Hi,
I’d like to request classic confinement for ansible-security-scanner (https://snapcraft.io/ansible-security-scanner). I’m the author and it’s open source under Apache-2.0.
It’s a command-line security scanner for Ansible. You point it at a directory of playbooks, roles, or inventories and it statically analyzes them for things like malicious code, RCE, injection, hardcoded secrets, and supply-chain risk, then writes out a report.
The reason I need classic is that people run it against whatever paths they care about, and those usually aren’t in $HOME. In practice that’s things like /etc/ansible, /opt, /srv, a CI checkout, or a mounted volume, and the report can go anywhere the user asks. Since the target path is just whatever gets passed on the command line at runtime, I can’t express it as a fixed personal-files or system-files rule ahead of time, and the home interface only covers $HOME. It’s the same read-everything shape as other scanners discussed in the classic review process thread (the OpenSCAP comment), where the tool has to be able to read arbitrary files and configs to do its job. It doesn’t manage the system or install anything; it only reads what it’s pointed at and writes a report.
For context, it’s also on PyPI and Homebrew, and the snap is built and published straight from the project’s release pipeline.
Happy to answer any questions. Thanks!