Classic confinement request: fce

[jog]

I have a foundation cloud engine tooling snap (fce) used by the cpe team for Foundation Cloud Build deployments. It’s classic because we need to create and update .gitconfig and .local/share/juju/ in the users $HOME. BTW it was pushed by the oil-ci-bot@canonical.com user.

[popey]

Ordinarily I’d +1 as having done the background checks, this looks sane.

Is the access limited to only ~/.gitconfig and ~/.local/share/juju or does the snap also need access to other directories and/or other external arbitrary binaries to function correctly?

If access requirements are indeed very limited, would it be possible for us to create a bespoke interface for the tool, rather than use classic? One for @jdstrand at least, in part.

[jog]

Yes, it also needs to access other binaries on the system, that are not necessarily known or even available at the time the snap is build. This tooling is used in a very dynamic deployment environment, driven by the need and requirements of the site at which the cloud is being installed.

[popey]

Thanks for explaining.
Ok, then +1 for classic confinement from me.

[Wimpress]

I would ordinarily give this a +1 but I see that @jdstrand has added an interface to define discrete personal and/or system files that a snap can access. Perhaps classic is not required now and @jdstrand can confirm?

[jog]

Can you provide more information on how to define a discrete file list and I’ll give it a try?

[sparkiegeek]

The personal-files interface

personal-files provides access to the specified files in the user’s home. This interface gives privileged access to the user’s data. Auto-connect: no Attributes: read (plug): list of files and/or directories for read-only access (eg, ‘read: [ $HOME/.file-read, $HOME/.dir-read ]’ write (plug): list of files and/or directories for read/write access (eg, ‘write: [ $HOME/.file-write, $HOME/.dir-write ]’ Specifying a directory in read and write allows access to the directory and all files unde…

The system-files interface

system-files provides access to the specified files in the system that are available in the snap’s runtime environment (eg, files in /etc). This interface gives privileged access to system data. Auto-connect: no Attributes: read (plug): list of files and/or directories for read-only access (eg, ‘read: [ /etc/file-read, /etc/dir-read ]’ write (plug): list of files and/or directories for read/write access (eg, ‘write: [ /etc/file-write, /etc/dir-write ]’ Transitional: no. Requires snapd ver…

[jog]

The fce snap provides tooling to drive installations using juju, which is a classic snap. So it seems I’m blocked at the point where the tooling calls juju. Classic confinement for bootstack-ops snap is a thread describing a similar issue but appears to have never been resolved.

We intend to use this snap internally to support the CPE field consultants and it will remain private. Would you please reconsider allowing classic confinement?

[jog]

BTW, The proposed fce snap’s functionality could be categorized along with these existing snaps:
conjure-up
juju-crashdump
juju-wait
juju-lint
rally
fcbtest
openstackclients

In fact fce uses most of these snaps, which are all classic confinement.

[jog]

@jdstrand are you the best person to make a decision on this?

[jdstrand]

@jog

@jdstrand are you the best person to make a decision on this?

Not typically, but I understand the juju position and have vetted you. Granting use of classic. This is now live.