gnome-boxes is a virtual machine application that uses qemu to create and manage various VM’s. The gnome-boxes snap has recently been transferred to Canonical and needs a few auto connections to make the app run properly. I am requesting auto-connection for the following interfaces:
kvm - needed to be able to create a VM
process-control - needed to be able to launch the window of a new VM at creation time. Existing VMs will work without this but they are unusably slow.
audio-record - while this doesn’t impact the ability to run VMs, a user may expect this to be connected for expected behavior.
camera - while this doesn’t impact the ability to run VMs, a user may expect this to be connected for expected behavior.
The case for gnome-boxes requiring kvm and process-control is well understood so +1 on those from me.
Considering all the voices involved in snap security and privacy though, I’m not sure that it makes sense for a VM management application to auto-connect to camera and audio-record. It certainly makes sense as a use-case, and manual connection is possible, but I think it might be preferable that users make an explicit decision to enable them. I personally wouldn’t expect a VM management snap to automatically have webcam and mic access, given it’s not the main purpose of the application. -1 on those two auto-connects from me.
It might not be all that obvious that audio-record and camera need to be connected when they try to access those devices from within their VM, but I’m fine if we don’t auto-connect those for now and see what kind of feedback we get.
The description of gnome-boxes makes it clear that it needs auto-connection of kvm and process-control interfaces, therefore +1 from me auto-connect of these two.
However, regarding audio-record and camera, while their manual connection makes sense, I am not convinced about the necessity of having them as auto-connected in the snap, therefore I’m inclined to give -1 for their auto-connect
I see your point about audio-record and camera not being auto-connected and agree it’s not strictly necessary for the application to work. I would be fine with just kvm and process-control.
