How to enable a "ListSeats" dbus call for a strictly confined snap?

Abuelodelanada · August 29, 2025, 10:19pm

As part of our efforts to get a node-exporter snap to work smoothly in strictly confined mode we see in /var/log/syslog errors like this one:

2025-08-29T17:45:18.698937-03:00 snapd-pr node-exporter.node-exporter[12178]: time=2025-08-29T20:45:18.698Z level=ERROR source=collector.go:168 msg="collector failed" name=logind duration_seconds=0.005156299 err="unable to get seats: An AppArmor policy prevents this sender from sending this message to this recipient; type=\"method_call\", sender=\":1.73\" (uid=0 pid=12178 comm=\"/snap/node-exporter/x1/bin/node_exporter --collect\" label=\"snap.node-exporter.node-exporter (enforce)\") interface=\"org.freedesktop.login1.Manager\" member=\"ListSeats\" error name=\"(unset)\" requested_reply=\"0\" destination=\"org.freedesktop.login1\" (uid=0 pid=825 comm=\"/usr/lib/systemd/systemd-logind\" label=\"unconfined\")"

As far as I understand, this error is produced by the node-exporter’s logind collector which uses the godbus library to ListSeats using dbus.

I know there is a dbus-interface, but it is not obvious to me how to use it to avoid this kind of errors.

As far as I understand, the logind collector uses this.

James-Carroll · August 30, 2025, 8:26am

Try the Login Session Observe plug, if this is essential to your app critically, you’ll separately want to apply for autoconnection as a store override, as otherwise you’ll need to manually run sudo snap connect $mySnap login-session-observe:login-session-observe

github.com

canonical/snapd/blob/acf0dbd328661b222c295aace125ab874b56380a/interfaces/builtin/login_session_observe.go#L101


      
              member={Session,User,Seat}Removed
              peer=(label=unconfined),
          
          dbus (receive)
              bus=system
              path=/org/freedesktop/login1
              interface=org.freedesktop.login1.Manager
              member=PrepareFor{Shutdow,Sleep}
              peer=(label=unconfined),
          
          dbus (send)
              bus=system
              path=/org/freedesktop/login1
              interface=org.freedesktop.login1.Manager
              member=List{Seats,Sessions,Users},
          
          dbus (send)
              bus=system
              path=/org/freedesktop/login1
              interface=org.freedesktop.login1.Manager
              member=Get{Seat,Session,User},

Abuelodelanada · August 30, 2025, 4:38pm

Thank you very much @James-Carroll !!