Classic confinement request: datashare

[pirhoo]

Hello,

I would like to create a snap for Datashare:

Datashare - ICIJ

Revision link for review:

https://dashboard.snapcraft.io/snaps/datashare/revisions/4/

Datashare is a self-hosted search engine for documents. It allows user to index documents on their own computer, and perform search over the extracted text and metadata.

Since several years we offer this tools through a .deb and Docker image. We would like to use the classic confinement so users can index documents stored in their homedir (Datashare creates a dedicated directory for that).

Datashare is open source and developed by the International Consortium of Investigative Journalists. It the same technology our organization used to run famous investigations like the Pandora Papers or the Panama Papers.

Cheers,

Pierre

[alexmurray]

The home interface allows access to files in a users normal homedir - so classic confinement should not be needed.

[pirhoo]

Hello @alexmurray, thanks for the recommendation!

I’m trying to use strict confinement as suggested here:

Limitation when writing to SNAP_USER_COMMON

Hello, Today I submitted a classic confinement request for my app. When running in classic confinement, the application works normally and is able to write data to SNAP_USER_COMMON as expected. In an attempt to use the home interface instead, I’m trying to run it in strict mode. Yet when I start the app, it throws errors, related to ElasticSearch not being able to write in SNAP_USER_COMMON: java.lang.IllegalStateException: failed to obtain node locks, tried [[/home/pirhoo/snap/datashare/commo…

I noticed the $HOME variable is set to $SNAP_ DATA value. Is that the intended behavior for strict confinement?

My connections:

Interface       Plug                      Slot             Notes
home            datashare:home            :home            -
mount-observe   datashare:mount-observe   :mount-observe   manual
network         datashare:network         :network         -
network-bind    datashare:network-bind    :network-bind    -
system-observe  datashare:system-observe  :system-observe  manual
x11             datashare:x11             :x11

[alexmurray]

@pirhoo

I noticed the $HOME variable is set to $SNAP_ DATA value. Is that the intended behavior for strict confinement?

Yes - $HOME is set to $SNAP_USER_DATA so that by default all snaps have somewhere they can write to out-of-the-box - but you can still get the user’s real home via the $SNAP_REAL_HOME environment variable, or just by doing something like: getent passwd "$USER" | cut -d ':' -f 6

[pirhoo]

Thanks, $SNAP_REAL_HOME does the trick!

[ogra]

@pirhoo

$SNAP_REAL_HOME does the trick!

just be aware that on devices where the home interface is not auto-connecting, your app will not have any write access and potentially mis-function (there is indeed a reason why $HOME defaults to $SNAP_USER_DATA and not to *_REAL_HOME)

[pirhoo]

That makes perfect sense. Thanks for the precision!