Using serialport inside strict snap confinement on Ubuntu

[benfrancis]

Hi,

tl;dr: Does anyone have experience of using the node-serialport library inside strict snap confinement on Ubuntu? If so, how did you get it to work?

I'm afraid this is a bit of a niche question but I'm working on packaging WebThings Gateway (an IoT gateway application) as a snap for use on Ubuntu Core. The gateway has installable add-ons for using different protocols, some of which use USB dongles. One of those add-ons is the Zigbee adapter add-on, which uses node-serialport (via serial-prober-node) to detect Zigbee USB dongles like the XStick.

By default strict snap confinement restricts access to serial ports, but this can be granted via the serial-port snap interface. I have tried manually connecting a serial-port plug of the gateway application to a slot for an XStick USB dongle which was automatically created by hotplug, but the Zigbee add-on fails to detect the dongle.

If I run the snap in devmode (disabling snap confinement) it can use the USB dongle without any problems, which suggests that the problem is due to snap confinement.

If I use snappy-debug to detect AppArmor denials whilst starting the gateway snap I see hundreds of AppArmor denials for files in /run/udev/data/ e.g.

= AppArmor =
Time: Feb  6 17:27:20
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/run/udev/data/c4:43" pid=75453 comm="udevadm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /run/udev/data/c4:43 (read)
Suggestions:
* adjust program to use $SNAP_DATA
* adjust program to use /run/shm/snap.$SNAP_NAME.*
* adjust program to use /run/snap.$SNAP_NAME.*
* adjust snap to use snap layouts (https://forum.snapcraft.io/t/snap-layouts/7207)
* add 'hardware-observe' to 'plugs'

If I filter those out I'm left with:

$ snappy-debug --exclude '/run/udev/data/'
INFO: Following '/var/log/syslog'. If have dropped messages, use:
INFO: $ sudo journalctl --output=short --follow --all | sudo snappy-debug
= Seccomp =
Time: Feb  6 17:25:26
Log: auid=4294967295 uid=0 gid=0 ses=4294967295 subj=snap.webthings-gateway.webthings-gateway pid=75052 comm="node" exe="/snap/webthings-gateway/x1/bin/node" sig=0 arch=c000003e 330(pkey_alloc) compat=0 ip=0x706c69c2cf6b code=0x50000
Syscall: pkey_alloc

= AppArmor =
Time: Feb  6 17:25:26
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high" pid=75052 comm="node" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high (read)
Suggestion:
* adjust program to not access '/sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high'

= Seccomp =
Time: Feb  6 17:25:27
Log: auid=4294967295 uid=0 gid=0 ses=4294967295 subj=snap.webthings-gateway.webthings-gateway pid=75098 comm="node" exe="/snap/webthings-gateway/x1/bin/node" sig=0 arch=c000003e 330(pkey_alloc) compat=0 ip=0x7c8240d3df6b code=0x50000
Syscall: pkey_alloc

= AppArmor =
Time: Feb  6 17:25:27
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high" pid=75098 comm="node" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high (read)
Suggestion:
* adjust program to not access '/sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high'

= Seccomp =
Time: Feb  6 17:25:28
Log: auid=4294967295 uid=0 gid=0 ses=4294967295 subj=snap.webthings-gateway.webthings-gateway pid=75112 comm="node" exe="/snap/webthings-gateway/x1/bin/node" sig=0 arch=c000003e 330(pkey_alloc) compat=0 ip=0x75c72191af6b code=0x50000
Syscall: pkey_alloc

= AppArmor =
Time: Feb  6 17:25:28
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high" pid=75112 comm="node" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high (read)
Suggestion:
* adjust program to not access '/sys/fs/cgroup/system.slice/snap.webthings-gateway.webthings-gateway.service/memory.high'

= AppArmor =
Time: Feb  6 17:25:29
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/sys/bus/isa/devices/" pid=75126 comm="udevadm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /sys/bus/isa/devices/ (read)
Suggestion:
* adjust program to not access '/sys/bus/isa/devices/'

= AppArmor =
Time: Feb  6 17:25:29
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/sys/bus/eisa/devices/" pid=75126 comm="udevadm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /sys/bus/eisa/devices/ (read)
Suggestion:
* adjust program to not access '/sys/bus/eisa/devices/'

= AppArmor =
Time: Feb  6 17:25:29
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/sys/bus/snd_seq/devices/" pid=75126 comm="udevadm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /sys/bus/snd_seq/devices/ (read)
Suggestion:
* adjust program to not access '/sys/bus/snd_seq/devices/'

= AppArmor =
Time: Feb  6 17:25:29
Log: apparmor="DENIED" operation="open" class="file" profile="snap.webthings-gateway.webthings-gateway" name="/sys/bus/xen/devices/" pid=75126 comm="udevadm" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
File: /sys/bus/xen/devices/ (read)
Suggestion:
* adjust program to not access '/sys/bus/xen/devices/'

Does any of this look familiar to serialport developers? I'm looking for clues as to why I can't access the USB dongle from inside snap confinement.

See also: WebThingsIO/gateway#3152

Many thanks

Ben

[benfrancis]

Ooh, I think I may have figured it out. I think it requires the serial-port, raw-usb and hardware-observe interfaces to be connected (and the experimental hotplug support).

Now the problem is that the user has to manually connect the serial-port interface for every USB dongle they connect.