Request classic confinement for deezer-linux

[deezer-community]

• name: deezer-desktop
• description: Unofficial port of Deezer Desktop Application. Deezer Desktop is only available on Windows and MacOS. This port only repackages Deezer Desktop for Windows to work on Linux, thanks to electron.
• snapcraft: no snapcraft. electron-builder snap config instead
• upstream: GitHub - aunetx/deezer-linux: An universal linux port of deezer, supporting Flatpak, Appimage, Snap, RPM, DEB...
• upstream-relation: main maintainer
• supported-category: electron application
• reasoning: This application is based on Electron and cannot work under strict confinement because of that. We have tried to remove as much permissions as we could. We have tried plugs and slots (desktop, legacy, wayland…), but classic confinement is still needed.

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces to make the snap to work under strict confinement.

[store-requests-bot]

This request has been added to the queue for review by the @reviewers team.

[Kyuyrii]

So, what exactly didn’t work?

Since you mentioned those plugins, I assume you didn’t use the gnome or kde-neon-6 extension, which may have made creating this Snap more difficult.

[Kyuyrii]

I created a snapcraft.yaml file for your app, using strict confinement and core24, and opened a pull request in the repository.

Snap version with strict confinement.

[ogra]

@deezer-community

supported-category: electron application

Note that this is not a supported category, it would need to be one from the list of supported categories at:

Process for reviewing classic confinement snaps

Classic confinement review process Background As of snapd 2.20, snappy supports confinement: classic which allows the snap to run without restrictions. Future releases of snapd will also support a classic interface (name TBD) that operates similarly. Snaps specifying classic confinement may target the stable channel, but are only supported on classic distro systems (ie, not on Ubuntu Core). Because classic confinement snaps run without restrictions, use of classic confinement effectively gran…

[jslarraz]

Hey @deezer-community

I don’t clearly see any technical reason why this snap cannot run under strict confinement. Could you please share the denials you observe when running you application under confinement?

Thanks

[Kyuyrii]

When trying to create the Snap version with strict confinement, I noticed that I needed to have the shared-memory plug and use “–no-sandbox” in the app startup command.

I suppose the lack of these things made it seem like the app couldn’t work in strict confinement.

[ogra]

The --no-sandbox is normal for electron apps, you really do not want to stack two sandboxes into each other (you already have snap sandboxing around the app) …

Keeping the electron sandbox also requires to run a suid root binary inside the snap which makes it actually less secure…