Currently, there is no mechanism in Snapcraft plugs that allows this at the "snap on the snap store level"
Right now, Snapcraft only permits the home
level connector at the narrowest for access to $HOME
.
Per https://snapcraft.io/docs/home-interface which explains this connector:
The home
interface allows access to non-hidden files owned by
the user in the user’s home ($HOME) directory where a user normally
stores their personal files and documents.
The majority of snaps use strict confinement and do not have arbitrary access a system’s resources, including file and directories
in the /home directory. Without this access, home will not be
visible in file requesters, or as a destination from within the snap
application.
This is the most narrow access to the $HOME
directory that Snaps allow, based on looking through the list of supported connectors. You might be able to achieve stricter confinement with AppArmor profiles specific to your one snap on each endpoint system that has the snap installed, but out of the box in Snaps, no, there's no way to be more narrow with the permitted connectors' access other than what's built into the snapcraft interfaces.
popey is correct in comments that personal-files
can be narrower than home
interface because you can give specific read/write privileges (see https://snapcraft.io/docs/personal-files-interface) but because this is a Super-privileged interface, any snap distributing personal-files
requires special permission and approval from the Store before they can be distributed and installed.
If your goal is to distribute this snap on the store, and you want to go the narrower personal-files
interface route, expect there to be enhanced scrutiny and you needing to contact the Snapcraft store managers for special approval for this if your intention is to define these items in personal-files
interface plugs. If your intention is to do this, expect to have to go through enhanced scrutiny in your snap first before you can distribute via the snap store.
system-files
andpersonal-files
but those require the publisher to do more work.home
allows access to home without hidden files, thepersonal-files
requires review because it could be used to access hidden files like.ssh
or.gnupg
.