Classic confinement request for fastnetmon-community

store-requests classic-confinement
1

  • name: fastnetmon-community

  • description: description of the snap

  • snapcraft: snapcraft.yaml

  • upstream: link

  • upstream-relation: I’m author of original project

  • supported-category: debug tools

  • reasoning:

    FastNetMon is a high-performance network traffic analysis and DDoS detection application. It captures packets directly from network interfaces using Linux AF_XDP and AF_PACKET sockets to achieve line-rate packet processing with minimal latency.

    These packet capture mechanisms require unrestricted access to the host networking stack and network interfaces. The application is intended to operate as a system-level network appliance and must inspect traffic on arbitrary interfaces, which is not compatible with strict snap confinement.

    FastNetMon is installed and administered by system administrators on dedicated servers and is expected to have full access to the host networking environment. Classic confinement is therefore required for its intended use.

[*] I understand that strict confinement is generally preferred over classic.

[*] I’ve tried the existing interfaces to make the snap to work under strict confinement.

2

Have you tried the firewall-control and network-control interfaces which I would expect to provide both of these ?

3

Hello @pavel_odintsov :slight_smile:

Thanks for the request. To move forward with the evaluation, we need a bit more technical context. As @ogra mentioned, have you already tested the snap using strict confinement paired with the network-control and firewall-control interfaces?

If you have tried these and they are failing, could you please share the specific error logs or blocked system calls? This will help us determine if the requirements genuinely dictate classic confinement or if they can be safely resolved using standard interfaces.

4

Even if they can not, I’d totally expect at least AF_PACKET to be permitted through firewall-control and if it is not we should simply expand the interface (if the security team does not object indeed) :wink:

5

Thank you for feedback! We’ve moved to strict mode and so far AF_PACKET works just fine, thank you for help

2 Likes