Privileged interfaces request and autoconnect for MongoDB Snaps

store-requests privileged-interfaces
1

Hello, we are currently working on improving our snaps. See (PR)[ https://github.com/canonical/mongodb-artifacts/pull/6 )

I’d like to request access and auto connect to the posix-mq interface and autoconnect to the hardware-observe, network-observe and system-observe for the MongoDB snaps. We have already requested manually review on those

  • Snap name: mongodb-server-replicaset, mongodb-server-sharded, mongos, charmed-mongodb

  • Description:

    • mongodb-server-replicaset: standalone snap. It packages the MongoDB server, MongoDB Shell (mongosh), and command-line tools for replica-set deployments.
    • mongodb-server-sharded : standalone snap. It packages mongod, mongos, MongoDB Shell, and administration tools for sharded MongoDB deployments.
    • mongos: standalone snap. It packages the MongoDB sharded-cluster query router, MongoDB Shell, and related client utilities.
    • charmed-mongodb: packages the MongoDB application used by the mongodb operator (charm)

  • snapcraft:

  • upstream: https://github.com/canonical/mongodb-artifacts

  • upstream-relation: These snaps are maintained by Canonical’s Data Platform team. I am a maintainer and contributor to the upstream packaging repository.

  • Requested interfaces:

    • hardware-observe: auto-connection
    • network-observe: auto-connection
    • system-observe: auto-connection
    • posix-mq: permission for the mongosh-posix-mq-provider slot and auto-connection of the corresponding plug

  • Justification for hardware-observe:

    MongoDB detects host hardware characteristics, including CPU architecture, processor count, and virtualization information. This information is used during startup for resource-aware runtime configuration and is also exposed through MongoDB diagnostic and server-status facilities.

    The interface is required by the mongod, mongos, and mongobridge applications packaged in these snaps. Without it, strict confinement denies access to hardware information under /proc and /sys, resulting in incomplete detection and diagnostic information.

    • Access is minimal: The interface is observational: it does not grant permission to modify hardware configuration.

  • Justification for network-observe:

    MongoDB server processes inspect the host’s networking state and interfaces as part of server initialization, connection handling, logging, and diagnostic data collection.

    The interface is required by the mongod, mongos, and mongobridge applications. Without it, strict confinement prevents these processes from querying networking status information, causing access-denied messages and incomplete server diagnostics.

    • Access is minimal: The requested interface provides read-only observation of network state. It does not allow the snap to change network configuration, routing, firewall rules, or interfaces.

  • Justification for system-observe:

    MongoDB collects system and process information for startup checks, runtime resource detection, server-status reporting. This includes information about CPU and memory usage, process state, and other operating-system metrics.

    The interface is required by the mongod, mongos, and mongobridge applications. It is also used by the packaged mongosh client for system-level runtime information.

    Without the interface, these standard MongoDB operations encounter confinement denials or return incomplete system and diagnostic information.

    • Access is minimal: The interface provides observational access only and does not allow the snap to control other processes or modify system configuration.

  • Justification for mongosh-posix-mq:

    These strictly confined snaps include MongoDB Shell (mongosh) as a first-class command. mongosh needs access to the POSIX message queue named /mongosh; without the interface connection, its message-queue system calls are denied by confinement and the shell does not operate correctly.

    • Access is minimal: only the /mongosh queue is exposed, the consuming plug is used only by the mongosh application, and consumer permissions are restricted to read
2

This request has been added to the queue for review by the @reviewers team.

3

Justification for mongosh-posix-mq:

This is an example of the error logs we get in the journalctl if we do not have this interface.

 Jul 17 16:28:29 moonbow kernel: audit: type=1400 audit(1784298509.305:10715088): apparmor="DENIED" operation="getattr" class="posix_mqueue" profile="snap.mongos.mongosh" name="/" pid=324509 comm="mongosh" requested="getattr" denied="getattr" class="posix_mqueue" fsuid=584788 ouid=0 olabel="unconfined" 
Jul 17 16:28:29 moonbow kernel: audit: type=1400 audit(1784298509.310:10715089): apparmor="DENIED" operation="getattr" class="posix_mqueue" profile="snap.mongos.mongosh" name="/" pid=324509 comm=6D6F6E676F7368206D6F6E676F6462 requested="getattr" denied="getattr" class="posix_mqueue" fsuid=584788 ouid=0 olabel="unconfined" 
Jul 17 16:28:29 moonbow kernel: audit: type=1400 audit(1784298509.310:10715090): apparmor="DENIED" operation="getattr" class="posix_mqueue" profile="snap.mongos.mongosh" name="/" pid=324509 comm=6D6F6E676F7368206D6F6E676F6462 requested="getattr" denied="getattr" class="posix_mqueue" fsuid=584788 ouid=0 olabel="unconfined"
4

Hello @reinosop,

Reviewing this request. Before I proceed, could you please verify for me which snaps need what permissions. My understanding is that you would like all four snaps to receive auto-connect for ‘hardware-observe’, ‘network-observe’, and ‘system-observe’. Then only mongodb-server-replicaset, mongodb-server-sharded, and mongos would require permission for use of the posix-mq SLOT. Is this correct?

Thank you!

5

Hello @elisehdy , Thank you for reviewing this requests.

We need auto-connect for hardware-observe, network-observe, and system-observe and posix-mq for all 4 snaps: mongodb-server-replicaset, mongodb-server-sharded, mongos and charmed-mongodb

Charmed-mongodb use of posix-mq is implemented here : https://github.com/canonical/mongodb-artifacts/pull/18

The implementation for other the other snaps is in : https://github.com/canonical/mongodb-artifacts/pull/6

thank you

6

Hello!

Thank you for the clarification. The technical reasons are clear and sound here, this is a +1 from me for granting auto-connection of the hardware-observe, system-observe, and network-observe interfaces for the snaps mongodb-server-replicaset, mongodb-server-sharded, mongos, charmed-mongodb.

This is also a +1 for granting usage of the posix-mq slot mongosh-posix-mq-provider for the same set of four snaps. No action or approval is needed for auto-connection of this interface, as it should happen automatically for slots/plugs from the same publisher.

What do other @reviewers think?

1 Like
7

I fully agree with @elisehdy review. +1 also from me for granting auto-connection to the requested interfaces.

8

+2 votes for, 0 votes against, granting auto-connect of interfaces hardware-observe, system-observe, and network-observe and installation of slot-interface posix-mq to snaps mongodb-server-replicaset, mongodb-server-sharded, mongos, charmed-mongodb. The publisher is vetted, this is ready to be granted.

Please let me know when a revision of each snap has been uploaded with the requested interfaces so I can grant the necessary permissions. Thank you!

9

This is now live! Please let me know if you experience any issues.