`raw-input` interface should grant read access to `/proc/bus/input/devices`

store-requests privileged-interfaces
1

The `raw-input` interface grants `/dev/input/* rw`, but not read access to `/proc/bus/input/devices`. This file is the standard way userspace enumerates input devices, so snaps relying on it fail even with the plug correctly connected.

Denial seen on Ubuntu 26.04, snapd from the store:

``` apparmor=“DENIED” operation=“open” class=“file” profile=“snap.vocalinux.vocalinux” name=“/proc/bus/input/devices” comm=“python3” requested_mask=“r” denied_mask=“r” ```

Repro: install a snap that enumerates keyboards via `/proc/bus/input/devices` (e.g. Vocalinux), connect `raw-input`, observe the denial and that the snap sees no input devices.

Since the interface already grants full read/write on the input device nodes themselves, allowing read of this read-only enumeration file exposes no additional information.

Request: add `/proc/bus/input/devices r` to the `raw-input` interface policy.

2

This request has been added to the queue for review by the @reviewers team.

3

You just need to additionally add the hardware-observe interface, that provides access to the requested /proc node … I’d also suggest to use the snappy-debug tool and run it alongside your app when looking for interfaces to add, it would actually have suggested the use of hardware-observe in your case.

4

Thank you. I’ll do that. Please consider this closed.

1 Like
5

For anyone stumbling onto this thread later, please note [BUG] snap/snapcraft.yaml may need hardware-observe · Issue #857 · VocaHQ/vocalinux · GitHub.