network-control does not allow rfkill on raspberry pi3

[Oliver Grawert]

Snapping a small script to read the rfkill state for a raspberry pi3 like:

apps:
  toggle:
    command: myscript
    plugs: [network, network-control]

with a "myscript" like:

#! /bin/sh

grep -l "phy" /sys/class/rfkill/rfkill*/name

will result in:

Jul 31 09:52:57 pi3 kernel: [ 487.865163] audit: type=1400 audit(1501494777.485:61): apparmor="DENIED" operation="open" profile="snap.bttest.toggle" name="/sys/devices/platform/soc/3f300000.mmc/mmc_host/mmc1/mmc1:0001/mmc1:0001:1/ieee80211/phy0/rfkill0/name" pid=2025 comm="grep" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

The network-control interface is allowed to provide full access to /dev/rfkill but obviously denies the actual device access to the respective network device ...

[Jamie Strandboge (jdstrand)]

Can you add this rule and comment if it resolves the issue for you?

/sys/devices/{pci[0-9]*,platform/soc}/**/rfkill[0-9]*/{,*} r,

[Jamie Strandboge (jdstrand)]

Actually, try this instead:

/sys/class/rfkill/ r,
/sys/devices/{pci[0-9]*,platform,virtual}/**/rfkill[0-9]*/{,**} r,

[Jamie Strandboge (jdstrand)]

This is being discussed in https://forum.snapcraft.io/t/wifi-and-bluetooth-on-snappy-ubuntu-on-a-dragonboard/1297 with a PR here: https://github.com/snapcore/snapd/pull/3634

[Michael Vogt (mvo)]

The PR got merged and is available now.