Request for auto connection of jami:network-manager

Hello,

I’d like to request auto connection of the network-manager interface for the Jami snap.

The new jami-qt client (currently published to the edge channel for the jami snap, and soon to be moved to stable) needs to talk to NM over DBus to detect network connectivity changes so it could update the IPs and keep the ICE sessions working properly.

An excerpt from snappy-debug (without network-manager connected) when doing snap run jami is included below. FWIW, I already tried with network-manager-observe but it was not sufficient.

= AppArmor =
Time: Feb 18 10:23:54
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop" interface="org.freedesktop.DBus.ObjectManager" member="GetManagedObjects" mask="send" name=":1.7" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
DBus access

= AppArmor =
Time: Feb 18 10:23:56
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
DBus access
Suggestion:
* try adding one of 'network-manager, network-manager-observe' to 'plugs'

= AppArmor =
Time: Feb 18 10:23:56
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.NetworkManager" member="GetDevices" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
DBus access
Suggestion:
* try adding one of 'network-manager, network-manager-observe' to 'plugs'

= AppArmor =
Time: Feb 18 10:23:56
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings" interface="org.freedesktop.NetworkManager.Settings" member="ListConnections" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
DBus access
Suggestion:
* try adding one of 'network-manager, network-manager-observe' to 'plugs'

= AppArmor =
Time: Feb 18 10:23:56
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
DBus access
Suggestion:
* try adding one of 'network-manager, network-manager-observe' to 'plugs'

= AppArmor =
Time: Feb 18 10:23:56
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.NetworkManager" member="GetDevices" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
DBus access
Suggestion:
* try adding one of 'network-manager, network-manager-observe' to 'plugs'

= AppArmor =
Time: Feb 18 10:23:56
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings" interface="org.freedesktop.NetworkManager.Settings" member="ListConnections" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
DBus access
Suggestion:
* try adding one of 'network-manager, network-manager-observe' to 'plugs'

Thank you for your consideration. :slightly_smiling_face:

I am surprised you observed these denials with network-manager-observe since from my understanding these should all be allowed:

Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.DBus.Properties" member="GetAll" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager" interface="org.freedesktop.NetworkManager" member="GetDevices" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop/NetworkManager/Settings" interface="org.freedesktop.NetworkManager.Settings" member="ListConnections" mask="send" name="org.freedesktop.NetworkManager" pid=2649 label="snap.jami.jami" peer_pid=545 peer_label="unconfined"

Are you sure it was definitely connected during this test?

Hi @alexmurray,

Okay so I tried again with a local snap build, and indeed with network-manager-observe connected I don’t see the errors with Suggestions of connecting network-manager or network-manager-observe anymore; but I still see the following in snappy-debug’s output:

= AppArmor =
Time: Feb 24 16:09:07
Log: apparmor="DENIED" operation="dbus_method_call"  bus="system" path="/org/freedesktop" interface="org.freedesktop.DBus.ObjectManager" member="GetManagedObjects" mask="send" name=":1.6" pid=3868 label="snap.jami.jami" peer_pid=540 peer_label="unconfined"
DBus access

And the following log output from Jami:

error initializing NetworkManager client:  GDBus.Error:org.freedesktop.DBus.Error.AccessDenied: An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender=":1.89" (uid=1000 pid=3868 comm="/snap/jami/x1/usr/bin/jami-qt " label="snap.jami.jami (enforce)") interface="org.freedesktop.DBus.ObjectManager" member="GetManagedObjects" error name="(unset)" requested_reply="0" destination=":1.6" (uid=0 pid=540 comm="/usr/sbin/NetworkManager --no-daemon " label="unconfined")

Which corresponds to this line in the Jami code base. I do not see this error when I connect network-manager instead; hence my request for auto-connecting network-manager.

The network-manager interface is privileged as it allows a snap to configure networking as well which I don’t think makes sense for a snap like Jami. So perhaps we need to adjust the network-manager-observe interface to include send permission to the DBus ObjectManager:

# NM implements org.freedesktop.DBus.ObjectManager too
dbus (send)
    bus=system
    path=/org/freedesktop
    interface=org.freedesktop.DBus.ObjectManager
    peer=(label=###SLOT_SECURITY_TAGS###),

@jdstrand would this sound reasonable to you?