Qt network bearer & NetworkManager access (extend network_observe?)


#1

Qt network internally can integrate with NetworkManager to get info on interface status and all sort of magic.

Currently there is no snapd interface to supply the necessary access privileges (excluding the neworkmanager one which gives full access to NM, so it’s unsuitable for most cases that do not actually want to control anything but only inspect the network states for being up/online/etc).

This is something every HTTP using Qt application needs to supply the best user experience.

Relevant Qt code

Here’s a dump of read-only accesses that HTTP GET requests would cause

Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.NetworkManager" member="GetDevices" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings" interface="org.freedesktop.NetworkManager.Settings" member="ListConnections" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/9" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/9" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/8" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/2" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/7" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/2" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/5" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/4" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings/41" interface="org.freedesktop.NetworkManager.Settings.Connection" member="GetSettings" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:14 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings/18" interface="org.freedesktop.NetworkManager.Settings.Connection" member="GetSettings" mask="send" name="org.freedesktop.NetworkManager" pid=21895 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.NetworkManager" member="GetDevices" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings" interface="org.freedesktop.NetworkManager.Settings" member="ListConnections" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/9" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/9" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/8" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/2" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/7" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/2" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/ActiveConnection/5" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Devices/4" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings/41" interface="org.freedesktop.NetworkManager.Settings.Connection" member="GetSettings" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'
Nov 08 17:16:15 polaris audit[1106]: USER_AVC pid=1106 uid=103 auid=4294967295 ses=4294967295 msg='apparmor="ALLOWED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings/18" interface="org.freedesktop.NetworkManager.Settings.Connection" member="GetSettings" mask="send" name="org.freedesktop.NetworkManager" pid=22098 label="snap.peruse.peruse" peer_pid=1126 peer_label="unconfined"
                                      exe="/usr/bin/dbus-daemon" sauid=103 hostname=? addr=? terminal=?'