3rd-party app wants communicate with Chromium snap

[Garrel]

3rd-party app (JabRef, jebref.org) wants to communicate with Chromium snap using Native Messaging Hosts. Only following detail was found regarding interface:

$ cat ~/.config/chromium/NativeMessagingHosts/org.jabref.jabref.json 
{
  "name": "org.jabref.jabref",
  "description": "JabRef",
  "path": "/opt/jabref-5.9/lib/jabrefHost.py",
  "type": "stdio",
  "allowed_origins": [
    "chrome-extension://bifehkofibaamoeaopjglfkddgkijdlh/",
    "chrome-extension://pgkajmkfgbehiomipedjhoddkejohfna/"
  ]
}

$ tree --filelimit=6 /opt/jabref-5.9/
/opt/jabref-5.9/
├── bin
│   └── JabRef
└── lib
    ├── app
    │   └── JabRef.cfg
    ├── jabrefHost.py
    ├── JabRef.png
    ├── libapplauncher.so
    ├── native-messaging-host
    │   ├── chromium
    │   │   ├── bifehkofibaamoeaopjglfkddgkijdlh.json
    │   │   └── org.jabref.jabref.json
    │   └── firefox
    │       └── org.jabref.jabref.json
    └── runtime
        ├── bin  [19 entries exceeds filelimit, not opening dir]
        ├── conf
        │   ├── logging.properties
        │   ├── net.properties
        │   ├── sdp
        │   │   └── sdp.conf.template
        │   ├── security
        │   │   ├── java.policy
        │   │   ├── java.security
        │   │   └── policy
        │   │       ├── limited
        │   │       │   ├── default_local.policy
        │   │       │   ├── default_US_export.policy
        │   │       │   └── exempt_local.policy
        │   │       ├── README.txt
        │   │       └── unlimited
        │   │           ├── default_local.policy
        │   │           └── default_US_export.policy
        │   └── sound.properties
        ├── legal  [44 entries exceeds filelimit, not opening dir]
        ├── lib  [40 entries exceeds filelimit, not opening dir]
        └── release

17 directories, 21 files

No idea how to search for further NMH details.

For Linux Manjaro here the connection is not working - JabRef-extension installed in Chromium fails to connect with JabRef app. However, Vivaldi in Linux-native package (not sandboxed) can talk to JabRef with no problems.

How does apparmor be modified in order to enable connection?

Exact same point regarding Firefox snap app.

[aoyama]

This link might be helpful.

Apparmor profile customisation

Hi Here’s what I needed to be able to quickly, for example, modify the Chromium profile in order to debug it with Visual Studio Code. However, the temporary directories of Visual Studio Code webstores were blocked. I am aware of security systems such as sandboxing, selinux, apparmor, firejail… But apparmor is the solution here! Next, for your information, the command “aa-logprof” belongs to apparmor, allowing direct modification of profiles based on denied accesses, in complain mode. For exam…

[Garrel]

Thanks for hint. It is hard to apply provided instructions as the feeling arises in end-effect multiple rules in profile (i.e. also rules not related to presented problem) will possibly be relaxed which is not the desire in case here. In desire is to fix only indicated problem, no more. For us it is also hard to see all possible consequences of presented method. E.g. leaving profile copies at their place instead of working with profile as set by snap app installer.