I ended up with my snapcraft.yaml like this:
name: rescript
base: core18
version: '3.7'
summary: Rescript bash script for restic
description: |
Rescript is a bash script created to manage backups made with
restic. Restic is a backup program which allows saving multiple
revisions of files and directories in an encrypted repository.
grade: stable
confinement: strict
architectures: [ all ]
apps:
rescript:
command: bash $SNAP/rescript
environment:
HOME: /home/$USER
plugs:
personal-files:
write: [ $HOME/.rescript ]
parts:
rescript:
source: https://gitlab.com/sulfuror/rescript.sh.git
plugin: dump
With these changes when running the script for the first time typing rescript config this is the output:
cat: /home/sulfuror/.rescript/config/.editor: Permission denied
======================
Select Text Editor
======================
[1] Nano
[2] Vim
[3] Gedit
[4] Mousepad
[5] Leafpad
[6] Pluma
[7] Kate
[8] Other
[9] Exit
======================
Select the Text Editor you want to use [ 1 - 9 ]: 1
/snap/rescript/x1/rescript: line 186: /home/sulfuror/.rescript/config/.editor: Permission denied
You have selected [Nano] as your default text editor.
Please type [rescript config] again to set/edit
your configuration/exclusion files.
So the script doesn’t have permissions to access to its files. I tried again changing the configuration files to ~/snap/rescript so maybe that way it could access and manage the files but it doesn’t work. The snapcraft.yaml stayed the same this way except that environment and plugs that are not needed that way. This way, when running the script like this, nano, which is my text editor, doesn’t open configuration files located in /home/sulfuror/snap/rescript/current/.rescript/config/ne.conf. When I use ls -la:
total 24
drwxrwxr-x 2 sulfuror sulfuror 4096 Jan 28 21:31 .
drwxrwxr-x 5 sulfuror sulfuror 4096 Jan 28 21:31 ..
-rw-rw-r-- 1 sulfuror sulfuror 9 Jan 28 21:33 .editor
-rwx------ 1 sulfuror sulfuror 2063 Jan 28 21:31 ne.conf
-rw-rw-r-- 1 sulfuror sulfuror 32 Jan 28 21:31 ne-datefile
-rw-rw-r-- 1 sulfuror sulfuror 349 Jan 28 21:31 ne-exclusions
When I open manually the configuration file using nano ~/snap/rescript/current/.rescript/config/ne.conf it open a blank page. The same with all files. However, if go to the location with my file manager and double click the file, it opens and I can do changes and save the changes.
The worst part about this is that this is a restic wrapper and if I modify the files manually, when I try to do anything, for example, listing snapshots in a repository already created, this is the output:
cat: /home/sulfuror/.rescript/config/.editor: Permission denied
/snap/rescript/x1/rescript: line 1089: /home/sulfuror/.rescript/config/rpi.conf: Permission denied
touch: cannot touch '/home/sulfuror/.rescript/lock/rpi.lock': Permission denied
/snap/rescript/x1/rescript: line 1835: restic: command not found
This is why I think the script needs to be in “classic confinement”, because it just doesn’t work with it’s own files but it also deal with other tools like text editors, sed, cat, grep, it creates configuration files and manage them, a lock file to block other processes and logs; and the most important thing, restic which is distributed as a standalone binary. My guess is that using strict will require me to change a lot of things in the script and I will ended up maintaining two sets of the same script, which is not ideal at all. The code is public, BSD license, free and it is basically “confined” to read/write its own directory only, which always will be at the user’s home directory.
