Is there any way to limit a snap to access only its folder inside /home/user/snap? Or at least, without being able to see outside this /home/user/snap folder?
I mean, in my case, snaps should not be able to access anything other than their own folder inside /home/user/snap. Or at least, they should be limited to see things only inside /home/user/snap folder.
I even tried something like:
sudo snap disconnect chromium:home core:home
But it is useless, as snaps continue to have access to everything inside /home/user
A snap without the home interface is not supposed to be able to read any file in $HOME. If your snap can do that then you either found a bug, or your platform does not provide apparmor.
Snaps can access anything, even when interfaces are removed… Not limited to Chromium, but here, Chromium can access everything, even if interfaces are disconnected.
I am not seeing that. Testing with the chromium snap, if I issue snap disconnect chromium:home and then run the snap, when trying to save a web page to disk I am unable to browse my home directory.
What makes you say that chromium can still access the home directory?