Why can't snap files be modified in any way?

Question

I have been trying for a long time to change Blender's icon, but no matter what I do, I am not allowed to edit anything in /snap/blender-tpaw/3/.

Here's what I tried:

• Editing the files from nautilus without sudo.
• Editing the files from nautilus with sudo (sudo nautilus in terminal ).
• Using terminal commands such as cp or rm without sudo.
• Using terminal commands with sudo (such as sudo cp <source> /snap/blender-tpaw/3/ or sudo rm /snap/blender-tpaw/3/<filename.ext>)
• Doing everything above in a root terminal (using sudo -i)

In every case I get the following error:

cannot remove/copy '/snap/blender-tpaw/3/filename.ext': Read-only file system

where filename is the file and .ext is its extension.

This also applies to other snaps' files, not only Blender.

Am I doing something wrong here? Or is it just impossible to change those files? Although I don't think it is impossible because everything here from Ubuntu to Blender is open-source, so they have no reason to block us from modifying those files.

EDIT:

I used Main Menu (alacarte) to change the icon, but I still want to know why I cannot modify any snap file.

Answer 1

While the premise of the question is technically correct (you can't change files of a snap), there are ways to work around this.

One such way is to use the --bind option in conjunction with mount, to remount the existing file hierarchy to somewhere else.

For example, if you want your snaps to use the system certificates instead of the certificates installed in core, you can mount the directory containing the system certificates on the host on top of the system certificates directory in core with the following command:

sudo mount --bind -o nodev,ro /etc/ssl/certs /snap/core/current/etc/ssl/certs/

This doesn't actually change the snap filesystem. If you unmount the folder, the old folder will take its place:

sudo umount /snap/core/current/etc/ssl/certs

Note: Mounts do not persist between reboots. There are several ways to make mounts persist after a reboot. One such way is to create a systemd startup script:

$ cat <<-EOF | sudo tee /etc/systemd/system/snap-core-current-etc-ssl-certs.mount
[Unit]
Description=Mount unit to fix etc ssl certs in core package
After=snapd.service

[Mount]
What=/etc/ssl/certs
Where=/snap/core/current/etc/ssl/certs
Type=none
Options=bind,nodev,ro

[Install]
WantedBy=multi-user.target
EOF
$ systemctl enable snap-core-current-etc-ssl-certs.mount

Taken from here.

Answer 2

It's impossible to change the contents of the snap without re-building the snap. This is primarily a security measure, to ensure that the snap hasn't been tampered with.

However, the icon referred to is likely in a desktop file called blender-tpaw_blender.desktop which is editable, and can be found in /var/lib/snapd/desktop/applications.

You could change the following line to update the icon:-

Icon=/snap/blender-tpaw/3/meta/gui/icon.svg

Answer 3

Actually it is possible to unpack edit and run snap using snap try command. Here is example for Microstack:

# Remove existing installation:
sudo snap remove --purge microstack

# download and unpack tree
mkdir ~/snap-repo
cd ~/snap-repo
snap download microstack --beta
mkdir ~/snap-tree
cd ~/snap-tree
sudo unsquashfs ../snap-repo/microstack_245.snap 

Now you can freely edit files under ~/snap-tree/squashfs-root. When you are ready you can run snap with those changes using:

sudo snap try ~/snap-tree/squashfs-root/

snap list microstack

Name        Version  Rev  Tracking  Publisher  Notes
microstack  ussuri   x1   -         -          try

When finished you can run snap remove PACKAGE as usual.

Reference: https://snapcraft.io/docs/snap-try