Snap application doesn't see files from another partition

Question

I have installed KeePassXC snap package on Ubuntu 17.10. I have multiple linux systems installed on the same drive, so I have made most of my home folders like ~/Documents created as links to a separate ext4 partition (users have same uid so permissions are correct). I tried to open my passwords' database which I have inside Documents, but keepassxc cannot see any files inside Documents. If I put the file in my home folder then it sees it.

Are snap packages able to find files outside from my home folder? Any way to make KeePassXC (and the rest snap packages) access the files at my separate ext4 partition (maybe some configuration somewhere)?

Answer 1

Snaps are typically confined. By default snaps can access nothing but their own writable areas, but they can gain permissions by way of interfaces. There are two interfaces that provide the ability to access files beyond the default: the home interface, and the removable-media interface. I assume KeePassXC uses the home interface, which is how you can access ~/Documents. Perhaps it even uses the removable-media interface, but that only covers stuff mounted into /media or /mnt. If your other partitions are mounted elsewhere, the snap will not have permission to follow the symlinks.

The ways to make this work, ordered by difficulty:

1. Mount the partitions into your home directory rather than symlinking them.
2. Mount the partitions into /media and ensure KeePassXC uses the removable-media interface. This may be an upstream change, but a small one.
3. Change KeePassXC into a classic snap, thereby making it no longer strictly confined. This is a larger change and upstream may not be interested in it.

Update: The KeyPassXC snapcraft.yaml is here. Looks like it already has the removable-media interface. All you need to do to follow (2) is to connect it (it's not automatically connected):

$ sudo snap connect keepassxc:removable-media

Answer 2

I ran into a similar issue with the makemkv snap application on Ubuntu 20.04

I was able to solve the issue with a bind mount:

sudo mount --bind /data/wip /home/user/Videos/wip

This allowed me to mount my data drive into the /home/ tree so the snap application can access it like Kyle mentioned above.

Answer 3

Just to add to Kyle's answer, some packages from the Ubuntu Software Store need this command too.

In my case kdenlive could not read my other hard-drive. The following command worked:

sudo snap connect kdenlive:removable-media

Answer 4

Here is a quick fix to make a snap application behave as a classic install, i.e. no confinement whatsoever.

Simply created a symlink to the binary into /usr/local/bin, like so:

/usr/local/bin/pdftk -> /snap/pdftk/current/usr/bin/pdftk

(Surprisingly, this specific application is being setup with "confinement: strict", which is very annoying because, at it is, it will not work on files from other file systems.)