Autoconnect request for dmtr/fmtr ping wrappers

[yvs]

dmtr and fmtr are wrappers of system ‘ping’ tool for displaying tracepath to a target. Unfortunately, snap core’s ping doesn’t work without network-control/network-observe permissions. Meanwhile I’ve added info message about adding these permissions at runtime, but maybe it’s better to be auto-connected. So I’d like to make request for auto-connect any of network-control or network-observe caps for dmtr and fmtr. Or if you have some ideas how to not elevate them beside of system ping, please share it.

Thanks

[alexmurray]

If your snap requires the use of say raw sockets (as is usually required by ping etc), then network-observe should be sufficient. network-control provides additional permissions, but it is best to follow the principle of least privilege, and so your snap should only plug network-observe.

+1 from me for auto-connect of network-observe for dmtr and fmtr.

[yvs]

Thank you for your reply and explanation on network-* use.
Below there’s a bit about details for what it’s needed.

snap requires the use of say raw socket

themselves these apps don’t use raw sockets, but they call system ‘ping’ tool which does

your snap should only plug network-observe

Okay, so far it uses ‘network-control’ in working instanses, I’ll change that to ‘network-observe’ synchronically with adding it

it is best to follow the principle of least privilege

No doubt, maybe it’d be even better (imho) to grant it for snap core’s ping directly not via user code, this matter is referred in

Enforcing permissions not needed by app itself, but needed by sandbox

Can you please give some hints how to drop down not needed permissions of snap app. Details: there’s an app parsing and displaying output of ‘ping’ tool (note: std ‘ping’ tool is included in all snap cores). Permissions that need to be granted in case of use it in snap infrastructure comparing to use out of snap scopes: out of snap ecosystem, with deb or apk package for example: There’s no need to grant anything extra because ‘ping’ itself has enough them to ping, it’s granted via fine-grain…

[ogra]

@yvs

maybe it’d be even better (imho) to grant it for snap core’s ping directly not via user code

That would mean removing the users control over what she allows a snap to access… i.e. every snap could start pinging the world, starting DOS ping attacks and whatnot without the user to be able to turn it off… keeping the control in a user controlled interface connection they can disconnect as needed/desired is surely the better choice here…

[yvs]

In general I agree it’s reasonable, but… aside from the fact that the same is applicable to tcp (allowed by default by network plug) that every snap could start sending tons of tcp requests around the world

[sahnaseredini]

As explained in the previous comments, I agree that network-control would provide unnecessary permissions that are not required by the snap. Therefore, +1 from me for auto-connect of network-observe interface to dmtr and fmtr snaps.

[yvs]

beforehand, I’ve already changed network-control plug to network-observe in beta version to be ready to move it to stable.

Thank you all for your suggestions and explanations

[emitorino]

+2 votes for, 0 votes against, granting auto-connect of network-observe to fmtr and dmtr. This is now live.