"Permission denied" when attempting to read `/proc/net/ipv6_route`

[Gabriel Mougard]

In the MicroCloud project (https://github.com/canonical/microcloud/pull/248), we are reading `/proc/net/route` in order to get IPv4 routing information for our FAN networking setup. Reading this file works well, but when we try to read `/proc/net/ipv6_route` (when IPv4 subnet gw discovery fails), we get 'open `/proc/net/ipv6_route`: permission denied'. We saw this issue rise in our GitHub runner as part of our CI pipeline. This is strange as both files seem to be world readable and convey the same information.

Here is our `snapcraft.yaml` for MicroCloud:

```yaml
name: microcloud
base: core22
assumes:
 - snapd2.59
version: git
grade: devel
source-code: https://github.com/canonical/microcloud.git
summary: Fully automated private clouds
description: |-
 Fully automated private clouds.

confinement: strict

apps:
  # Service
  daemon:
    command: commands/daemon.start
    daemon: simple
    plugs:
      - lxd
      - microceph
      - microovn
      - network
      - network-bind

  # Commands
  microcloud:
    command: commands/microcloud
    plugs:
      - network

parts:
  dqlite:
    build-attributes: [core22-step-dependencies]
    after:
      - raft
    source: https://github.com/canonical/dqlite
    source-type: git
    source-depth: 1
    plugin: autotools
    autotools-configure-parameters:
      - --prefix=
    stage-packages:
      - libsqlite3-0
      - libuv1
    build-packages:
      - libsqlite3-dev
      - libuv1-dev
      - pkg-config
    organize:
      usr/lib/: lib/
    prime:
      - lib/libdqlite*so*
      - lib/*/libuv*

  raft:
    build-attributes: [core22-step-dependencies]
    source: https://github.com/canonical/raft
    source-type: git
    source-depth: 1
    plugin: autotools
    autotools-configure-parameters:
      - --prefix=
    stage-packages:
      - libuv1
      - liblz4-1
    build-packages:
      - libuv1-dev
      - liblz4-dev
      - pkg-config
    organize:
      usr/lib/: lib/
    prime:
      - lib/libraft*so*
      - lib/*/libuv.so*

  microcloud:
    build-attributes: [core22-step-dependencies]
    source: https://github.com/canonical/microcloud
    source-type: git
  source-depth: 1
    after:
      - dqlite
    build-snaps:
      - go
    plugin: nil
    override-pull: |
      craftctl default
      set -ex

      # Download the dependencies
      cd microcloud
      go get -d -v -tags=agent ./...
    override-build: |
      set -ex

      # Setup build environment
      export CGO_CFLAGS="-I${SNAPCRAFT_STAGE}/include/ -I${SNAPCRAFT_STAGE}/usr/local/include/"
      export CGO_LDFLAGS="-L${SNAPCRAFT_STAGE}/lib/ -L${SNAPCRAFT_STAGE}/usr/local/lib/"
      export CGO_LDFLAGS_ALLOW="(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"

      # Build the binaries
      cd microcloud
      go build -trimpath -o "${SNAPCRAFT_PART_INSTALL}/bin/microcloud" -tags=agent ./cmd/microcloud
      go build -trimpath -o "${SNAPCRAFT_PART_INSTALL}/bin/microcloudd" -tags=agent,libsqlite3 ./cmd/microcloudd

      # Strip binaries
      strip -s "${SNAPCRAFT_PART_INSTALL}/bin/microcloud"
      strip -s "${SNAPCRAFT_PART_INSTALL}/bin/microcloudd"
    prime:
      - bin/microcloud
      - bin/microcloudd

  wrappers:
    plugin: dump
    source: snapcraft/

```

[Maciej Borzecki (maciek-borzecki)]

Access to /proc/net/ipv6_route (really /proc/self/net/ipv6_route) is allowed through network-observe. Actually the interface allows `@{PROC}/@{pid}/net/** r,` so you'll be able to access all files under /proc/self/net. Can you add the plug and see if that works for you?

[Simon Déziel (sdeziel)]

@maciej, I guess the surprising bit is why `/proc/self/net/route` is being treated differently than `/proc/self/net/ipv6_route`? Why is the first not requiring the network-observe but the second would?

[Maciej Borzecki (maciek-borzecki)]

@sdeziel that's because the `network` interface https://github.com/snapcore/snapd/blob/8e6c01a05491a2f12e5e59401aeebc7ef162769f/interfaces/builtin/network.go#L34 has:

  #include <abstractions/nameservice>

which internally grants:

  # interface details
  @{PROC}/@{pid}/net/route r,

[Simon Déziel (sdeziel)]

@maciej, ah so that's an oversight in the apparmor abstraction, thanks!

[Simon Déziel (sdeziel)]

https://gitlab.com/apparmor/apparmor/-/merge_requests/1246

[Gabriel Mougard (gabrielmougard)]

Thanks a lot @maciej !