Classic confinement request for my 'server analyzer' app

store-requests classic-confinement
1

Title: Request for classic confinement: shresth-server-analyzer

  • name: shresth-server-analyzer

  • description:
    The Shresth Server Analyzer is a powerful and user-friendly Bash script designed to provide comprehensive insights into the performance and status of a Linux server. This tool is ideal for system administrators, DevOps engineers, and anyone who needs to monitor server health and troubleshoot issues efficiently.

  • snapcraft: Snapcraft YAML

  • upstream: GitHub Repository

  • upstream-relation: I am the developer and maintainer of this project.

  • supported-category:

    • development tools (since it aids in system analysis and debugging)
    • command-line tools (as it provides essential system monitoring features)

  • reasoning:
    shresth-server-analyzer requires classic confinement due to the following technical reasons:

    • It needs access to system logs, including /var/log/auth.log, to analyze failed login attempts, which is crucial for security monitoring.
    • It reads from /proc/ (e.g., /proc/cpuinfo, /proc/meminfo, /proc/loadavg) to monitor CPU usage, memory usage, system load, and running processes.
    • It retrieves OS details from /etc/os-release to display distribution and version information.
    • The snap also interacts with system utilities like ps, top, and df, which rely on full system access.

    Strict confinement is not feasible because the existing Snap interfaces do not provide sufficient access to these system files and logs. The snap needs unrestricted access to system metrics, making classic confinement necessary.

-:heavy_check_mark: I understand that strict confinement is generally preferred over classic.

-:heavy_check_mark: I’ve tried the existing interfaces to make the snap work under strict confinement, but they do not allow access to the required system logs and process monitoring utilities.

2

This request has been added to the queue for review by the @reviewers team.

3

Hey @shresth-kumar-lal

See following suggestion/commentaries (#askForInfo)

It needs access to system logs, including /var/log/auth.log, to analyze failed login attempts, which is crucial for security monitoring.

It can be done via log-observe interface

It reads from /proc/ (e.g., /proc/cpuinfo, /proc/meminfo, /proc/loadavg) to monitor CPU usage, memory usage, system load, and running processes.

system-observe interface should provide equivalent means. If anything cannot be done with system-observe currently it should probably be added there.

It retrieves OS details from /etc/os-release to display distribution and version information.

You can use system-files interface to access this file

The snap also interacts with system utilities like ps, top, and df, which rely on full system access.

You should stage the required packages rather than accessing system binaries. Access binaries from the host system does not qualify a valid reason for classic.

Thanks