Classic confinment request for alabofur

name: alabofur

description: alabofur is a small “ufw-like” command-line bandwidth shaper. It caps per-interface upload/download speeds on the host and installs a systemd service so the limits persist across reboot. POSIX-sh, no bundled third-party binaries.

snapcraft: alabofur/snap/snapcraft.yaml at main · tuncaybahadir/alabofur · GitHub

upstream: GitHub - tuncaybahadir/alabofur: Simple ufw-like Linux CLI to cap upload/download speeds. · GitHub

upstream-relation: I am the original author and sole maintainer of alabofur.

supported-category: System/network administration utility that must operate on the host’s networking stack and host systemd. (Please advise if a different classification is preferred.)

reasoning: alabofur cannot function under strict confinement, even with the
available interfaces:
1. It configures host traffic control by invoking tc and ip to
create qdiscs/filters on real host interfaces.
2. It loads the ifb kernel module (modprobe ifb) for ingress
redirection (download shaping).
3. It installs and manages a host systemd service unit and calls
systemctl on the host so the limits persist across reboot —
writing to the host’s systemd unit directory is not possible from a
strictly-confined snap.
These operations act directly on the host networking stack, kernel
modules and host systemd, which is not achievable from inside a
strictly-confined snap. The tool is a host-administration utility and
is expected to run as root.

This request has not been added to the review queue. It should be placed in the appropriate store-requests subcategory using the subcategory template for classic-confinement, privileged-interfaces and aliases requests.