tun module is not auto-loaded on UC18/pi3 despite network-control interface being connected

[Lorenz]

1. Build any snap which uses the network-control interface
2. Install it on a Raspberry Pi 3 running Ubuntu Core 18
2. Attach the interface
3. Run it -> permission error

Here is an example:

snapcraft.yaml: https://paste.ubuntu.com/p/SvsjMGWXzD/

Without attaching the network-control interface, mytest.add responds with

    Cannot open netlink socket: Operation not permitted

When connecting the interface, the action is executed as intended on every machine I tested, except the Raspberry Pi 3 running Ubuntu Core 18. Here, another error is displayed

    open: Operation not permitted

I tested the following configurations (clean images with refreshed snaps):

    Ubuntu 19.10 amd64 desktop (working)
    Ubuntu 19.10 server armhf Raspberry Pi 3 (working)
    Ubuntu Core 18 amd64 (working)
    Ubuntu Core 18 armhf Raspberry Pi 3 (NOT working)
    Ubuntu Core 18 arm64 Raspberry Pi 3 (NOT working)

[Sergio Cazzolato (sergio-j-cazzolato)]

Hello, thanks for the report, could you please share the output for:
> journalctl -u snapd
> dmesg

Also could you please indicate which core18 image are you using? and which rpi3 model you are testing?

Thanks

[Lorenz (lorenzhab)]

I'm using the Raspberry Pi 3 Model B+ and the following images:

armhf http://cdimage.ubuntu.com/ubuntu-core/18/stable/current/ubuntu-core-18-armhf+raspi3.img.xz
arm64 http://cdimage.ubuntu.com/ubuntu-core/18/stable/current/ubuntu-core-18-arm64+raspi3.img.xz

I have not tried the beta image yet, because I did not realize there were any. I will do that now.

journalctl -u snapd https://paste.ubuntu.com/p/mk8HX4xfhs/
dmesg https://paste.ubuntu.com/p/5hQ63SYHG6/
snap list https://paste.ubuntu.com/p/XrDVPNjfgd/

I also tried switching the release channel of snapd from stable to edge. However, this did not change anything.

[Lorenz (lorenzhab)]

Just tested the armhf beta image. Unfortunately, the problem still exists here too.

[Jamie Strandboge (jdstrand)]

FYI, I triaged this in https://forum.snapcraft.io/t/raspberry-pi-3-ubuntu-core-18-network-control-interface-issue/14773/4.

Summary:
* pi-kernel should use CONFIG_TUN=y, like our other reference and distro kernels
* to support CONFIG_TUN=m, snap-confine can add /dev/net/tun to the device cgroup so long as it exists

[Matthew Lovibond (ub-matt-hv)]

I've just run into this while trying to setup a rPI 3 openvpn client connection using the easy-openvpn snap. As expected the problem goes away when installing easy-openvpn with --devmode.

[Matt Reimer (mattreimer)]

Ditto here with wireguard.

[Jamie Strandboge (jdstrand)]

https://github.com/snapcore/snapd/pull/8233

[Zygmunt Krynicki (zyga)]

This was fixed in snapd 2.45, which was since released to the stable channel. Marking as released.