Closed-source (proprietary), not publicly available
Hello,
I’d like to request classic confinement for the smartloop-studio snap.
The application is SmartLoop Studio, a desktop app built with Electron and
packaged from an existing Debian package (.deb). Classic confinement is
required for the following technical reasons:
Electron/Chromium sandbox
The app ships the Chromium chrome-sandbox setuid helper. Inside a snap
the setuid bit is stripped, so the setuid sandbox cannot initialize, and
the user-namespace fallback is blocked for strict snaps on modern Ubuntu
releases (23.10+ restrict unprivileged user namespaces, and the snap
AppArmor profile prevents their use). Without a usable sandbox, Electron
refuses to launch unless run with --no-sandbox, which degrades security.
Native Node.js module
The app bundles a native module (better-sqlite3) that reads/writes a
local SQLite database and temporary files in runtime paths that are not
reliably covered by the strict home interface.
Pre-built bundle matching the .deb install
The snap wraps our self-contained pre-built binary, which dynamically
links against the host system’s GTK/NSS/X11 libraries. Under classic
confinement it runs on the host libraries and behaves identically to the
native .deb installation, with no large bundled dependency set and no
drift between our supported packages and the snap.
The snap is amd64-only, base core24, and requires full desktop and network
access to function as the native install does.
Your app must fit properly into one of the categories to be considered for classic confinement…
This is the expected way to launch electron apps in snaps since there is already a sandbox the app is running in. Stacking the sandboxes is not really useful
Can you elaborate on this ? By default $HOME in snaps points to $SNAP_USER_DATA (typically ~/snap/<snap name>/current) completely transparently. Your module has all abilities to write there and create directories etc to its liking in this place
Especially under classic confinement you will need to ship all these libraries (instead of being able to simply use one of the snap extensions that provide everything when your snap is strictly packaged). Even a classic snap needs to be able to be run on any distro out there regardless of what GTK/NSS/X11 libs are installed on the host so your snap needs to bundle them to be able to run on i.e. arch linux, fedora or gentoo the same reliable way as it would on Ubuntu …
Note that packaging classic snaps is significantly harder than packaging stict ones since you need to make 100% sure none of the outside libs leak into the runtime of the snap or vice versa, if you rely on a pre-build binary you will very likely need to binary-patch your libs and apps contained in your snap to make sure they do not accidentally use something (like i.e. the dynamic linker) from the host.
Pleas also see:
It has a template for classic confinement requests that helps the reviewers to review it faster …
It makes sense to discuss the confinement requirements carefully, especially if SmartLoop Studio genuinely needs access that strict confinement can’t provide. It would be helpful to clearly document which specific interfaces or filesystem operations require classic confinement and whether any of those requirements could be handled through existing Snap interfaces instead. That would make the security trade-off easier to evaluate and give reviewers a clearer picture of why classic confinement is necessary.
First of all you should upload a .snap, not a .deb file
The error you get is indeed correct, you can only upload a classic snap after the reviewers have decided on the request here and flipped a switch in the store to permit the upload…
For proper review you should use the template I linked above (just edit your original post above) and as I said before, only snaps that fit one of the few supported categories listed on the page I linked above are allowed to receive classic confinement permission at all…
Once your paperwork is complete you will need to wait for two positive reviews, only then you will be allowed to upload…
You will most likely also need to apply for publisher vetting if your application is closed source …
Classic snaps are a very sensitive matter and only few are actually granted the permission…
TBH, your technical reasons are all covered by interfaces (or minor adjustments to the app) with strict confinement (see my answers to the points you made) I doubt you will get classic confinement granted unless you have a very convincing reason you can give to the reviewers
I was able to release build in strict mode (its can read the libsqlite and other GPU related libraries properly), it works as expected, so I guess I don’t need the classic permission
I was able to publish it with strict mode but now, how can I convert into org account instead of it is showing my name / username. I could open different support request but wanted to check first
Your organization needs to create a store account, then you can make them a collaborator.
Once this is done there is a special category under store-requests called transfer-ownership where you can then request the actual transfer with a forum post (similar to this one here)
