Access USB stick from snap desktop application

1

Is there an interface for desktop applications to access USB mounted storage devices?

2

Since you said USB mounted devices, use removable-media. That allows access to filesystems mounted in /media, which is where hotplugged USB devices are typically mounted.

3

Thanks!

I see that this plug is not connected automatically. What is the reasoning behind this? I would think it’s reasonable for a desktop user to expect snaps can access a usb stick…? Is there a process to enable this automatically?

4

It is because removable-media might contain sensitive data and the user should have a voice on when a snap can access this data. Note that snap declarations can be granted to auto-connect the interface for a particular snap, and the work on Connecting plugs and slots in a GUI will make this experience better.

5

Thanks for your response.

But the home plug is connected automatically? :thinking:

Blocking access to removable-media when an app has access to home, provides only minor security/privacy improvements with a big cost: UX. This gives a bad UX since there is no way to inform users that a certain function of an app needs more permissions. The GUI to connect plugs and slots has the same UX issues, because the user has to realize that an app needs more permissions, know about the gui, and turn on the correct permissions.

The reason that it works on Android is because an app can prompt the user for more permissions when something is needed. This is not the case on Linux desktop; hence I think it’s best to auto connect removable-media until we have such a mechanism in place, no?

So in summary:

  • Only minor privacy/security gains because home is auto-connected
  • No precedent in other OS’s: on android “access to files” also means access to removable media.
  • Bad UX because user needs to figure out that something is not working because of permissions and know what to enable and where. This is made harder by the fact that there is no precedent since most users will think that access to files (home) means access to removable media.
6

Please note that all of this is a process of working towards great security and great UX.

Ideally, the home interface wouldn’t exist at all and we would have contextual prompting/great UX for file access not already granted to the snap. Some of this will come with the portals work that is ongoing, some will come with new kernel features. For now we have the home interface and on Ubuntu Core, it is not autoconnected. From a security POV I would personally prefer that it also not be auto-connected on classic distro but since so much existing software assumes writable access in HOME, we auto-connect it. Far less software requires access to removable-media, so we chose to not auto-connect it, but keep in mind software that really expects to use it may be granted a snap declaration so it is autoconnected. While I am not a fan of install prompting in general, for existing software that people can’t/don’t want to patch, we have opted for the GUI as a step towards better UX. I suspect that many of the snaps today that request removable-media will transparently just start to work when portals is enabled, even without removable-media connected.

More succinctly, work is ongoing to make this better:

  • portals will allow snaps that use common toolkits to just work. This should be enabled soon
  • for other snaps, the gui for interface connections is coming and will help. This should also be enabled soon
  • where connecting via the gui is onerous, a snap declaration can be issued to auto-connect the interface. This is available today
  • farther out, we’ll improve prompting/UX for the general case
7

First off, what is a snap declaration? :thinking:

I fully understand and agree that auto-connecting the removable-media snap on classic distro’s isn’t a good solution long-term, but I still don’t understand why it isn’t auto-connecting at this moment while the home directory is auto-connected.

I don’t know what the process is so I see two possible futures:

  1. There is or will be a good mechanism in place to deprecate and stop auto-connecting the home directory once all the other stuff is in place. This means that we could use the same mechanism to deprecate and stop auto-connecting removable-media at the same time as home.
  2. There won’t be a mechanism like that, so snaps will have access to home directory until eternity. This means users need to trust a snap to not do bad stuff to their home, which means that users will probably also trust the snap to not do bad stuff to the removable media. So removable-media shouldn’t require a higher “security clearance” than home…

It’s not that auto-connecting removable-media is good, I just don’t see any benefit to manually connecting removable-media when home is auto-connecting. However, there are big UX issues with manually connecting removable-media as I said before.

The reason why I started to investigate this is because one of the users of the Mattermost snap I maintain, reported that he gets an “server not found” error when dragging files from a usb stick to Mattermost. The cryptic error message is an issue at the Mattermost side, but we also need to give these applications some Slack :wink: in order to improve adoption and usefuleness of Snaps.