Allow classic confinement for postman-agent

[jamesh]

Another topic relating to decisions around native messaging:

System-files under .mozilla/native-messaging-hosts

Hi. I’m snapping a program that makes use of a native messaging host browser addon as an extra companion. For now the integration that is needed is with the non snap version of firefox… one step at a time I have the script in the snap with the binary that is called, and use the json file lo locate it, as the native messaging host is supposed to work (it’s really a mistery to me…but apparently this is it…). Can I use the personal-files interface to have my snap “own” this single file under…

I think the main points to consider from a security perspective:

1. Letting a snap install a native messaging configuration makes sandbox escape trivial. The configuration file contains a command line that the web browser will execute. If that command line is not a snap command wrapper, then it will be executed without confinement.
2. Even if they can trivially escape it, strict confinement can be useful for a native messaging service since it will be run in a well known execution environment. The request for system-files or personal-files access should be treated with similar gravity as a classic confinement request, due to the relative ease of escalating to similar privilege.
3. Having a snapped web browser talk to a snapped native messaging service is probably not going to be possible as a snapped application can not execute another snapped application directly.