Long story short we’re going to need a specialist interface in snapd to handle the LSI snap, purely because its a very different creature to the ones we’re used to dealing with.
Before I go making PRs I wanna discuss this first from a security perspective, so I’m tagging @jdstrand into the convo here. Right now our initial steam-support
interface is being prealpha tested in the Solus repos, and you can see our patch here:
I basically need help in making this interface only ever autoconnect for the linux-steam-integration
snap, as it pops a number of holes through apparmor to make games work. Now, the PCI and USB stuff can be largely ignored in the current patch as they won’t be sent in my first revision. The main thing to be concerned
about is the way in which games work, such as certain titles needing ptrace (Feral Interactive) or the lack of a PPID
identifier in AppArmor to allow filtering the /proc/*/environ
read for Game Dev Tycoon…
Then lastly there is the obvious issue that a great many of those paths (in /usr
) are specific to the solus-runtime-gaming
contents, which provide all the necessary support items to allow games using OpenAL to work, etc. The biggest hole popper I see in permissions is this:
########################
# Disks/Media #
########################
# Steam requires +x permissions on the partitions and will perform
# such a test:
# sh: /run/media/bigdisk/games//steamapps/.steam_exec_test.sh: /bin/sh: bad interpreter: Permission denied
/run/media/**/.steam_exec_test.sh ixmrw,
# Libraries and executables on other partitions require map + execute permissions
/run/media/**/steamapps/common/** ixm,
If we want folks to be able to play games on other partitions (Which, we really do) then we need to be able to execute the games from within the steamapps tree(s). So - any help that anyone can give me in securing the interface, and making it autoconnect only for LSI, will be GREATLY appreciated. The sooner we can get past this stage the sooner we can get LSI onto stable, and then move onto udev access (i.e. using my PS4 controller with the Steam snap :))