Interface required to access /proc/cmdline and character device /dev/abc

snapcraft
1

Hi team,

I would like to know the interface to access @{PROC}/@{pid}/cmdline and /dev/ for my snap.

Thanks

2

Accessing your own /proc/<pid>/cmdline is allowed by the default apparmor template. For reading cmdline of other processes you’ll need system-observe interface. The interface is not auto-connected by default.

which device?

3

Thanks for quick response. Yes I am registering character device and I need interface to access it. Is it custom-device interface applicable here ?

4

What kind of device is it? What’s the device node name under /dev?

5

If you are unsure which interfaces your application needs you can use the snappy-debug tool from the snappy-debug snap and run it alongside your snapped application, this will print suggestions for well known interfaces (like system-observe avove)…

6

Thanks for the input. I shall verify it and update back .

7

I have added the system-observe,hardware-observe & network-control , interface and issue is ruled but after running with snappy debug -

I seeing these issues repeatedly on screen -

= AppArmor = Time: Mar 05 08:56:47 Log: apparmor=“DENIED” operation=“capable” profile=“/snap/snapd/20671/usr/lib/snapd/snap-confine” pid=8827 comm=“snap-confine” capability=12 capname=“net_admin” Capability: net_admin Suggestions:

= AppArmor = Time: Mar 05 08:56:47 Log: apparmor=“DENIED” operation=“capable” profile=“/snap/snapd/20671/usr/lib/snapd/snap-confine” pid=8827 comm=“snap-confine” capability=38 capname=“perfmon” Capability: perfmon Suggestions:

  • adjust program to not require ‘CAP_PERFMON’ (see ‘man 7 capabilities’)
  • do nothing if program otherwise works properly

Do they impact snap application working ? Thanks,

8

No, they are false positives of the snap-confine command, you can ignore everything that is not directly related to your snap, snappy-debug also has some filter options to only have denials listed on a per snap basis

9

Okay thank you for quick response .

10

Hi,

Yes , I am trying to create a custom char driver inside /dev/ and my c code is trying to access it. So I would like to know the interface to access it. I should be able to read/write to this driver from snap app.

Thanks, Shriya

11

Have you looked at The custom-device interface ? The slot and the plug can be defined within the same snap, in which case you would then establish a connection by running: snap connect mysnap:plug-name mysnap:custom-device-slot.

12

Thanks for your input. Yes, I have gone through it.

As per the documentation , the custom-device slot needs to be part of gadget snap and custom-device plug should be referred in application snap ? The implementation is always the same ? It would be great if you point to an example where this has been implemented.

Thanks.

13

It does not. The documentation covers the most common case, but in practice the slot can be provided by the snap itself. See https://github.com/snapcore/snapd/pull/13521/files#diff-987626e55e6664d9cf20d636dfb29466d6f743094209d2bdf5179320370f9fc1 for an example. The same PR contains a test which connects the plug to the slot provided by the same snap.

14

Oh great !! Thanks a lot, I shall implement and update back on this.