/esrt/entries/ r,
/sys/firmware/efi/esrt/entries/** r,
+ # Access SMBIOS information (fwupd core)
+ /sys/firmware/dmi/tables/ r,
+ /sys/firmware/dmi/tables/** r,
+
+ # Access DP Aux (synaptics mst plugin)
+ /dev/drm_dp_aux0 rw,
+ /dev/drm_dp_aux1 rw,
+ /dev/drm_dp_aux2 rw,
+
+ # Access Thunderbolt (Thunderbolt plugin)
+ /sys/bus/thunderbolt/ r,
+ /sys/bus/thunderbolt/** r,
+ /sys/bus/thunderbolt/devices/*/nvm_non_active*/ r,
+ /sys/bus/thunderbolt/devices/*/nvm_non_active*/** rw,
+
+ # Communicate over SMBIOS WMI (dell plugin)
+ /dev/wmi/dell-smbios rw,
+ /sys/devices/platform/dell-smbios.*/tokens/ r,
+ /sys/devices/platform/dell-smbios.*/tokens/** r,
+
+ # Communicate over SMBIOS SMI (dell plugin)
+ /sys/devices/platform/dcdbas r,
+ /sys/devices/platform/dcdbas/** rw,
+
+ # Turn on Thunderbolt (Thunderbolt force power plugin)
+ /sys/bus/wmi/drivers/intel-wmi-thunderbolt/86CCFD48-205E-4A77-9C48-2021CBEDE341/ r,
+ /sys/bus/wmi/drivers/intel-wmi-thunderbolt/86CCFD48-205E-4A77-9C48-2021CBEDE341/force_power rw,
+
# Allow fwupd to access system information
/sys/devices/virtual/dmi/id/product_name r,
/sys/devices/virtual/dmi/id/sys_vendor r,
So can you please let me know what you think of this approach I propose?