So, I installed my hello snap on my Ubuntu 16.04 LTS machine with strict confinement, and both the hello and bash commands work. However, inside of the bash shell that the command starts, I can read and write to files in my home directory, even hidden ones like .bashrc. Is this supposed to happen? and if it is, isnβt it somewhat of a security risk?
Also, I double checked and the snap is not connected to the home interface. I am trying to learn more about snaps and how they work, so if anyone could explain to me how this works and why it happens I would be grateful.
That example uses confinement: devmode which is effectively unconfined for debugging purposes. devmode snaps cannot be published in the stable channel in the store.
Thank you for the quick reply, but as I said before I finished the entire tutorial and I changed the example snapβs confinement to strict in the yaml file and then rebuilt the snap, and it is still allowing me access to certain nonhidden and hidden files in my home directory.
Did you specify --devmode when you ran snap install with your snap? Did you also re-run snap install once youβd rebuilt the snap with confinement: strict in the yaml?
Accessing non-hidden files is expected if you specify the home interface. As well as snap info (snapname), also snap connections (snapname) and let us know the path you use to launch the binary, would be helpful.
I did not specify --devmode when I installed it, and yes this was after I changed the yaml. Here is the output of snap version:
snap 2.39.2
snapd 2.39.2
series 16
ubuntu 16.04
kernel 4.4.157-0404157-generic
I did not specify the home interface. Here is the output of snap info hello-fritz:
name: hello-fritz
summary: GNU Hello, the "hello world" snap
publisher: Fritz Grunert (fgrunert)
license: unset
description: |
GNU Hello prints a friendly greeting.
commands:
- hello-fritz.bash
- hello-fritz.hello
snap-id: NnFWljwJeiQU7UiR4N7dVNZPsrSO2dmr
tracking: stable
refresh-date: today at 17:06 EDT
channels:
stable: 2.10 2019-06-26 (1) 3MB -
candidate: 2.10 2019-06-26 (1) 3MB -
beta: β
edge: β
installed: 2.10 (1) 3MB -
Snap connections hello-fritz does not give any output. I am not sure if this is what you mean by the path used to launch the binary, but the output of which hello-fritz.bash is: /snap/bin/hello-fritz.bash
The other unique thing is that my directories when building the snap were not the same as what the tutorial showed. Within hello/ I only had a .snap binary, prime/ and snap/. Also when I changed the name to hello-fritz, a new .snap binary was created (with the hello-fritz name), but within mysnaps/hello/snap. Here is the directory structure of hello/ (with some files removed for brevity, which I can add back if theyβre relevant):
Okay, it seems like youβre right @ogra, although the person who installed ubuntu and the kernel swears that they did nothing to change the kernel from what came with the ubuntu image.
So, yes, the confinement support is downgraded to partial. This was confusing to me because the snap is still strictly confined according to snap info --verbose hello-fritz
Anyway thank you all for your help, but I think this point is now moot for me anyway because Iβm going to be switching to Ubuntu 18.04 LTS very soon.