Auto-connect request: tabularis password-manager-service

store-requests
1

Forum topic

Title: Auto-connect request: tabularis password-manager-service

Category: store-requests

name: tabularis

description: Tabularis is an open-source desktop database client for PostgreSQL, MySQL/MariaDB, SQLite, and plugin-based database drivers.

store: https://snapcraft.io/tabularis

snapcraft: https://github.com/TabularisDB/tabularis/blob/main/snap/snapcraft.yaml

upstream: GitHub - TabularisDB/tabularis: Open-source desktop SQL workspace for PostgreSQL, MySQL/MariaDB, SQLite and 15+ more databases like DuckDB, ClickHouse, Redis and Firestore. Built-in MCP server for Claude, Cursor and Devin, SQL notebooks and visual EXPLAIN. · GitHub

upstream-relation: I am a maintainer of the upstream project and the publisher of the official Tabularis snap.

Interfaces

password-manager-service

request-type: auto-connection

reasoning:

Tabularis stores credentials for database connections in the user’s system keychain through the Rust keyring crate and libsecret.

Secure credential storage is part of the application’s normal connection workflow. When the interface is disconnected, saving or retrieving database passwords fails with an AppArmor/Secret Service error. Users must then manually run:

sudo snap connect tabularis:password-manager-service

Tabularis only creates and retrieves entries belonging to Tabularis and does not intentionally enumerate or access credentials created by other applications. Credentials are never intentionally stored in plaintext.

The snap uses strict confinement, is published from the official open-source repository, and declares the interface explicitly in snap/snapcraft.yaml.

We understand that password-manager-service provides broad access to the session keyring and that auto-connection is normally restricted. We are requesting an exception because secure storage of database credentials is a core feature of a database client and the disconnected interface causes the standard connection workflow to fail.

2

This request has been added to the queue for review by the @reviewers team.

3

Hi @debba92

The password-manager-service interface grants non-isolated access to all secrets stored in the user’s system keyring, while also making the snap’s own stored credentials accessible to any other application with keyring access. To protect user privacy and system security, auto-connection is rarely granted for this interface. Hence, -1 from me for granting auto-connection of password-manager-service interface to tabularis.

I would suggest looking into portals for managing secrets using libsecret to securely store per-snap isolated credentials, if applicable.

4

Hello @debba92,

Thank you for the detailed request! Unfortunately, I agree with @shishirsub10 in this case. Given its highly-sensitive nature, we prioritize the user’s voice over ease-of-use when it comes to the password-manager-service interface. As such, this is also a -1 from me for granting auto-connect for password-manager-service.