Implement `org.freedesktop.ModemManager1.InhibitDevice` to take over cleanly the modem from ModemManager when adding UDEV rules is not possible (e.g within a sandboxed environment)

[p1-mmr]

May require to add dependencies + make the code more async?

[p1-mmr]

(Also re-submit the Snap package with a DBus allowance rule request afterwards)

[p1-mmr]

Unfortunately it seems that accessing the InhibitDevice method call is still root-restricted, so not sure if it would be a better solution at all:

• Cf. DBus PolicyKit rules for ModemManager: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/blob/1.24.2/data/org.freedesktop.ModemManager1.conf.polkit
  • "Methods listed here are explicitly allowed or PolicyKit protected. The rest are restricted to root for security."
  • No matching entry
  • (Installed on system at /usr/share/dbus-1/system.d/org.freedesktop.ModemManager1.conf)
• Cf. DBus PolicyKit configuration specification for ModemManager: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/blob/1.24.2/data/org.freedesktop.ModemManager1.policy.in.in
• Cf. DBus node definition: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/blob/1.24.2/introspection/org.freedesktop.ModemManager1.xml#L116

[p1-mmr]

However, it seems that can running a strict-confined Snap as root can pass through the PolicyKit ruling, while accessing or adding runtime udev rules present in /run/udev cannot pass the sandboxing:

Cf.: running a Snap as non-root:

host-machine$ snap run --shell qcsuper

snap$ dbus-send --print-reply --dest=org.freedesktop.ModemManager1 --system /org/freedesktop/ModemManager1 org.freedesktop.ModemManager1.InhibitDevice 'string:/sys/devices/pci0000:00/0000:00:08.1/0000:73:00.4/usb3/3-1/3-1.4' 'boolean:true'
Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 2 matched rules; type="method_call", sender=":1.1225" (uid=1000 pid=988607 comm="dbus-send --print-reply --dest=org.freedesktop.Mod" label="snap.qcsuper.qcsuper (enforce)") interface="org.freedesktop.ModemManager1" member="InhibitDevice" error name="(unset)" requested_reply="0" destination="org.freedesktop.ModemManager1" (uid=0 pid=736957 comm="ModemManager --debug" label="unconfined")

snap$ touch /run/udev/rules.d/a
touch: cannot touch '/run/udev/rules.d/a': Permission denied

snap$ ls -l /run/udev/rules.d/
ls: cannot open directory '/run/udev/rules.d/': Permission denied

Running a Snap as root:

host-machine$ sudo snap run --shell qcsuper

snap# dbus-send --print-reply --dest=org.freedesktop.ModemManager1 --system /org/freedesktop/ModemManager1 org.freedesktop.ModemManager1.InhibitDevice 'string:/sys/devices/pci0000:00/0000:00:08.1/0000:73:00.4/usb3/3-1/3-1.4' 'boolean:true'
method return time=1780308950.869286 sender=:1.990 -> destination=:1.1223 serial=127 reply_serial=2

snap# touch /run/udev/rules.d/a
touch: cannot touch '/run/udev/rules.d/a': Permission denied

snap# ls -l /run/udev/rules.d/
ls: cannot open directory '/run/udev/rules.d/': Permission denied

[p1-mmr]

It seems that InhibitDevice was implemented in December 2018 and merged in ModemManager in January 2019, in cooperation with the fwupd team: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/60

While I reached the ModemManager maintainer about improving the serial device locking mechanism in June 2018 but the ticket was closed in September: https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/6

[p1-mmr]

Snap as root can read the contents of /proc/${MM_PROCESS}/fd but not the symbolic links:

host-machine$ snap run --shell qcsuper

snap# ls -l /proc/736957/fd
ls: cannot read symbolic link '/proc/736957/fd/0': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/1': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/2': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/3': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/4': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/5': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/6': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/7': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/8': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/9': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/10': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/11': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/12': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/13': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/14': Permission denied
ls: cannot read symbolic link '/proc/736957/fd/15': Permission denied