Restart another service in configure hook

snowsky · May 5, 2021, 10:07pm

Hi there,

Got a quick question, is it possible to restart another service in the snap’s configure hook script? I am trying to allow some settings from command line snap set SNAP_NAME settings=something. When the snap service started, the configure hook was loaded and the error message returned as systemctl: Permission denied.

Thanks,
Hao

ogra · May 6, 2021, 7:00am

you can restart any service the snap ships inside with snapctl restart $SNAP_NAME.<service name> … you can not restart any services outside of the snap (unless there is an interface that explicitly allows this but even then it is usually through a dbus call and not by giving access to the hosts systemctl command (for obvious security reasons))

snowsky · May 6, 2021, 5:13pm

Thanks @ogra, I guess the command to set a parameter, like snap set system a=b, cannot run in configure hook for it failed in my codes.

ogra · May 6, 2021, 5:18pm

i dont think you can set system options from a snap hook but if you would it would again be snapctl set ... not snap set ... the snap binary is not accessible from inside a snap package, snapctl provides a (limited) route to the features the snap command offers …

system options need to either be set manually (or from a script or tool) outside of confinement or via an entry in a gadget.yaml in case you are on Ubuntu Core

snowsky · May 6, 2021, 9:43pm

Thanks for the hint, and I believe it should work with snapctl set system.journal.persistent=true (I have not tried in an image yet ) Is journalctl command allowed to run in configure hook? I used snap run --shell snap_name.application, then the command journalctl returned Permission Denied.

ogra · May 6, 2021, 9:53pm

you will need the log-observe interface defined and connected for the hook , then you can execute it from the path described in the interface (i dont think it is in $PATH by default)

github.com

snapcore/snapd/blob/master/interfaces/builtin/log_observe.go#L44


# Description: Can read system logs and set kernel log rate-limiting
/var/log/ r,
/var/log/** r,
# for accessing journald and journalctl
/run/log/journal/ r,
/run/log/journal/** r,
/var/lib/systemd/catalog/database r,
/{,usr/}bin/journalctl ixr,
# allow using journalctl on the host to support new logs on classic systems
/var/lib/snapd/hostfs/bin/journalctl ixr,
/var/lib/snapd/hostfs/lib/systemd/*.so* mr,
# journalctl wants this but it grants far more than 'observe' so don't enable
# it. We could silence the denial, but let's avoid that for now.
# capability sys_resource,
# Allow sysctl -w kernel.printk_ratelimit=#
/{,usr/}sbin/sysctl ixr,
@{PROC}/sys/kernel/printk_ratelimit rw,

EDIT: oops, i’m blind, /usr/bin/journalctl is actually in there, so it should just work after connecting the interface.

snowsky · May 6, 2021, 9:55pm

wow, awesome, thanks @ogra

waltermiller · June 3, 2021, 5:46pm

Thanks for this subject of discussion, it helped me too. I appreciate that!