0

I would like to allow a snap to access / read / write to a given folder $HOME/some_folder/*, without giving it access to my full $HOME/* (since access to $HOME/some_folder is enough for this snap to do its work, and I would like to "isolate" things as much as possible / give as little access to my system as possible as a precaution, so no reason to give it access to my full $HOME/*).

Is there a way to do so? After reading a bit online, it feels like the "good" way to do so would be to deny this snap access to the home interface, but somehow set up a new (more restricted) interface to $HOME/some_folder to which this snap can be granted access. Is this doable and how?

I am on Ubuntu 22.04, though this should not play any major role I think.

Edit 1

This is for running an externally provided snap on my personal machine - I was not aware initially this information was important. So this means that the AppArmor suggested in the answer is the way to go then :) .

Improve this question
11
  • 1
    Is this a theoretical example for a snap you own and publish, or an example of a snap that someone else owns and has already published?
    – popey
    May 2, 2023 at 18:29
  • It would be for a snap someone else would have already published - discussing with some third party the advantages of using snaps, and this isolation is one of the advantages we were discussing, so being able to check if this kind of isolation is doable would help convince the other actor to release as snap too :) .
    – Zorglub29
    May 2, 2023 at 18:57
  • 1
    Some people religiously downvote anything that doesn't have an Ubuntu release version number in it.
    – popey
    May 2, 2023 at 19:26
  • 2
    Anything is of course possible, given you have apparmor which can limit the folders a snap can "see". But that only "fixes" it for the one user, not globally in the store. The problem will be when the snap is updated from the store, and it wipes out whatever apparmor changes you made locally. Snap isn't designed to be more granular really. It can, however be coerced with options like system-files and personal-files but those require the publisher to do more work.
    – popey
    May 2, 2023 at 19:28
  • 2
    @ThomasWard I know, I alluded to that by saying "by those require the publisher to do more work". It's not odd, that home allows access to home without hidden files, the personal-files requires review because it could be used to access hidden files like .ssh or .gnupg.
    – popey
    May 3, 2023 at 14:18

1 Answer 1

Reset to default
3

Currently, there is no mechanism in Snapcraft plugs that allows this at the "snap on the snap store level"

Right now, Snapcraft only permits the home level connector at the narrowest for access to $HOME.

Per https://snapcraft.io/docs/home-interface which explains this connector:

The home interface allows access to non-hidden files owned by the user in the user’s home ($HOME) directory where a user normally stores their personal files and documents. The majority of snaps use strict confinement and do not have arbitrary access a system’s resources, including file and directories in the /home directory. Without this access, home will not be visible in file requesters, or as a destination from within the snap application.

This is the most narrow access to the $HOME directory that Snaps allow, based on looking through the list of supported connectors. You might be able to achieve stricter confinement with AppArmor profiles specific to your one snap on each endpoint system that has the snap installed, but out of the box in Snaps, no, there's no way to be more narrow with the permitted connectors' access other than what's built into the snapcraft interfaces.

popey is correct in comments that personal-files can be narrower than home interface because you can give specific read/write privileges (see https://snapcraft.io/docs/personal-files-interface) but because this is a Super-privileged interface, any snap distributing personal-files requires special permission and approval from the Store before they can be distributed and installed.

If your goal is to distribute this snap on the store, and you want to go the narrower personal-files interface route, expect there to be enhanced scrutiny and you needing to contact the Snapcraft store managers for special approval for this if your intention is to define these items in personal-files interface plugs. If your intention is to do this, expect to have to go through enhanced scrutiny in your snap first before you can distribute via the snap store.

Improve this answer
1
  • Many thanks for your detailed answer. I now understand that my question was not specific enough - I will update it, I did not know of these different options hence did not know I was vague initially: an unknown unknown :) . My user case is for my own machine and limiting a snap to a smaller area than $HOME on my machine, so that would mean AppArmor if I understand correctly.
    – Zorglub29
    May 3, 2023 at 17:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .