RPi3 GPIO confinement from a SNAP called from another SNAP

the device itself is using 0600 permissions and is root owned, the interface wont change anything about that fact, so you will still only be able to access it as root …

you can split your app into a daemon part that listens on a pipe, socket etc and does the actual talking to sysfs … all daemons are running as root in snaps …

and have an enduser-side app that talks to the socket, pipe or whatever you use to forward the user commands …

@ogra, @lucyllewy, @jdstrand

Thanks to you all, I have successfully created a chatbot snap that, through a coffee script, and in strict confinement, can access the RPi3 GPIO via /dev/mem with the physical-memory-control and physical-memory-observe slots.

As suggested by ogra, I created a root daemon that listens to a user program.

On the user side (called in the coffee script) i created a program that simply creates a file (mygpio4trigger) in the /tmp directory. On the root side, I made my gpio program a daemon that while-loops until it detects the file, and then it executes the gpio routine and then deletes the file and goes back to the while loop, waiting for the file to appear again.

I don’t need a socket because all this is happening on the same server. It was not clear to me how I would use pipe, since that is for two processes created in the same program. I found a “FIFO” example that claimed to be a pipe between different programs, but it was just writing to and reading from a fifo file in the /tmp directory, so that’s what I did and I dropped the FIFO stuff.

Thanks for all your help. I really have learned a lot from this thread.

Hi,

For what it’s worth, I’ve recently used the gpio-memory-control interface on pi3 using /dev/gpiomem and it works fine.

$ snap version
snap 2.33.1
snapd 2.33.1
series 16
kernel 4.4.0-1092-raspi2

Cheers