The simple answer is that yes, it is possible for a classic snap to execute scripts as root similar to a .deb package. However, it doesn’t look like the Slack snap is using any hooks at present.
Through the use of the configure
, install
, and remove
hooks, snaps can execute code as root on install, update, and removal:
For classic snaps these hooks run effectively unconfined, which is one of the reasons uploads of classic snaps to the store trigger manual review.
For strict confined snaps the hooks still run as root, but are run under the snap’s confinement policy that restricts what files it can read and write. In particular, the hook won’t be able to read any files in your home directory (the AppArmor rules granting access there use the @owner
modifier, which requires files be owned by the same user as the process).