Teams-for-linux: Please request auto-connection to camera for the snap

[galgalesh]

As you know, the teams-for-linux snap doesn't have access to the camera by default. Users have to turn this on manually, which is not great user experience. There is a process to request auto-connection for this interface, however.

Similar snaps such as Discord have been granted auto-connection to the camera. As an example, their request is here: https://forum.snapcraft.io/t/camera-plug-auto-connect-for-discord/2730

More info about permission requests: https://snapcraft.io/docs/permission-requests

Requesting this auto-connection is relatively easy and it improves user experience a lot. Let me know if you have more questions about this.

[IsmaelMartinez]

Hi, feel free to request it. I don't think its only the owner that can request this. Thanks for sharing!!

[galgalesh]

I'm note entirely sure if other people can create these requests, but we'll see. Here it is: https://forum.snapcraft.io/t/auto-connect-camera-to-teams-for-linux/16633

[IsmaelMartinez]

I am not the owner of that snap... I do publish to it but the initiative was from @julianalarcon . Thanks for reporting it! It will make life a bit easier. Ta

[julian-alarcon]

I have no issues to make the changes if this is approved. But I think that no changes are required in the snap build configuration.

[IsmaelMartinez]

thanks @julian-alarcon. I do also suspect there are no changes to be done in here... a part from updating the documentation to remove or update the "enable camera" step.

[josefschabasser]

Original Post

I have no issues to make the changes if this is approved. But I think that no changes are required in the snap build configuration.

I have looked at the snapcraft.yaml, and it seems fine. The snap camera interface won't auto-connect by default (https://snapcraft.io/docs/camera-interface), so this is intended behavior. But why do certain other snaps automatically connect to the camera, like zoom? Zooms snapcraft.yaml doesn't even contain the camera plug.

$ snap connections | grep -E 'Interface|camera'
Interface                 Plug                                    Slot                             Notes
camera                    teams-for-linux:camera                  :camera                          manual
camera                    zoom-client:camera                      :camera                          -

EDIT: I was looking at the wrong snapcraft.yaml.

EDIT2: This whole snap stuff seems very complicated and the documentation is meh. How does one request auto-connect for a plug?

The more I read, the less I like snap. Auto-connect requests for interfaces that don't do that by default are managed at store level, not inside the snapcraft.yaml or other files. Auto-connect for such interfaces is done via manual requests in the store forum. Is this an Aprils fools joke? This makes it hard to manage and work with. Adding and removing stuff through forum requests naturally takes ages. I think this is bad for security, because there is no list of such permissions in the code, web store or desktop store. You have to manually compare snapcraft.yaml (or the desktop stores permission list) to the snapcraft documentation and find auto-connected plugs that don't do that by default. Snap definitely is not production-ready because of this and other issues (e.g. snapcore/snapd/pull/7129 and the mouse cursor issues).

I really tried to use snaps, as snap support comes bundled with the distribution of my choice (Manjaro Linux), but Canonical makes it very hard to actually use their stuff.

[galgalesh]

Hi @josefschabasser, I'll address some of your questions here.

This whole snap stuff seems very complicated and the documentation is meh. How does one request auto-connect for a plug?

This is explained in the Permission requests docs, and the pages that doc links to.

The documentation can indeed improve a lot, though there are a bunch of Canonical employees and community members like me working on that. If you have specific feedback about certain pages, you can click the "Help improve.." link at the bottom of the docs, and write a comment there about what information you want to see. This is what those links look like:

Snapcraft is a complex ecosystem, which makes it hard to write good documentation, but the community feedback really helps a lot.

Auto-connect requests for interfaces that don't do that by default are managed at store level, not inside the snapcraft.yaml or other files. Auto-connect for such interfaces is done via manual requests in the store forum. Is this an Aprils fools joke? This makes it hard to manage and work with. Adding and removing stuff through forum requests naturally takes ages.

The answer to this is quite long, but please bear with me. The goal of snapcraft is to create an app store where developers can publish applications themselves on their own schedule. A developer can publish an application in the snap store _without any interaction of the snapcraft people_. This obviously changes how security works. In a traditional repository, the distro maintainers make sure each application is secure and trustworthy before the users have access to it. This is not possible in the snap store. Instead, the snap store tries to protect users by giving each application very limited access to the computer of the user. That is why many interfaces are not auto-connected by default. Many viruses use the camera and microphone to spy on people, for example, so automatically connecting the camera to every application that requests it is dangerous.

That is where the auto-connection requests come in. If an application is expected to use the camera, like Teams for Linux, then the developer can request to automatically connect the application to the camera. The snapcraft team needs to be involved in this because somebody needs to "vet" whether an application is expected to use the camera. Otherwise, a malicious developer would simply say "yes, my virus is expected to use the camera" and nobody could stop them.

Moreover, there is also an effort underway to create better API's for accessing the camera, files and more. XDG desktop portals are standardized API's for Linux desktop applications to securely access sensitive resources. This has a camera portal which requests the user permission when the application uses the camera, similar to how permissions work on Android. These are also supported in snaps for a while now, but applications need to be rewritten in order to use the new, secure API's.

I think this is bad for security, because there is no list of such permissions in the code, web store or desktop store. You have to manually compare snapcraft.yaml (or the desktop stores permission list) to the snapcraft documentation and find auto-connected plugs that don't do that by default.

You are completely right that it should be easy to see which interfaces will auto-connect to an application before installing it. Once the application is installed, you can see the permissions of the app using snap connections <name>. The snapcraft developers are very active on https://forum.snapcraft.io and they respond well to constructive feedback, so feel free to talk to them about this feature request.

Snap definitely is not production-ready because of this and other issues (e.g. snapcore/snapd/pull/7129 and the mouse cursor issues).

Many issues such as a mouse cursor theme not working have been fixed in snapcraft itself for a long time, but individual snaps need to be updated to actually use the cursor themes snapcraft provides. If you know of certain apps that do not use the correct cursor theme, please let us know at https://forum.snapcraft.io so we can see what the issue is, and possibly contact the developers so they can fix their snaps.

It also seems like the PR you are referring to will be available in the next release of snapd, and the developers are working on process changes to make similar PR's land quicker.

[galgalesh]

This auto-connection is now granted. Teams for linux will now be automatically connected to the camera after install.

[IsmaelMartinez]

Thanks a lot @galgalesh !