Hi, I am developing a UCore system for Raspberry Pi. So i had a security concern. For Raspberry Pi through USB boot we can access the system files and the root partition. Using that is it possible to access the software in the /snap directory?
if not, Can the software be accessed any other way without having a system-user ?
the /snap directory is just a mount point for the squashfs images located in /var/lib/snapd/snap, the mounted files there are all read-only and will only show up there at runtime when you booted the system. on a Pi which is by design not possible to safely lock down you will indeed always get access to the various files on the file-system, though the interesting data is rather in /var/snap (the writable data files of snaps) than in /snap
So can the files inside /var/lib/snapd/snap be unsquashed to get access to all the software files?
yes, indeed … they are just squashfs files … you wont be able to re-squash them and use them though, since the GPG signature will not match anymore …
So one can get access to the software files, but they cant install or use the Ucore system since its protected by the system user and also the gpg signature wont match
But can we add a snap into the writable partition and make it run on boot? or would it be prevented on a signed image?
