"network" plug does not allow outbound ping

[Jacek Nykis]

I'm trying to snap a monitoring daemon. I have the following lines in my snapcraft.yaml:

plugs: [network-bind, network]

But when the daemon tries to ping external hosts it's not allowed to:

audit: type=1400 audit(1498050973.735:72): apparmor="DENIED" operation="create" profile="snap.prometheus-blackbox-exporter.blackbox-exporter" pid=4043 comm="blackbox_export" family="inet" sock_type="raw" protocol=1 requested_mask="create" denied_mask="create"

snap 2.25
snapd 2.25
series 16
ubuntu 16.04
kernel 4.4.0-81-generic

[Guy Taylor (thebiggerguy)]

This also includes attempts at using "ping" via the command line.

[ 134.018690] audit: type=1400 audit(1498730790.150:24): apparmor="DENIED" operation="open" profile="snap.xxx.xxx" name="/bin/ping" pid=1347 comm="bash" requested_mask="r" denied_mask="r" fsuid=0 ouid=

[John Lenton (chipaca)]

You need "network-observe", "network-control", or "firewall-control" for ping.