System-files interface for epa-orchestrator snap

store-requests privileged-interfaces
1

Snap needs to introspect isolcpus and hugepages for each numa node on the given node. Currently apparmor denies the access due to permission issue

cc @wolsen @hemanth

2

This request has been added to the queue for review by the @reviewers team.

3

As per your snapcraft.yaml, I assume you are requesting read access to:

  - /sys/devices/system/cpu/isolated
  - /sys/devices/system/cpu/present
  - /sys/devices/system/node

The default template already grants read access to:

  • /sys/devices/system/cpu/** r, which certainly should grant access to:

    - /sys/devices/system/cpu/isolated
- /sys/devices/system/cpu/present

  • /sys/devices/system/node/node[0-9]*/* r, may also do the work for /sys/devices/system/node .

Could you please share the denials you find when running you snap without this interface connected?

4

hey @jslarraz here are the denials I am seeing

[18873.146660] audit: type=1400 audit(1756207044.078:1084): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.146744] audit: type=1400 audit(1756207044.078:1085): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.146789] audit: type=1400 audit(1756207044.078:1086): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node0/hugepages/hugepages-2048kB/surplus_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.146880] audit: type=1400 audit(1756207044.078:1087): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/nr_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.146925] audit: type=1400 audit(1756207044.078:1088): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/free_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.146967] audit: type=1400 audit(1756207044.078:1089): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/surplus_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.147122] audit: type=1400 audit(1756207044.078:1090): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node1/hugepages/hugepages-2048kB/nr_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.147166] audit: type=1400 audit(1756207044.078:1091): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node1/hugepages/hugepages-2048kB/free_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.147208] audit: type=1400 audit(1756207044.078:1092): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node1/hugepages/hugepages-2048kB/surplus_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0 [18873.147285] audit: type=1400 audit(1756207044.078:1093): apparmor=“DENIED” operation=“open” class=“file” profile=“snap.epa-orchestrator.daemon” name=“/sys/devices/system/node/node1/hugepages/hugepages-1048576kB/nr_hugepages” pid=1339484 comm=“python3” requested_mask=“r” denied_mask=“r” fsuid=0 ouid=0

5

Thanks @hassahma,

All apparmor denial seems to be related to /sys/devices/system/node/node[0-9]*/hugepages/** r. I wonder if we should add this rule to the default template or to a new hugepages-observe interface.

In the meantime, only /sys/devices/system/node would be needed in your system-files interface and it should be named following the usual naming convention (sys-devices-system-node).

6

Hi @jslarraz I have added this one here https://github.com/canonical/snap-epa-orchestrator/pull/5/commits/6fe918a596ec83ee355f236630df43b5acd7f96e

Please let me know if I can publish this snap now?

7

Looks good to me now. +1 from me for granting read access to /sys/devices/system/node via system-files interface (#voteFor)

To grant the request we need to get the required votes from other reviewers and wait for the voting period, which typically is 7 days.

8

+1 from me for granting read access to /sys/devices/system/node as well given the default template doesn’t have it and it makes sense for the snap (#voteFor)

9

Voting period has ended. This request is approved with 2 votes for and 0 votes against.

10

@jslarraz Can I publish the snap now, please ?

11

This request has been approved and the publisher is vetted. This is now live.