Optical-drive plug, allow access to read /proc/sys/dev/cdrom/info?

Should the optical-drive plug allow access to read /proc/sys/dev/cdrom/info? I can’t see anything privileged in the information it provides. The access requested in my makemkv snap is only read and the file is read-only so there should be no requests for write access.

= AppArmor =
Time: Aug 28 20:53:50
Log: apparmor="DENIED" operation="open" profile="snap.makemkv.makemkvcon" 
name="/proc/sys/dev/cdrom/info" pid=32610 comm="makemkvcon" requested_mask="r" 
denied_mask="r" fsuid=1000 ouid=0
File: /proc/sys/dev/cdrom/info (read)
Suggestion:
* adjust program to not access '@{PROC}/sys/dev/cdrom/info'

Hey Daniel! Thanks for raising this issue. I checked and in snapd in master this is fixed:

commit ece2d715d1d66cf323026c658e0fdc543b967d1d
Author: Jamie Strandboge <jamie@ubuntu.com>
Date:   Mon Jun 26 18:39:53 2017 +0000

    interfaces/optical-drive: allow read on /proc/sys/dev/cdrom/info

This means as soon as 2.27 becomes the stable snap (should happen soon) this should work.

2 Likes