2

I can open the default chromium snap on my Ubuntu 20.04 computer. I then right click on the defualt homepage, click Save As, navigate to my ~/home directory, and can proceed to save the .html file anywhere in my home directory.

Why are Snap packages marketed as "sandboxed" when they are not sandboxed in actual usage? If the chromium snap can read/write to my home directory, the chromium program, in essence, has the keys to my castle.

The average person (e.g. me) is most familiar with smartphone environments and likely understands sandboxing as meaning something like:

An app or program shall not have access to any system resource without obtaining explicit permission for said resource, by the system owner.

This is the Android and iOS paradigm I'm used to. And looking at Ubuntu documentation it seems they claim this, when in reality it's not true:

... each package is sandboxed so that it runs in a constrained environment, isolated from the rest of the system...

Or, am I missing something here?

Improve this question
2
  • I would say to that, there should be no "system resources" in your home directory... How/why are your "keys to your kingdom" in your home directory?(being a little facetious...but kinda not)... There are PLENTY of questions here and everywhere else about the difficulty of trying to use devices(outside the home dir) with snaps.... I'd say it's pretty much confined... As long as your home directory is not that of root, that should be the place of least harm, in my opinion...
    – WU-TANG
    Sep 18, 2020 at 18:15
  • @WU-TANG access to a file system and it's file and/or directories is one thing I'd say falls under the umbrella term "system resources". Some may disagree. In this case I'm referring to the ~/home directory. Most average users would likely have their photos, contacts, perhaps medical information, etc. in their home directory. This is why I use the phrase "keys to the castle". I imagine most users (myself included) would like to limit the access to this type of data.
    – Display name
    Sep 21, 2020 at 13:55

3 Answers 3

Reset to default
2

The chromium snap package is properly confined (no classic confinement). The snap package developers for chromium picked and chose the appropriate connections so that the package is nicely confined.

To see the list of connections, run the following. You can use that the snap package has access to your home directory, an access right that is enabled on request on the Snap Store, on a per-case basis.

$ snap connections chromium
Interface                 Plug                               Slot                            Notes
audio-playback            chromium:audio-playback            :audio-playback                 -
audio-record              chromium:audio-record              :audio-record                   -
bluez                     chromium:bluez                     :bluez                          -
browser-support           chromium:browser-sandbox           :browser-support                -
camera                    chromium:camera                    :camera                         -
content[gtk-3-themes]     chromium:gtk-3-themes              gtk-common-themes:gtk-3-themes  -
content[icon-themes]      chromium:icon-themes               gtk-common-themes:icon-themes   -
content[sound-themes]     chromium:sound-themes              gtk-common-themes:sound-themes  -
cups-control              chromium:cups-control              :cups-control                   -
desktop                   chromium:desktop                   :desktop                        -
gsettings                 chromium:gsettings                 :gsettings                      -
home                      chromium:home                      :home                           -
joystick                  chromium:joystick                  :joystick                       -
mount-observe             chromium:mount-observe             -                               -
mpris                     -                                  chromium:mpris                  -
network                   chromium:network                   :network                        -
network-bind              chromium:network-bind              :network-bind                   -
network-manager           chromium:network-manager           -                               -
opengl                    chromium:opengl                    :opengl                         -
password-manager-service  chromium:password-manager-service  -                               -
personal-files            chromium:chromium-config           :personal-files                 -
pulseaudio                chromium:pulseaudio                -                               -
raw-usb                   chromium:raw-usb                   -                               -
removable-media           chromium:removable-media           :removable-media                -
screen-inhibit-control    chromium:screen-inhibit-control    :screen-inhibit-control         -
u2f-devices               chromium:u2f-devices               :u2f-devices                    -
unity7                    chromium:unity7                    :unity7                         -
upower-observe            chromium:upower-observe            :upower-observe                 -
x11                       chromium:x11                       :x11                            -
Improve this answer
2
  • that explains it. I can see that my issue is that the snap permissions are allowed to be determined by those other than the owner (in this case the developer and/or Canonical). I'd rather the owner be asked if permission shall be granted or not. I understand asking for all these permissions could be deemed annoying by many people. Maybe grouping would make sense. Maybe individual requests could be a setting toggled by the end user.
    – Display name
    Sep 21, 2020 at 14:13
  • 2
    The default setting in snap packages is to accept the confinement settings of the packager. If you want, you can add/remove connections using the snap connect command. I suppose someone may create such a GUI tool in the future.
    – user4124
    Sep 22, 2020 at 13:57
1

Snaps installed with --classic aren't sandboxed.

...from man snap

--classic
              Put snap in classic mode and disable security confinement

It makes more sense to restrict some programs, and less other ones.

Improve this answer
2
  • from that I'd have to conclude that chromium was installed in classic mode, and if I were to uninstall it, reinstall with the vanilla snap install chromium that I'd get some type of "you don't have write access to the ~/home directory" error when I try to save files. I'll go try...
    – Display name
    Sep 18, 2020 at 17:37
  • 1
    I doubt that's the case. You could try the --jailmode options.
    – mikewhatever
    Sep 18, 2020 at 17:44
1

Actually, it's perhaps closer to the Android model than you think.

Snap access to the rest of the system is defined by a set of interfaces. One interface for network, another interface for bluetooth, another interface for /home dir (top level only), another interface for all of /home dir, etc.

The allowed interfaces for a snap are listed in the Snapcraft YAML file. Snapd uses that YAML file to implement access control. This is intended to set the baseline minimum access for the application to function properly .

After a snap is installed, you (the admin) can explicitly turn any of those interfaces off (or on) using snapd. You have control.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .