Request for classic confinement: parsec

[jdstrand]

@touilleMan

From what I understood, snap fuse interface:

• is not connected automatically, meaning user should do an additional manual operation once the snap installed to enable this. I guess the manual phase has to be done only once (and not each time the application is started or each time snapd is restarted).

Yes. There is a process for requesting auto-connection as well: Process for aliases, auto-connections and tracks

@touilleMan

This still leave me puzzled with the Can mount fuse filesystems (as root only). documentation sentence about the fuse-support interface. Does this means once the interface connected, the application must be run as root (typically by having snapd prompt a root password box before actually running it) ?

Yes, this is precisely what it means. The aforementioned PR comment discusses that the fuse-support interface has a number of limitations. You would need a new interface called ‘fuse-control’ and for the core snap to ship fusermount for your snap to work in strict mode as non-root, but see below for a complication.

@touilleMan

• doesn’t support unmounting (even if the mountpoint has been mounted by the same process like in my usecase). This is not compatible with the logout phase of my application. BTW, this is still a bit strange for me given I would say not unmounting your fuse before closing an application can leave a zombie mountpoint (i.e. ls on the path ends up with a Transport endpoint is not connected error), I got the case when using SIGKILL on my application. Is there something I’m missing there ?

You aren’t missing anything. The fuse-support interface is limited (see above). Unmount would be supported by a fuse-control interface.

@touilleMan

• you wrote in the github issue Furthermore, the snap-confine command creates a new mount namespace so the fuse mounts aren’t accessible to other processes outside of the app’s process . Does this means the fuse mountpoint wouldn’t be accessible from 3rd party applications (for instance opening a text file with vi or reading a movie with vlc ?). If so this would make fuse pretty useless so I guess I read this wrong

The fuse-support interface is there to support other scenarios different from allowing a snap to make fuse mounts available to the global mount namespace of the host.

@touilleMan

Of course your request for classic means that the snap wouldn’t be available on classic either.

I’m not sure what you mean by that…

Well, yes, I had a typo I meant to say "Of course your request for classic means that the snap wouldn’t be available on non-classic distro (ie, Ubuntu Core) either.