Permissions for slcan

eFix · August 3, 2023, 1:24pm

On my way to package slcand as a snap I’m having problems to define the required interfaces. Slcand translates from a serial-port interface to a can-bus interface.

1.) Accessing the serial-port from the gadget snap is working so far, but I’m missing the permissions to call ioctl(fd, TIOCSETD, …). Is this permission granted by another interface definition?

2.) The slcand snap would provide a can-bus plug. How to define this? Defining the plug in the snapcraft.yaml of the snap is not working for me. Is there a similar example with this kind of challenge?

ogra · August 3, 2023, 2:08pm

you should be able to find out when running snappy-debug (from the same named snap) in a second terminal while your app tries to run the ioctl … if there is an interface, snappy-debug should suggest using it in its output …

looking at the source of the canbus interface it seems only the core snap (or rather snapd) can provide the slot for it:

github.com

canonical/snapd/blob/master/interfaces/builtin/can_bus.go#L28


      
          */
          
          package builtin
          
          const canBusSummary = `allows access to the CAN bus`
          
          const canBusBaseDeclarationSlots = `
           can-bus:
             allow-installation:
               slot-snap-type:
                 - core
             deny-auto-connection: true
          `
          
          const canBusConnectedPlugAppArmor = `
          # Description: Can use CAN networking
          network can,
          `
          
          const canBusConnectedPlugSecComp = `
          # Description: Can use CAN networking

(else there would be an - app entry underneath - core) if this is a typical use-case the interface might need to be extended to allow app snaps to provide the slot …

if you instead only need the plug in slcand, make sure to manually connect it using snap connect ... after installing the snap (note the “deny-auto-connection: true” in the above source code)

eFix · August 7, 2023, 3:10pm

Thanks a lot, for pointing me to the right place. In this case it makes sense to consume the CAN frames directly in the snap. Thanks for the hint regarding the tools. I was not able to solve the issues with TIOCSETD yet, as it does not seem to be related to AppArmor, but I keep searching.