Running the apps inside the snap under non-privileged user

[sborovkov]

Hi,
is it possible to specify services inside the snap to run under non-privileged user? Specifically for services.

[ogra]

not currently (but given that confinement is root-proof you do not actually need to) …

… that said, there is something on the TODO list:

Multiple users and groups in snaps

The previous (obsolete) discussion on the topic is here. To make the discussion clearer I was asked to start a new topic with the currently agreed to design so that we may work through any additional details. As such, I will copy the entire ‘Introduction’ and a description of the 4 use cases from the other topic, but leave the ‘Implementation Ideas’ in the other topic for historical reference. Introduction Today, snappy’s notion of users (and groups) is primitive: daemons run as root commands…

[vpetersson]

I asked Sergey to raise this issue. My worry is that there is a bug (say in AppArmor) that would allow an attacker to break out (similar to Docker breakouts) that were mostly affected by containers running as root.

Do you have an ETA for this?

[ogra]

that is a question for @jdstrand i guess …

[jdstrand]

The status can be found here: Multiple users and groups in snaps (ie, the feature is designed and on the roadmap, but not currently assigned).