Request to allow use of a system-files plug for canonical-livepatch

store-requests privileged-interfaces
1

Hello, the canonical-livepatch snap has added a new system-files plug - sys-kernel-livepatch. Please review and allow the use of this plug.

The purpose of this plug is to allow read access to the kernel livepatch files present in sysfs. The plug will allow read access in the following format:

sys-kernel-livepatch:
    interface: system-files
    read:
      - /sys/kernel/livepatch

This is required to allow the canonical-livepatch snap, read access to the /sys/kernel/livepatch/<patch-name>/transition file to know if a livepatch has been fully applied and has finished its transition phase. This read is needed to make the patch application confirmation, by the canonical-livepatch snap, more robust. Since the will be different for different patches, we will need to have read access to everything in the parent directory. More information can be found in the Linux kernel livepatching documentation.

  • name: canonical-livepatch

  • description: Canonical Livepatch patches high and critical linux kernel vulnerabilities removing the immediate need to reboot to upgrade the kernel, instead allowing the downtime to be scheduled. It is a part of the Ubuntu Pro offering.

    The Canonical Livepatch Client is an application that runs on your machine and periodically checks for patches.

    See our docs at https://ubuntu.com/security/livepatch/docs/livepatch

  • snapcraft: PRIVATE

  • upstream: PRIVATE

  • upstream-relation: Canonical owned and operated snap. I am an engineer working on this project.

  • interfaces:

    • system-files:
      • request-type: installation
      • reasoning: Read kernel livepatch files to know when a patch application is complete (please read above for more context).
2

Access to /sys/kernel/livepatch is expected for livepatch functionality. Could you please clarify if you are requesting manual connection or auto-connection?

3

Hello,

I am requesting for auto-connection of this plug. Read access to /sys/kernel/livepatch is a critical functionality that needs to be present at startup, to be able to confirm livepatch application.

The canonical-livepatch snap already has other plugs defined for the system-files interface that are auto-connected.

4

Hello @prinsonf7,

Thanks for clarifying, this is a +1 (#voteFor) granting auto-connection of the system-files interface with read permissions to /sys/kernel/livepatch given the provided reasoning and clear ownership. Thanks!

5

+2 for, 0 against granting canonical-livepatch read access to /sys/kernel/livepatch via auto-connection to system-files interface. The publisher is vetted.

We will make changes live once a new revision of the snap using the requested system-files interface is uploaded to the store.

1 Like