Syncthing cannot access hidden files and directories

[Vincent]

I’m writing here because I have a strange permission problem with the Syncthing Snap.

Syncthing is a p2p file synchronisation program, I use it to sync documents, photo and fonts across all my devices.

On my new laptop, I recently installed it under Ubuntu Gnome 17.04 who is providing Syncthing as a Snap Package.

As I described the problem in details here : https://forum.syncthing.net/t/cant-share-a-hidden-folder/9830/5
Somehow, Syncthing seems to not have access to hidden folders within my home folder. In this case, it claims not having the permission to acess ~/.fonts although this folder have the same permission as other synced folders.

Could this be a limitation due to the Snap Sandbox? If so, is there a way to fix this permission problem?

thank you

[elopio]

Hello @Vincent!

As I mentioned in the syncthing forum, I see the syncthing case very similar to the editors. We need to read and write files in locations chosen by the users, and sometimes those users will want to access sensitive locations. Some parts of that are being discussed here:

Support for editors and similar in strict mode

I fully agree. I was thinking about some avenues. I was thinking about a hotplug-like interface that would allow access to specific places (e.g. project directory) so that a command line toolchain can be used on it. Desktop apps could use it as well, especially deeply integrated things like atom/vscode. For more casual apps where you don’t typically work with thousands of files I think the portal approach is better (a trusted helper moves the file from host to app) but this is obviously hanging…

Any thoughts and suggestions are welcome.

[niemeyer]

The summary is that yes, this is the snap sandbox preventing arbitrary system access. The home interface provides access to files in $HOME, but it doesn’t grant open access to dotted files and directories because those often contain very sensitive information that we cannot hand off to arbitrary applications.

Per @elopio’s note above, we’ll probably offer a more general solution to open up specified paths to specific snaps in the short to medium term. This was just made much easier now that we’ve just finished the dynamic manipulation of paths inside the sandbox, so perhaps we can address it soon.

[jsmolka]

@niemeyer
I wrote my question as a reply on labix some days ago.
Would you copy the question to this place, please?
Many thanks!

– EDIT ---------

Accessing git config from a strict snap

It is pretty common to have hidden (dotted) config files in the users home! I think the home interface should deal with that. Maybe with a declaration fixed within the snap to avoid free access?!