Autoconnect request for snap savedesktop

store-requests
22

@pedronis can you please provide your opinion here?

We (some of the @reviewers) were discussing this request for some time today. On one side we provide a system-backup interface, but there are no restore capabilities available to support this use case. On the other side, granting write access to the various personal-files directories requested here not only allows for confinement escape, but also access to very personal or even sensitive information that can be store in those locations.

Even though the requested directories are limited, this looks like a classic confinement request (but backup/restore capabilities are not a supported category).

Also FYI @soumyaDghosh is applying to be a snapcrafters member.

23

Now, I am :slight_smile:

24

Any updates on this?

25

@Igor kindly do the publisher vetting or continue the necessary processes. It’s been very long now.

26

I’m taking over publisher vetting for this one.

@vikdevelop could you please get back to my private message. Thanks.

1 Like
27

@sahnaseredini any updates. Is the vetting done?

28

@soumyaDghosh The vetting is still in process.

29

Should I ping the upstream? He’s actually kinda upset about this long time being taken.

30

I have now vetted the publisher.

But we still need @pedronis input here (as @emitorino mentioned above). Thanks.

1 Like
31

any updates on this?

32

As @emitorino hinted, we have discussed whether using classic for this would give a better signal that this can escape confinement. There’s been varying opinion (it is not an explicitly mentioned category in the classic process page, see also restic discussion) whether classic is appropriate for backup applications but in is generally true that during restore many such applications will need to be able to write to places that allow them to escape confinement. The main reason to pursue a confinement route would be for cases where Ubuntu Core is the desired installation target. Classic also needs vetting. It also true that for desktop a combination of read permission and in-progress prompting support on write might cover some backup cases, this approach is not immediately available though.

33

What I proposed/asked regarding this, is to allow the snap, but don’t auto connect, and this is not only for this snap, but for all the snaps.

34
  • Allow this to only open-source snaps(so that anyone can verify it)
  • Allow auto-connect only if the app upstream/developer confirms by showing their code that they don’t write to those folders directly.

Neither of these work because once the developer has permission, a bad actor could publish a proprietary opaque application under the same name.

  • With every new release, the maintainers must create a post in forum asking continuation of the autoconnection and if they don’t after a week, revoke the auto-connection. Thus, malicious changes done in new releases, can’t be pushed to the users.

The platform doesn’t allow for that, and would need significant design and development work to make it happen. So basically won’t happen.

Further, it places additional load on the review team. This conversation is already 2+ months old. Imagine that every time you do an update.

  • Backup apps should be given some space. This app falls into that category as it takes backup of the current desktop. If an app can qualify even for the classic confinement, why not this.

Contentious opinion - Not everything has to be a snap.

1 Like
35

This snap will mainly help users with LTS releases and other distros that doesn’t ship the latest gtk4 libraries. Can this snap be given access to at least allow the app to be in the store, with the plugs not auto connected on installation, but can be manually connected? Because not everyone will need every folder. Like someone from gnome will not need $HOME/.cinnamon, $HOME/.xfce and vice-e-versa. It’ll be great if this is allowed. @vikdevelop what’s your take about this?

1 Like
36

@dclane can we kindly get the allowance to upload the snap in the store without an auto connection to the plugs?

37

any updates on this?

38

Hi, there has been no update on this for more than a month now. Can this snap be allowed without autoconnections?

39

@reviewers have discussed this offline and have agreed that we will treat this like a classic snap. We have decided to grant auto-connect to the personal-files interface.

Could you please adjust the snap yaml to partition the dot-folders interface into individual groupings based on requested path. i.e

plugs:
  dot-config:
    interface: personal-files
    write:
    - $HOME/.config
  dot-local:
    interface: personal-files
    write:
    - $HOME/.local
...
40

Hi, @cav Thanks for your help. I have renamed all as you requested. A snap is currently building based on that. Kindly allow it.

41

Hi @soumyaDghosh, this is now live.

1 Like