Distributing systemd user daemon with snap- not possible to define standard unit file?

snapd does not let snaps install unit files verbatim because it would make sandbox escape trivial. There are numerous directives that provide commands for systemd to execute. Those commands would be executed by systemd unconfined.

To make it safe, we’d need to validate that the unit file was using a safe subset of directives and that any directives providing commands to execute were rewritten to ensure those commands are run with the correct confinement. It wouldn’t be safe to allow any new directives snapd does not know about, since they may enable command execution.

At that point, having snaps provide unit files would be over-promising on what snapd would deliver. The current yaml based syntax makes it clear what is supported and what isn’t.

Now as for the question of providing units for the user instance of systemd, there is experimental support for that available in snapd right now but gated behind a feature flag. I wrote an outline of this support in this post:

I do hope that this will be turned on by default soon, but can’t give a hard timeline at this point.

2 Likes