Auto-connection and installation request for uinput in smart-float-keyboard

Hello Canonical Security Team,

I am the developer of smart-float-keyboard GitHub (rahebsaeed/smart-float-keyboard).

Reason:

smart-float-keyboard is an on-screen floating virtual keyboard for Ubuntu (supporting English, French, and Arabic). It requires the uinput interface to inject simulated keystrokes at the kernel level directly into active cursor fields across Wayland and X11 applications.

Please approve the installation constraints and auto-connection.

Thank you, RAHEB Saeed

This request has been added to the queue for review by the @reviewers team.

Hello @rahebsaeed,

The uinput interface is considered a super-privileged, high-risk interface, and is therefore subject to much stricter constraints than other interfaces. As such, I do not believe that smart-float-keyboard currently meets our trust requirements, primarily due to the project’s young age. This is a -1 from me at this time for use and auto-connection of the uinput interface. What do other reviewers think?

Hello @rahebsaeed :slight_smile:

Given the justification provided I can understand the technical reasons why the interface is needed. However as @elisehdy stated, this is a super-privileged interface and your project is really fresh. Manual-connection might be a safer alternative, though (instead of auto-connection).

@elisehdy do you think this is plausible?

Hello all!

One of the requirements for granting manual-connection for the uinput interface is trust in the publisher. This is due to its combination of high level of privileges as well as lack of transparency to the user.

@rahebsaeed as it seems you are a newer publisher and this project is quite young (my understanding is it is about a week old), establishing this trust would require successfully obtaining verified account status. The process for this is described in this forum post. If you would like to pursue manual connection for this snap, please go through the verification process if you are able and let us know here when it is complete.

If verification is not possible or desirable, I would encourage you to re-request use of this interface when the application is more mature and well-known. Please let us know how you would like to proceed, thank you!