bluetooth-control interface doesn't allow to read /sys/bus/usb/drivers/btusb/modules/**

[Federico Gimenez]

A snap declaring a plug on bluetooth-control is unable to read files from /sys/bus/usb/drivers/btusb/*:

$ su -l -c '/snap/bin/generic-consumer.cmd cat /sys/bus/usb/drivers/btusb/module/version' test
cat: /sys/bus/usb/drivers/btusb/module/version: Permission denied
$ snap interfaces
Slot Plug
:account-control -
:alsa -
:autopilot-introspection -
:bluetooth-control generic-consumer
:browser-support -
:camera -
:classic-support -
:core-support core:core-support-plug
:dcdbas-control -
:docker-support -
:firewall-control -
:framebuffer -
:fuse-support -
:hardware-observe -
:hardware-random-control -
:hardware-random-observe -
:home -
:io-ports-control -
:joystick -
:kernel-module-control -
:kubernetes-support -
:log-observe -
:lxd-support -
:mount-observe -
:netlink-audit -
:netlink-connector -
:network -
:network-bind -
:network-control -
:network-observe -
:network-setup-control -
:network-setup-observe -
:opengl -
:openvswitch-support -
:physical-memory-control -
:physical-memory-observe -
:ppp -
:process-control -
:raw-usb -
:removable-media -
:shutdown -
:snapd-control -
:system-observe -
:system-trace -
:time-control -
:timeserver-control -
:timezone-control -
:tpm -
:uhid -

$ dmesg
[ ... ]
[Fri Jun 16 15:55:14 2017] audit: type=1400 audit(1497628515.338:92): apparmor="DENIED" operation="open" profile="snap.generic-consumer.cmd" name="/sys/module/btusb/version" pid=9548 comm="cat" requested_mask="r" denied_mask="r" fsuid=1001 ouid=0

$ snap version
snap 2.26.4
snapd 2.26.4
series 16
kernel 4.4.0-1059-snapdragon

$ snap list
Name Version Rev Developer Notes
core 16-2.26.4 2088 canonical -
dragonboard 16.04-0.18 24 canonical -
dragonboard-kernel 4.4.0-1059.63 25 canonical -
generic-consumer 1.0 x1 -

[Michael Vogt (mvo)]

The reason is that the "modules" subdirectory is actually a symlink to /sys/module/btusb/ - if we want to support this we can just add:
"""
diff --git a/interfaces/builtin/bluetooth_control.go b/interfaces/builtin/bluetooth_control.go
index eee042b1d..8e832acd4 100644
--- a/interfaces/builtin/bluetooth_control.go
+++ b/interfaces/builtin/bluetooth_control.go
@@ -42,6 +42,8 @@ const bluetoothControlConnectedPlugAppArmor = `
   # File accesses
   /sys/bus/usb/drivers/btusb/ r,
   /sys/bus/usb/drivers/btusb/** r,
+ /sys/module/btusb/ r,
+ /sys/module/btusb/** r,
   /sys/class/bluetooth/ r,
   /sys/devices/**/bluetooth/ rw,
   /sys/devices/**/bluetooth/** rw,
""""

but I'm not sure if this is useful.

[Jamie Strandboge (jdstrand)]

I think this is useful. I'll fix this for 2.31.

[Jamie Strandboge (jdstrand)]

PR for 2.31: https://github.com/snapcore/snapd/pull/4536

[Zygmunt Krynicki (zyga)]

The proposed fix has been merged and will be a part of the 2.31 release.