Comment 1 for bug 2048508

Hi Michał, thanks for bringing this to our attention.

I can confirm from code that what you see is intended behavior, and seems to have been in place for 2 years already.

See: https://github.com/snapcore/snapd/blame/master/overlord/hookstate/ctlcmd/model.go#L153-L176

The model is owned by brand store and protected accordingly which is why the `model` command requires one of the following permissions criteria should be met:

  1. The requesting snap must be a gadget OR
  2. Come from the same brand as the device model assertion OR
  3. Have the snapd-control plug

-> I will request for the documentation to be improved.