Publishing eUPF as a strictly confined snap - eBPF privilege

[gruyaume]

Hello,

I am aiming to publish eUPF as a strictly confined snap. The upload failed because the system-files interface is a super-privileged interface and requires a store request. There it is.

---

• name: eupf
• description: Snap for eUPF, a 5G user plane function based on eBPF.
• snapcraft: link to snapcraft.yaml if publicly available
• upstream: link to the upstream repository if open-source or ‘PRIVATE’ otherwise
• upstream-relation: No direct relation
• interfaces:
  • \system-files:
    • request-type: installation and connection
    • reasoning: This application is a 5G core network and uses eBPF to route packets. To do so, the app needs read and write permissions to the /sys/fs/bpf/upf_pipeline host path.

The snap also uses the following interfaces though I don’t think they require manual review:

• network
• network-bind
• network-control
• process-control
• system-observe

Feel free to reach out if you have any questions.

Thank you,

[store-requests-bot]

This request has been added to the queue for review by the @reviewers team.

[jslarraz]

It seems there was already some discussion about this topic in the past. See Request to publish snap with `system-files` plug

+1 from me for (#voteFor) granting eUPF write access to /sys/fs/bpf/upf_pipeline via manual connection of the requested system-files interface

[cav]

Given the previous topic linked above and the reasoning for this interface, +1 (#voteFor) from me as well

[store-requests-bot]

Voting period has ended. This request is approved with 2 votes for and 0 votes against.

[cav]

Publisher is vetted. Request has been granted. This is now live.

[gruyaume]

Thank you very much for the review!