Reasonable ide (non-classic-)confinement

ide running should have access to limited set of user-files that reside in specific folders of the user’s home-directory.

  • name: janesser-eclipse-pde
  • description: eclipse for eclipse commiters
  • snapcraft: eclipse-snap/snapcraft.yaml.template_confined at master · janesser/eclipse-snap · GitHub
  • upstream: see above
  • upstream-relation: i am publisher
  • interfaces:
    • \personal-sourcedir@personal-files:
      • request-type: connection
      • reasoning: checked out source-code outside of the snap (writable)
    • \personal-workspace@personal-files:
      • request-type: connection
      • reasoning: eclipse workspace configuration (this may be challenged - SNAP_USER_DATA may be a valid alternative
    • \personal-gitconfig@personal-files:
      • request-type: connection
      • reasoning: the interfaces shares user-level git-config (could be set read-only)
    • \personal-sshid@ssh-keys:
      • request-type: connection
      • reasoning: the interfaces shares ssh-keys (cheers to the makers of this interface)
    • \personal-maven-cache@personal-files:
      • request-type: connection
      • reasoning: the interfaces shares maven access secrets and the maven cache

This request has been added to the queue for review by the @reviewers team.

The personal-sourcedir and personal-workspace interfaces are redundant when you just declare the home interface in your apps plug section (they both point to non hidden subdirs in $HOME)…

There is also no need to rename the ssh-keys plug, you can just add it to your apps plug section as is.

3 Likes

thanks for looking into the interfaces. about ssh-keys, adoption is made. i’ve rationalized personal_workspace.

anyways there is no selective restriction over non-hidden home-dirs? mounting just certain path would better fit the confinement idea.

regards, Jan

1 Like

It’s an odd request but I understand the thought and would encourage it on the security basis, and discourage it on the basis that users don’t read and you’ll probably get bug reports all over the place.

It’s worth considering Ubuntu experimentally has prompting support for the home interface, which will soon be in an LTS release (on lunar scales anyway) - this would allow users to have control over the specific subdirs in $HOME in a way that’d be more flexible in layout and better understood, meaning if they did want just a specific folder, they’d be able to choose that, or more.

Ultimately the choice is yours but experience makes me believe the user experience might lead you to reconsider later.

It’s also not impossible that the personal files interface has quirks home doesn’t. I know recently it was seen that personal files didn’t grant mmap syscall access, so .so files couldn’t be loaded in directories using it, whereas the home interface does give this. That seems fairly relevant to your use case but might not happen practically in your platform I guess.

2 Likes

i have adopted all suggestions, as a consequence the snap need clearance for the resulting plugs situation

content[gnome-46-2404]  janesser-eclipse-pde:gnome-46-2404         gnome-46-2404:gnome-46-2404     -
content[gpu-2404]       janesser-eclipse-pde:gpu-2404              mesa-2404:gpu-2404              -
content[gtk-3-themes]   janesser-eclipse-pde:gtk-3-themes          gtk-common-themes:gtk-3-themes  -
content[icon-themes]    janesser-eclipse-pde:icon-themes           gtk-common-themes:icon-themes   -
content[sound-themes]   janesser-eclipse-pde:sound-themes          gtk-common-themes:sound-themes  -
desktop                 janesser-eclipse-pde:desktop               :desktop                        -
desktop-legacy          janesser-eclipse-pde:desktop-legacy        :desktop-legacy                 -
gsettings               janesser-eclipse-pde:gsettings             :gsettings                      -
home                    janesser-eclipse-pde:home                  :home                           -
hugepages-control       janesser-eclipse-pde:hugepages-control     :hugepages-control              manual
network                 janesser-eclipse-pde:network               :network                        -
network-bind            janesser-eclipse-pde:network-bind          :network-bind                   -
opengl                  janesser-eclipse-pde:opengl                :opengl                         -
personal-files          janesser-eclipse-pde:personal-gitconfig    :personal-files                 manual
personal-files          janesser-eclipse-pde:personal-maven-cache  :personal-files                 manual
ssh-keys                janesser-eclipse-pde:ssh-keys              :ssh-keys                       manual
wayland                 janesser-eclipse-pde:wayland               :wayland                        -
x11                     janesser-eclipse-pde:x11                   :x11                            -```
1 Like