Alternate $HOME workaround request?

[jamesh]

As things stand at the moment, there are two separate things that can break with non-default home directory locations:

1. AppArmor rules making use of the @{HOME} macro do not expand to a pattern that matches the user’s home directory
2. the snap-confine utility does not mount the user’s home directory into the private mount namespace used to sandbox strictly confined snaps.

For (1), it is possible to update how @{HOME} expands by editing /etc/apparmor.d/tunables/home.d/site.local, or dropping a new file in that directory that adds the new parent for home directories. You’ll need to regenerate the profiles after this change.

For (2), the snap-confine utility is hard coded to do recursive bind mounts of /root and home into the private mount namespace. There’s no easy way to override this. So you’re fine if your non-default home directory location is some subdirectory of /home, but not otherwise.

I know @zyga-snapd had some ideas about how to handle non-default locations in a more generic way, but I don’t think anything has come of that yet:

How can I use snap when I don't use /home/$USER?

I have some ideas but it’s a technical idea and I’m not sure the usability would be just right. The technical idea is that whatever your home directory is, it would be mapped to a fixed base inside the execution environment. It could be the new /var/home that is now also used by some other systems. Snapd could make sure that the user’s real home directory is mapped there on startup. We could further manipulate gecos data to make it appear that $HOME is /var/home/$LOGNAME - regardless of the r…