Classic Confinement Request for `guest-configs`

store-requests classic-confinement
1

To make the review of your request easier, please use the following template to provide all the required details and also include any other information that may be relevant.

  • name: guest-configs
  • description: guest-configs provides operating system configuration for Linux guest environments running on Google Compute Engine (GCE). It contains configuration and integration components used to configure the guest OS for the Google Compute Engine environment.
  • snapcraft: not yet available
  • upstream: GitHub - GoogleCloudPlatform/guest-configs · GitHub
  • upstream-relation: The snap is maintained and published by Google as part of the Google Compute Engine guest environment tooling.
  • supported-category: public cloud agents
  • reasoning: guest-configs requires classic confinement because its purpose is to configure the host operating system for operation as a Google Compute Engine guest. The package needs to interact with and modify host-level operating system configuration outside of the snap’s own filesystem. This includes system configuration and resources on the host that are not accessible through the existing strict-confinement interfaces.

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces to make the snap to work under strict confinement.

Note that snappy-debug can be used to identify possible required interfaces. See https://snapcraft.io/docs/debug-snaps for more information.

1 Like
Please transfer guest-configs to Google-owned organization account
2

This request has been added to the queue for review by the @reviewers team.

3

Hi @guest-os-snapstore

Thank you for request!

The technical justification for classic confinement is clear and understood and the snap fits within the supported category of public cloud agents.

However, because classic confinement grants unrestricted access to the host system, we require publisher vetting to verify the relationship between the publisher account and the upstream project. As this request comes from a new account, we cannot grant classic confinement until vetting is completed.

To move forward, you have two options:

  1. Transfer snap ownership to Google-owned organization account. Similar request in the past: Please transfer 2 packages to Google-owned organization account

  2. If you wish to maintain the snap under this account, I will being the publisher vetting as per Process for performing Snap Publisher Vetting

Please let us know how you would like to proceed!

4

Hi,

thank you for your suggestions. I have created a request for option 1. Please transfer guest-configs to Google-owned organization account

Please review and thanks again!

5

+1 votes for, 0 votes against, Publisher is vetted, Granting classic confinement to guest-configs snap.